42 U.S.C. § 19234 — Research security training requirement for Federal research award personnel

(a) Annual training requirement: 1. In general: Within 12 months of August 9, 2022, every federal research agency must set up a rule that, as part of a research award application: (A) each covered individual named on the application must certify that, within the year before applying, they finished research security training that meets the guidelines from (b); and (B) each institution or organization applying must certify that every covered individual it employs and lists on the application has completed that training. 2. Consistency: The OSTP Director must make sure the training requirements different agencies set up under (1) match each other. (b) Training guidelines: The OSTP Director, working through the National Science and Technology Council and using authority from an earlier law, must — after considering input from stakeholders — write guidelines that institutions and organizations getting federal research money can use to build their own training programs. These programs should fit each institution's own needs, challenges, and risk level, and can include the training modules described in (c). The point is to comply with National Security Presidential Memorandum-33 (which is about protecting U.S.-funded research from foreign government interference) or whatever document replaces it. (c) Security training modules: 1. In general: Within 90 days of August 9, 2022, the OSTP Director — working with the Directors of the National Science Foundation and the National Institutes of Health, the Secretary of Energy, and the Secretary of Defense, and consulting with other relevant agency heads — must hire a qualified organization to build online research security training modules for the research community and for people in the U.S. research and development system. This is to keep compliance with NSPM-33 or its successor. The modules must: (A) cover cybersecurity, working and traveling internationally, foreign interference, and the proper rules for using funds, disclosing information, and avoiding conflicts of commitment or interest; and (B) be tailored to fit the different needs of (i) covered individuals; (ii) undergraduate students, graduate students, and postdoctoral researchers; and (iii) people applying for Small Business Innovation Research or Small Business Technology Transfer program awards. 2. Stakeholder input: Before hiring anyone under (1), the OSTP Director must get input from people in academia, the private sector, intelligence agencies, and law enforcement about what the modules should cover, including how needs differ across institutions of different sizes and types, and how to keep the paperwork burden on recipients and researchers as low as possible. 3. Development: The OSTP Director must make sure the hired organization (A) builds modules that can be adjusted and used by any federal research agency, and (B) creates and follows a plan to keep updating the modules as needed.