Research Security Training
Regulatory Background
These new rules and regulations are a result of federal agencies implementing the provisions of National Security Presidential Memorandum 33 (NSPM-33) and the CHIPS and Science Act of 2022 (CHIPS Act).
One of the many requirements requires UVM to implement a Research Security Program, addressing the following 4 elements:
- Cybersecurity Program
- Foreign Travel Security
- Research Security Training*
- Export Control Training
*Element 3, Research Security Training was created by the National Science Foundation, in partnership with the National Institutes of Health, the Department of Energy and the Department of Defense and is now available to the research community.
Who is Required to take Research Security Training?
All Research Proposal and Award Investigators and Senior/Key Personnel must complete this training.
We also encourage all research administration staff, support staff, lab techs, postdocs and students to complete this training.
Non-Research projects are exempt.
What is the Frequency and Timeline for Completion?
To meet federal regulations and avoid delays in proposal submissions and award set-up, we would like to see all Investigators and Senior/Key Personnel complete the Research Security Training by October 1, 2025.
With the recent release of the NSF Important Notice 149, along with other agency announcements, it has been clarified that research security training will be an Annual Requirement for most of us.
According to these new guidelines, senior/key personnel must certify that they have completed the training within the 12 months immediately preceding the proposal submission date and recertify annually for the duration of any resulting award.
For example, if we have a proposal submission date of November 1, 2025, senior/key personnel would need to have completed the training sometime in the preceding 12-month period—from November 1, 2024, to October 31, 2025. If you then plan to submit another proposal for a November 1, 2026, deadline, the previous training would no longer be valid, requiring them to retake the training.
Where is the Training located?
To complete the required Research Security Training or annual refresher, please follow the navigation below to CITI.
Always login to CITI through the “LOG IN THROUGH MY ORGANIZATION”.
This allows you to use your net id and connect your training to UVM.
Use the Search Box and Find “University of Vermont”.
Follow these instructions to sign up for Research Security Training:
Select “View Courses”
Scroll down to “Learner Tools for University of Vermont,” and select “Add a Course.”
At Question 1, select “Research Security” and click “Next”.
On the next screen, select “Research Security Training” click “Next”.
For FIRST TIME Takers, Add “Research Security Training (Combined)”.
For Annual retake, Add "Research Security Advanced Refresher"
You may begin the 1-hour training.
Who Created the Training and Why?
In response to the CHIPS and Science Act, Research Security Training was created by the National Science Foundation, in partnership with the National Institutes of Health, the Department of Energy and the Department of Defense and is now available online and free to the research community thru CITI Program.
Recipients will learn key concepts of research security and how to recognize situations that may indicate undue foreign influence and better understand the regulatory landscape that shapes research security.
Research security training educates researchers and institutions on risks like foreign influence, intellectual property theft, and misuse of research data.
Recipients will discover that we have a responsibility to safeguard the core values that underpin U.S. academic research.
Will Training Apply to both Federal and non-Federal Research Projects?
The Research Security Training requirement will apply to both federal and non-federal sponsored research projects.
For federally funded research projects, the frequency is annual.
For the non-federal research projects, the frequency will be once and done, unless a non-federal sponsor issues guidance otherwise.
Who is Responsible for Ensuring Training is Completed?
Individual researchers are responsible to ensure they completed research security training on time and is kept updated as needed.
SPA will monitor new funding proposals and new awards for compliance. See the below SPA accordion for more info.
Principal Investigators must ensure any new senior/key personnel that come onto a federally funded project in mid-stream complete the Research Security Training. This is a critical step to maintain compliance and uphold the integrity of our research projects.
CITI Complete Certs Automatically connect to UVMClick
Training completion certifications will automatically upload to UVMClick Funding Proposal and Award Training Tab.
Principal Investigators, Grant Administrators, including SPA staff can view the Training Tab at any time to ensure required trainings have been completed.
If required trainings are missing, please take action to ensure trainings are completed timely.
How will SPA Monitor for Compliance?
At Time of Proposal Submissions:
Beginning October 1, 2025, SPA pre-award teams will be reviewing Investigators training records to ensure the CITI complete cert is on file prior to grant submission.
The UVMClick Funding Proposal module includes a Training Tab which lists all Investigators completed trainings.
If training is missing the Investigator will be asked to complete. If the sponsor allows a proposal will continue to be submitted without the training in place.
Please pay attention to the sponsors’ direction on this topic.
Several agencies, for example NSF Important Notice 149, are requiring individuals identified as senior/key personnel in the grant application are to certify they have completed the requisite research security training.
At Time of Award Acceptance and Set-up:
Beginning October 1, 2025, Research Security Training will need to be completed by all Investigators and Senior/Key personnel participating in the research award prior to SPA releasing the award chartstring with budget.
The UVMClick Award module includes a Training Tab which lists all Investigators completed training and is available to the PI and administrators to monitor completions.
Agency Implementations and Regulations
Agency | Effective Date | Highlights | Details |
DOD | TBD | TBA | DOD has not yet issued an agency wide timeline. |
Read through the proposal guidelines until official guidance has been released. | |||
DOE | May 1, 2025 | Annual Training Required | Must complete within the 12 months immediately preceding the application submission date and recertify annually for duration of award. |
Covered individuals | All Senior/key personnel listed on research applications and awards. | ||
Certification | All Senior/key personnel must certify they have completed the training via Current and Pending Support forms. | ||
Agency Policy | Implementation of DOE Research Security Policies: PF 2025-04 (FAL 2025-02) | ||
https://www.energy.gov/management/pf-2025-04-fal-2025-02-research-security-training-requirements-all-rd-financial | |||
NASA | TBD | TBD | NASA has not yet issued an agency wide timeline. |
Carefully read through the proposal guidelines until official guidance has been released from this agency. | |||
NSF | October 10, 2025 | Annual Training Required | Must complete within the 12 months immediately preceding the application submission date and recertify annually for duration of award. |
Covered individuals | All Senior/key personnel listed on research applications and awards. | ||
Certification | All Senior/key personnel must certify that they have completed the training via Current and Pending Support forms. | ||
Agency Policy | Implementation of NSF Research Security Policies: Important Notice No. 149 | ||
https://www.nsf.gov/notices/important/important-notice-no-149-updates-nsf-research-security/in149 | |||
NIH | January 25, 2026 Guidance on hold | Annual Training Required | Must complete within the 12 months immediately preceding the application submission date and recertify annually for duration of award. |
Covered individuals | All Senior/key personnel listed on research applications and awards. | ||
Certification | Senior/Key Personnel must certify completion by electronically signing the ‘Other Attachment’ field of the R&R Other Project Information form of the application. The file for each senior/key person must be named ‘Research Securities_[Name].pdf’ without quotations, where ‘[Name]’ is the name of the senior/key person. | ||
Annual Certification at the time of the Research Performance Progress Report (RPPR): Individuals serving as senior/key personnel must continue to certify annually that they have completed training within the past 12 months. | |||
Agency Policy | Implementation of NIH Research Security Policies NOT-OD-25-154. | ||
https://grants.nih.gov/grants/guide/notice-files/NOT-OD-25-154.html | |||
USDA | October 1, 2025 | Annual Training Required | Must complete within the 12 months immediately preceding the application submission date and recertify annually for duration of award. |
Covered individuals | All Senior/key personnel listed on research applications and awards. | ||
Certification | All Senior/key personnel must certify that they have completed the training via Current and Pending Support forms. | ||
Agency Policy | Implementation of USDA Research Security Policies SM 1078-014, America First Memo. | ||
https://www.usda.gov/directives/sm-1078-014 |