Protecting Innovation and National Security
ARMY SBIR|STTR FOREIGN RISK EVALUATION PROGRAM
The Army SBIR|STTR Foreign Risk Evaluation (FRE) Program protects the Army’s small business investments, partnerships, and national security interests, ensuring that the program awards small businesses with acceptable risk of malign tech transfer and sabotage. The team implements foreign risk evaluation reviews for every proposal seeking research and development funding from the Army SBIR|STTR Program.
Risk Factors
In accordance with the Small Business Innovation and Economic Security Act of 2026 (Public Law 119-83), the Army SBIR|STTR FRE team conducts step-by-step risk assessments of small business structures, personnel, and partnerships to protect U.S. intellectual property and defense capabilities, using a standard five-year lookback period. Following every proposal submission, the team reviews risk factors that may indicate potential Foreign Ownership, Control, or Influence (FOCI) concerns, particularly those linked to foreign countries of concern (FCOC) or designated FCOC.
The Army SBIR|STTR Foreign Risk Evaluation Team provides risk analysis and recommendations, not award decisions. The Office of the ASA(ALT) is responsible for final assessment of risk and award determination.
Please refer to the Department of War (DoW) Foreign Risk Evaluation website page for the 2026 DoW SBIR|STTR FRE Program Common Decision Matrix, dated 08 July 2026 (https://www.defensesbirsttr.mil/FRE/). The Army’s assessment is not limited to the factors or countries of concern listed in that matrix. Instead, the Army evaluates the mandatory Foreign Disclosures provided with each proposal and all areas identified under 15 U.S.C. § 638(vv), including cybersecurity practices, patent analysis, employee analysis (including subcontractor employee foreign affiliations), foreign ownership, financial ties and obligations, and employee ties to foreign entities.
If a proposal presents a prohibited factor (such as ties to specifically restricted government entity lists) or an unacceptable risk to national security that cannot otherwise be mitigated, the team will recommend denial of the award, otherwise we strive to make every attempt to mitigate risks identified that may prevent an award.
Foreign Ownership, Control, or Influence
What’s the Risk? Malign Tech Transfer & Sabotage
Indicators: Prohibited entity ties; risk related to investors; employee affiliations with designated foreign countries of concern or foreign countries of concern; designated foreign countries of concern or foreign countries of concern-based parents, subsidiaries, joint ventures, etc.; company and individual patent transfers; number of employees with designated foreign countries of concern or foreign countries of concern affiliations; percentage of employees at company with designated foreign countries of concern or foreign countries of concern affiliations.
Cyber
What’s the Risk? Compromise or Theft of Valuable Information
Indicators: Risk related to overall cybersecurity posture; failure to meet required defense cybersecurity posture standards; and vulnerabilities in safeguarding intellectual property and controlled information from adversary exploitation.
Integrity/Fraud, Waste & Abuse
What’s the Risk? Waste of Taxpayer Dollars
Indicators: Risk related to regulatory and fraud history; discrepancies between company self-disclosures and publicly/commercially available business intelligence; and attempts to obscure ultimate beneficial ownership or foreign investor ties.
Patents & Intellectual Property (IP)
What’s the Risk? Intellectual Property Theft & Sovereign Tech Leakage
Indicators: Past patent transfers, licensing agreements, or technology-sharing agreements with entities or individuals in a foreign country of concern; patents funded by U.S. government research that were subsequently filed, registered, or assigned in foreign countries of concern; and joint-venture structures that legally grant foreign investors veto rights over IP utilization or transfer.
Foreign Financial Obligations & Relationships
What’s the Risk? Coercion and Undisclosed Foreign Leverage
Indicators: Debt, loans, or surety bonds held by the small business that originate from foreign banks, foreign venture funds, or foreign persons; financial obligations of “covered individuals” (such as key founders or Principal Investigators) to foreign institutions; and technology licensing agreements that require royalty payments or operational reporting to foreign adversaries.
Research Integrity & Conflict of Commitment
What’s the Risk? Dual-Service Conflicts and Misappropriation of R&D
Indicators: Key personnel or PIs with active or historical memberships in foreign talent recruitment programs (specifically, Malign Foreign Talent Recruitment Programs (MFTRPs) as defined by federal statute); concurrent employment, positions, or honorary appointments at research institutions located in a foreign country of concern; and co-authorships or research funding originating from foreign adversary-backed laboratories.
Supply Chain & Restrictive List Compliance
What’s the Risk? Operational Sabotage, Backdoors, and Legal Non-Compliance
Indicators: Business relationships, software integrations, or material sourcing linked to companies on U.S. government enforcement, sanctions, or restricted lists (e.g., Section 1260H, BIS Entity List, or Section 889); and reliance on critical materials or manufacturing capabilities controlled by foreign countries of concern.
Understanding Countries of Concern
It is important to note the distinct difference between the following terms used in our risk evaluations:
Foreign Countries of Concern: A baseline list of nations automatically classified by federal statutes (such as the CHIPS Act for SBIR/STTR). Currently, this includes the Peoples Republic of China (PRC), Russia, Iran, and North Korea.
Designated Foreign Countries of Concern: Nations that are officially designated or added to restrictive lists by an executive authority (such as Department of War/DoD components) under specific statutory powers to mitigate emerging national security risks. For example, a DoW component may identify a specific nation as high-risk for technology transfer based on the evolving global threat landscape and add them to a restricted list.
Foreign Risk Evaluation Frequently Asked Questions
What law and policy guides the Army SBIR|STTR Foreign Risk Evaluation Program?
The SBIR and STTR Extension Act of 2022 (Extension Act), Public Law 117–183 (Sep. 30, 2022), which amended section 9 of the Act, 15 U.S.C. 638(g)(13)–(17), (o)(17)–(21), and (vv), and the Small Business Innovation and Economic Security Act of 2026 (Economic Security Act), Public Law 119–83 (Apr. 13, 2026), jointly require small businesses applying for SBIR or STTR awards to disclose information about the applicant’s investment and foreign ties. In response, the SBA amended Section 9(a) of the Policy Directive and added an appendix to address the responsibilities of Participating Agencies to collect these disclosures. This amendment provided a common template, based on the statutory language in the Act, to uniformly capture the required disclosures.
Per the Extension Act, the term ‘‘foreign country of concern’’ means the People’s Republic of China, the Democratic People’s Republic of Korea, the Russian Federation, the Islamic Republic of Iran, or any other country determined to be a country of concern by the Secretary of State. Currently, there are no additional countries of concern designated for the purposes of the SBIR and STTR program by the Secretary of State.
The SBIR and STTR FRE Program (formerly the Due Diligence Program) implements the 2026 risk assessment framework mandated by the Department of War. The program’s security review process is guided by the 2026 Department of War (DoW) SBIR and STTR Foreign Risk Evaluation Program Common Decision Matrix, which establishes the standardized areas of risk assessment to inform evaluations and decision-making.
How does the Army SBIR|STTR Foreign Risk Evaluation process work?
The Army SBIR|STTR FRE team assesses both company disclosures and business intelligence data through our providers. Once a small business submits a proposal via DSIP, the team identifies any discrepancies between the forms, and/or foreign nexus, and/or other business concerns from the business intelligence data to produce a Secondary Review report. The team uses the Secondary Review report to triage proposals based on risk indications and to determine whether the proposal requires enhanced deep-dive foreign risk evaluation reviews. Once deep-dive reviews and any necessary referrals are complete, the team finalizes the risk assessment and presents findings alongside the technical review in the proposal approval meeting for award decision.
What risk factors does the Army SBIR|STTR Foreign Risk Evaluation Team assess?
See Risk Factors above and also reference 2026 Department of War (DoW) SBIR and STTR Foreign Risk Evaluation Program Common Decision Matrix.
If I have foreign countries of concern investment or an individual working on the project team with a foreign country of concern affiliation (e.g., co-authorship, funding, etc.), is my proposal automatically denied?
No – the Army SBIR|STTR FRE team will independently assess each proposal using the standard foreign risk evaluation process. For proposals exhibiting significant risk indicators, such as covered individuals with foreign countries of concern affiliations or investment, the FRE team will conduct enhanced deep dive reviews on the indicated risk and overall proposal. The presence of individual risk indicators will not cause the team to automatically deny a proposal. The only reason for automatic risk-based denial would be continuous and systemic issues within the small business concern, which raise the probability of loss or damage to the Army to an unacceptable level.
What tools does Army SBIR|STTR employ when conducting foreign risk evaluation?
The Army SBIR|STTR FRE team conducts evaluations by cross-referencing company submitted disclosures with a combination of publicly available information (PAI), commercially available information (CAI), open-source research, and commercial business intelligence tools.
As a small business, how can I vet my company and employees internally prior to submitting a proposal to reduce my risk?
Capitalization Table Assessment
Know your investors: Where are your investors headquartered? Who are the key stakeholders in that business? Do any individuals have potential foreign countries of concern affiliations? Are there any agreements with investors regarding IP that increases malign tech transfer risk?
Employee Assessment
Know your employees: Do your company executives or individuals involved with the SBIR and/or STTR project have any foreign countries of concern affiliations?
Examples:
- Co-authorships with individuals with positions/appointments at foreign countries of concern-based research institutions
- Current or historical membership in a talent program with a foreign country of concern-based institution
- Current or historical position or appointment at a foreign country of concern-based institution
- Employment at a business or institution within a foreign country of concern
- Research funding from a foreign country of concern-based research institution
- Any other significant ties to individuals or institutions within a foreign country of concern
Open-Source Tools
Even without sophisticated vetting tools, you can achieve a good understanding of Foreign Ownership, Control, or Influence risk (knowing your employees and investors) using open-source research (including Boolean searches and other methods).
What is Foreign Risk Evaluation?
FRE is a risk assessment process designed to protect U.S. intellectual property and defense capabilities. The evaluation process confirms or denies reported foreign interests and associations while uncovering unreported factors representing potential conflicts of commitment or interest. As it pertains to congressional requirements for the SBIR and STTR Programs, foreign risk evaluation primarily focuses on confirming, denying, or uncovering facts or details of Foreign Ownership, Control, or Influence, cybersecurity hygiene, and intellectual property/patent risk of each proposal.
Resources & Contact Us
For additional foreign risk evaluation information, please visit the Resources page of the website.
For questions on the Army SBIR|STTR FRE Program, contact the team here.