U.S. Department of Energy expands SBIR/STTR cybersecurity due diligence framework

Traders Union
All News
Regulators
DOE expands SBIR/STTR cybersecurity

Highlights

On April 13, 2026, the Small Business Innovation and Economic Security Act of 2026 was signed, extending SBIR/STTR cybersecurity due diligence through September 30, 2031.
The 2026 law expands DOE’s security reviews, now encompassing foreign affiliations, investment linkages, and ties to China, North Korea, Russia, Iran, and sanctioned entities.
For FY 2025 Phase II Release 2, applicants must submit evidence-based reporting rather than a cybersecurity self-assessment, aligning with CISA and NIST cybersecurity baselines.

2026 mandate broadens security reviews

As reported by Department of Energy, the agency requires cybersecurity due diligence to identify risks tied to federally funded research and to encourage small businesses to adopt safeguards that protect technology development and commercialization.

Congress requires federal agencies running SBIR or STTR programs to maintain due diligence programs for security risks presented by applicants for federally funded awards. Under 15 U.S.C. § 638(vv), agencies use a risk-based approach that includes cybersecurity practices, patent analysis, employee analysis, foreign ownership, financial ties and obligations, and required foreign-relationship disclosures.

The Small Business Innovation and Economic Security Act of 2026, signed on April 13, 2026, reauthorizes the SBIR/STTR programs and strengthens the research-security framework. The current authorization extends the statutory due diligence program through September 30, 2031.

DOE says the 2026 law widens reviews beyond traditional cyber controls to include foreign affiliations of covered individuals, owners and key personnel, investment relationships, technology licensing agreements or joint ventures, business relationships involving entities in foreign countries of concern, and links to parties on federal sanctions and restricted-party lists. For SBIR/STTR purposes, DOE identifies those countries as China, North Korea, Russia and Iran, along with any others later designated by the Secretary of State.

Application process and small business impact

DOE evaluates security risk separately from scientific and technical merit reviews, and Phase II small business applicants are assessed for cybersecurity business-practice risk. Phase II applicants are required to submit a cybersecurity self-assessment as specified in the applicable funding opportunity, while Phase I awardees are encouraged to strengthen their cybersecurity posture before applying for the next phase.

For the FY 2025 Phase II Release 2 Applied Science round, DOE says the self-assessment is not used and applicants instead must provide reporting of requirements together with a body of evidence submission. The department directs applicants to its SBIR/STTR cybersecurity self-assessment guidance for details.

DOE bases its cybersecurity requirements on the Cybersecurity and Infrastructure Security Agency Cross-Sector Cybersecurity Performance Goals, National Institute of Standards and Technology Special Publication 800-171 Revision 3, and the NIST Cybersecurity Framework. The department says the baseline is intended to be practical, risk-based and scalable, helping Small Business Concerns reduce the risk of unauthorized access to or disclosure of sensitive information during research, development and commercialization.

Our earlier report on Q3 2026 cybersecurity funding highlighted that global cybersecurity and privacy startups raised $6.8 billion, with fewer deals but much larger late-stage rounds. It also noted that AI-oriented and identity-security firms led fundraising and that big acquisitions signaled continued consolidation and strong demand for security capabilities.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.