42 U.S.C. § 19037 — Research security and integrity information sharing analysis organization

(a) Establishment. The Director must contract with a qualified independent organization to set up a research security and integrity information sharing analysis organization, called the RSI-ISAO here. It must include the members described in subsection (d) and carry out the duties in subsection (b). (b) Duties. The RSI-ISAO must: act as a clearinghouse of information to help members and others in the research community understand their research's context and spot improper or illegal efforts by foreign entities to steal research results, know-how, materials, or intellectual property; build standard risk-assessment frameworks and best practices for assessing research security risks in different settings; share information about security threats and lessons learned through forums and other communication; give timely reports on research security risks to keep the research and STEM education community aware of the situation; offer training and support, including webinars, for faculty and staff at colleges on research security topics; set up standardized ways to gather, store, and analyze compiled incident reports; help members spot patterns of risk and identify bad actors, and improve their ability to prevent and respond to threats; and take other steps as appropriate to boost research security. (c) Funding. The Foundation may provide starting funds for the RSI-ISAO, but must work toward having membership fees (described in subsection (d)(2)) cover its running costs as soon as practical. (d) Membership. (1) In general: The RSI-ISAO must serve and include members from institutions of higher education, nonprofit research institutions, and small and medium-sized businesses. (2) Fees: As soon as practical, members must be charged an annual fee to help cover the RSI-ISAO's costs. Fees must be set on a sliding scale based on how much each member spends on research and development, so membership stays affordable for a wide range of participants. The RSI-ISAO must also develop a plan to keep running without federal funding, as far as that is practical. (e) Board of directors. The RSI-ISAO may set up a board of directors to guide its policies, legal issues, and strategy. The board should include a mix of stakeholders, including people from academia, industry, and experienced research security administrators. (f) Stakeholder engagement. In setting up the RSI-ISAO, the Director must make sure its services fit what the research community actually needs. The Director can do this by holding workshops or other events with multiple stakeholders, or by publishing a description of the planned services and membership requirements in the Federal Register and taking public comments for at least 60 days.