How SBIR Proposals Get Screened for Foreign Ties

The Department of War’s FY2027 Release 1 closes on November 25, 2026. Per the record for Navy SBIR and STTR Phase I, the release opened October 28, with a Phase I base of up to $200,000 for exactly six months plus an option of up to $115,000 — $315,000 in all. Buried in the same record is a line that has nothing to do with the technology: Volume 7 disclosures feed the Department of War’s Foreign Risk Evaluation.

Volume 7 is not part of your technical proposal. It feeds a separate review that can stop an award on its own, and most of what it examines is settled long before you open a solicitation.

What the Screen Is, and Why It Is Not Peer Review

Every federal agency that runs SBIR or STTR is required by statute to operate this review. Under 15 U.S.C. § 638(vv), the head of each participating agency, coordinating with the Small Business Administration, “shall establish and implement a due diligence program to assess security risks presented by small business concerns seeking a federally funded award.” The statute lists eight things each program assesses, using a risk-based approach: the cybersecurity practices of the small business; patent analysis; employee analysis; foreign ownership of the applicant, “including the financial ties and obligations (which shall include surety, equity, and debt obligations)” of both the company and its employees to a foreign country, person or entity; foreign affiliations of a covered individual, owner or key personnel with an entity in a foreign country of concern; investment relationships with one; technology licensing agreements or joint ventures with one; and business relationships between key personnel and one.

Notice what is absent. None of it is about the project. Six of the eight are about who owns you, who funds you and who works for you. The review that judges your science is a different review, and passing one says nothing about the other.

The screen also runs a list check. The statute requires agencies to examine any relationship between the applicant and an entity or individual on eight government lists — among them the UFLPA Entity List, Treasury’s Non-SDN Chinese Military-Industrial Complex Companies List, the Section 889 Prohibition List, the Section 1260H list of Chinese military companies, and Commerce’s Entity List. Agencies may spend up to 2% of their SBIR funds on all of this, and the authority terminates September 30, 2031.

The Hinge Is “Covered Individual,” and It Is Wider Than You Think

Most of the denial triggers attach to a “covered individual,” so the definition decides how far the screen reaches into your team. Per NIH’s April 2026 policy notice, a covered individual is someone who “contributes in a substantive, meaningful way to the scientific development or execution” of the proposed project, or who is identified in the application as senior key personnel. That is two tests, not one. The second is a list you write. The first is a description of a role, and a person can satisfy it without appearing on any form you filed.

What gets disclosed is equally broad. A “foreign affiliation” means a funded or unfunded academic, professional or institutional appointment with a foreign government or government-owned entity — “whether full-time, part-time, or voluntary (including adjunct, visiting, or honorary).” An unpaid honorary title at a state university abroad qualifies. So does a visiting appointment nobody has thought about in years.

Agencies differ on who this covers. In GAO’s January 2026 report — the third in a required series — the auditors found that as of August 2025, all eleven participating agencies had incorporated only three of the twelve best practices the SBA published in March 2023, and that determining which individuals must submit disclosures was among the practices some agencies had not adopted. The Department of Agriculture closed that gap only in September 2026, designating covered individuals to include all key personnel identified in an application and to extend to subcontracted employees whose technical or scientific contribution is critical to the work. If your STTR research partner staffs the project with someone you have never met, at USDA that person is now inside the screen.

Eight Findings That Make an Award Impossible

Most of the screen is judgment. A specific set of findings is not. Per the NIH notice, HHS “cannot make an award” under SBIR or STTR if the applicant has any of the following: an owner or covered individual party to a malign foreign talent recruitment program; a business entity, parent company or subsidiary located in the People’s Republic of China or another foreign country of concern; an owner or covered individual with a foreign affiliation with a research institution in one of those countries; a connection to an entity or individual on any of the eight lists above; a security risk whose primary source is classified; or a security risk the agency determines warrants a denial.

Two features of that list matter. The fifth means you can be denied on information you are not permitted to see. The sixth is open-ended by design.

And at HHS there is no cure. The notice states plainly that HHS “will not provide applicants the opportunity to address any identified security risks prior to award.” The agency names the category that caused it, and a denial does not bar you from a later cycle, but the correction happens after the decision. For the NIH, CDC and FDA Parent SBIR and the Parent STTR, both carrying deadlines of April 5, 2027 per their records, that makes your disclosure forms a one-shot filing.

The Army describes a different posture. Per the Army SBIR|STTR foreign risk FAQs, a covered individual with a foreign country of concern affiliation, or investment from one, does not produce an automatic denial: proposals showing significant risk indicators get “enhanced deep dive reviews,” and individual risk indicators do not by themselves decide the outcome. AFWERX says the same. Both are mandatory-denial regimes too; the difference is how much assessment happens before a finding becomes one.

The Screen Is Not Looking Only at What You Wrote

A common misreading is that the screen checks your disclosure form for problems. It checks your disclosure form against everything else. Per the Army FAQs, the Foreign Risk Evaluation team cross-references company-submitted disclosures with publicly available information, commercially available information, open-source research and commercial business intelligence tools, then produces a Secondary Review report used to triage proposals. The statute names this directly: agencies assess proposals, using open-source analysis and analytical tools, for the nondisclosure of required information. Omission is a finding, not a gap.

GAO’s November 2024 report gives the concrete case. One agency found that although an applicant had not disclosed foreign affiliations for key personnel on their disclosure form, the principal investigator had likely received funding from a Chinese malign talent recruitment program. The agency did not make the award. In fiscal 2022 the eleven agencies made more than 6,500 SBIR and STTR awards worth more than $4.4 billion to over 4,000 small businesses.

It Does Not Stop at Award

The obligation continues for the life of the award, and its penalty is unusual. Per the NIH notice, recipients must submit an updated disclosure form for any change to a previous disclosure, any material misstatement posing a risk to national security, and any change of ownership, entity structure or other substantial change in circumstances the agency determines poses such a risk. Updates are due at every annual, interim and final RPPR, and between reports within 30 days of a change in ownership, entity structure or covered individual.

Then the recovery clause. A company “will be required to repay all amounts received” from NIH, CDC or FDA under the award if the agency determines either that the company made a material misstatement posing a risk to national security, or that a change in ownership, entity structure or circumstances poses one. Not the unspent balance. All amounts received.

That makes a Phase II raise a disclosure event. A new strategic investor, a parent entity added in a restructuring, a foreign fund joining a round — each starts a 30-day clock, with repayment exposure on money already spent on salaries.

GAO found agencies inconsistent here too: its first recommendation in the January 2026 report asks the Air Force to tell awardees in writing that updated disclosures are due within 30 days of substantive changes, and that was still open as of the Department’s June 2026 response. Education closed the same recommendation by writing the sentence into its FY2026 solicitations. Where your agency has not said it in writing, the obligation still exists.

The Same Statute, Eleven Different Implementations

One screen, written once, run eleven ways. GAO’s January 2026 report made 26 recommendations across ten agencies and the SBA; all agreed.

The cybersecurity assessment shows the spread. GAO found nine of the eleven agencies and components assessing applicants’ cybersecurity through business intelligence tools or self-assessment forms. Two were not assessing all applicants: the National Science Foundation, whose officials said its applicants are small and nascent companies with limited electronic assets to protect, and the Department of Agriculture, which had understood that training applicants would suffice.

Both agencies have money open now. Per its record, the NSF SBIR/STTR Phase I, Phase II and Fast-Track solicitation closes March 4, 2027, with each company able to receive up to $2 million for research and development. The headline figure on that listing is a program total rather than an award ceiling — an award cap and a program total are different things. Per its own record, the USDA NIFA SBIR/STTR Phase II program, Assistance Listing 10.212, pays $600,000 to $650,000 and closes November 17, 2026.

On the defense side the review has a name and a published rubric: the Department of War’s Foreign Risk Evaluation Program replaces what was called the Due Diligence Program, per AFWERX, and both AFWERX and the Army point applicants to an FRE Program Common Decision Matrix. The open FY2027 Release 1 records all close November 25, 2026 — Office of the Secretary of War topics at up to $2,153,927, AFWERX topics 27.BZ and 27.BX at up to $2.1 million, the Navy at up to $315,000, and DARPA topics at $150,000 to $2,300,000. The AFWERX record also requires a company more than 50% U.S. owned and controlled — ownership as eligibility rule and screening input at once.

What to Check Before You File

The screen runs on facts that take months to change. Doing this the week of a deadline is late, but better than not doing it.

1. Write down every covered individual by the role test, not the form. Start from who contributes substantively to the scientific work, then check that against your senior key personnel list. If an STTR partner or subcontractor staffs part of the project, ask whether your agency counts those people — USDA now does.
2. Ask each one about appointments, not jobs. The definition reaches unpaid, honorary, adjunct and visiting positions with a foreign government or government-owned entity. People do not think of those as affiliations and will not volunteer them.
3. Read your cap table the way the screen reads it. The Army FAQs suggest asking where your investors are headquartered, who the key stakeholders in those entities are, and whether any investor agreement about intellectual property increases technology transfer risk.
4. Run the eight lists yourself. They are public, and checking your investors, parent entities, subsidiaries and suppliers against them tells you what a finding would be before the government makes it.
5. Find out whether your agency lets you answer, and calendar the 30-day rule. HHS says in writing that it will not give you the chance before award; others review more deeply first. On an active award, treat any ownership change, restructuring or new covered individual as a reporting event, and read the repayment language before you close a round.

Disclosure is not an admission. GAO’s recommendation to USDA was that the agency tell applicants disclosure does not mean denial, and USDA put that on its foreign disclosure page in September 2026. The failure mode here is not having something to disclose. It is not knowing what you have.

Questions Founders Ask

Does a foreign affiliation disqualify my company? Not by itself. Per the Army’s FAQs and the AFWERX program page, an affiliation or foreign investment triggers closer review rather than an automatic denial. A specific set of findings in the statute does require denial — an owner or covered individual party to a malign foreign talent recruitment program, a parent or subsidiary located in a foreign country of concern, or a connection to one of the eight named lists, among others.

Can I fix a problem after the agency finds it? At HHS, no — the notice states the agency will not provide an opportunity to address identified security risks before award, though a denial on security grounds does not make you ineligible in a subsequent cycle. Other agencies review more deeply before reaching a denial, but none commit to a cure period.

What happens if my ownership changes after the award? Per the NIH notice, an updated disclosure is due within 30 days of a change in ownership, entity structure or covered individual, and at every RPPR. If the agency determines the change — or a material misstatement — poses a risk to national security, the company is required to repay all amounts received under the award, and the agency may terminate it.

Does this apply outside the Department of War? Yes. The requirement in 15 U.S.C. § 638(vv) binds every federal agency that runs an SBIR or STTR program. The eleven implement it differently — the subject of GAO’s three-report series — but none is exempt.

The Bottom Line

The security screen is the part of an SBIR or STTR application that cannot be written well under deadline, because it is not writing. It is a set of facts about ownership, investment and personnel that already exist on the day you decide to apply, assessed against public lists and commercial intelligence by an office that never reads your technical volume. Companies working to the Department of War’s November 25 close, USDA’s November 17 or NSF’s March 4 have different amounts of time and the same preparation to do.

You can see which SBIR and STTR programs are open, who runs them and when they close in the SBIR and STTR funding hub, alongside the per-agency limits on how many proposals you can submit and the broader startup funding programs. Subscribe to Funding Friday, our weekly grant digest, to keep up with what opens and what closes.