Significant Changes to the SBIR and STTR Programs

Agency Due Diligence Programs. No later than June 27, 2023, agencies will be required to establish and implement due diligence procedures to assess offerors’ eligibility for SBIR and STTR awards based on security risks presented by small businesses seeking to participate in the programs. These due diligence procedures will be based on best practices provided by the Small Business Administration, in consultation with the director of the Office of Science and Technology Policy and the Committee on Foreign Investment in the Unites States. Among other things, agency due diligence procedures must:

• Assess, using a risk-based approach as appropriate, the cybersecurity practices, patent analysis, employee analysis, and foreign ownership of a small business concern seeking an award, including the financial ties and obligations (which shall include surety, equity, and debt obligations) of the small business concern and employees of the small business concern to a foreign country, foreign person, or foreign entity; and,
• Assess awards and proposals or applications, as applicable, using a risk-based approach as appropriate, including through the use of open-source analysis and analytical tools, for the nondisclosures of information.

Disclosures Regarding Ties to Foreign Countries—Especially Any “Foreign Country of Concern.” Any small business participating in the SBIR or STTR program must disclose in its proposal or application a range of information relating to ties with foreign countries. Most of these requirements pertain to any “foreign country of concern,” which means China, North Korea, Russia, and Iran. Specifically, small business in the program must disclose the following information:

• The identity of all owners and covered individuals of the small business concern who are a party to any “foreign talent recruitment program” of any foreign country of concern;
• The existence of any joint venture or subsidiary of the small business concern that is based in, funded by, or has a “foreign affiliation” with any foreign country of concern;
• Any current or pending contractual or financial obligation or other agreement specific to a business arrangement, or joint venture-like arrangement with an enterprise owned by a foreign state or any foreign entity;
• Whether the small business concern is wholly owned in a foreign country of concern;
• The percentage, if any, of venture capital or institutional investment by an entity that has a general partner or individual holding a leadership role in such entity who has a foreign affiliation with any foreign country of concern;
• Any technology licensing or intellectual property sales to a foreign country of concern during the five-year period preceding submission of the proposal; and,
• Any foreign business entity, offshore entity, or entity outside the United States related to the small business concern.

Thus, to ensure a proper disclosure, offerors must provide information about their investors, intellectual property, operations and contractual relationships. They also must become familiar with the meaning with terms such as “foreign affiliation,” “foreign talent recruitment program,” and, as noted below, “malign foreign talent recruitment program.”

Denial of Awards. Agencies now are prohibited from making a SBIR or STTR award if: (1) the small business has ties with a foreign country of concern; and, (2) the agency determines that the ties pose a risk to national security or present other concerns. Specifically, agencies may not make an award if:

(1) The small business concern:

• Has an owner or covered individual that is party to a “malign foreign talent recruitment program”;
• Has a business entity, parent company, or subsidiary located in a foreign country of concern; or
• Has an owner or covered individual that has a foreign affiliation with a research institution located in a foreign country of concern

and

(2) The relationships and commitments described above:

• Interfere with the capacity for activities supported by the federal agency to be carried out;
• Create duplication with activities supported by the federal agency;
• Present concerns about conflicts of interest;
• Were not appropriately disclosed to the federal agency;
• Violate Federal law or terms and conditions of the federal agency; or
• Pose a risk to national security.

Ongoing Reporting. The Act requires that small businesses that have received awards to regularly report to the procuring agency and SBA, throughout the duration of the award, on:

• Any change to any disclosure required by the SBIR and STTR Extension Act of 2022;
• Any material misstatement that poses a risk to national security; and
• Any change in ownership, change to entity structure, or other substantial change in circumstances of the small business concern that poses a risk to national security.

To comply with these ongoing reporting requirements, small businesses will want to ensure that they are maintaining current records on their investors and operations.

Repayment of Full Award Amount. The risks of violation may be numerous, but the Act specifies one significant Government remedy: Agencies are required to claw back all money paid to a small business under the award. Specifically, a small business concern receiving an award must repay all amounts received from the federal agency under the award if:

• The small business concern makes a material misstatement that the federal agency determines poses a risk to national security; or,
• There is a change in ownership, change to entity structure, or other substantial change in circumstances of the small business concern that the federal agency determines poses a risk to national security.

Congressional Reporting. Perhaps as a sign of the significance of these changes, Congress included numerous reporting requirements in the Act relating to national security risks. Agencies must brief relevant Congressional committees “on a recurring basis” until implementation of their due diligence procedures is complete. The Defense Department and other agencies must submit reports assessing the adversarial military and foreign influences in the SBIR and STTR programs to various Congressional committees by June 27, 2023. The Government Accountability Office is also required to study and submit to certain Congressional committees an annual report on the implementation and best practices for due diligence procedures.

Other Changes to the SBIR and STTR Programs. Separate from concerns of national security, Congress made other changes to the programs, including:

• In a section called “Prohibition Against Writing Solicitation Topics,” the Act requires each agency to implement a multi-level review and approval process for solicitation topics “to ensure adequate competition and that no private individual or entity is shaping the requirements for eligibility for the solicitation topic after the selection of the solicitation topic.”
• In a section called, “Increased Minimum Performance Standards for Experienced Firms,” which is effective April 1, 2023, the Act changes rules applicable to small businesses that received more than 50 awards per covered period. The terms “covered period” means, for progress to Phase II, the five years preceding the most recent fiscal year and, for progress to Phase III, the 10 years preceding the most recent two fiscal years. The Act increases the minimum performance standards for such firms, and a small business that fails to meet the increased standards is restricted in the number of future awards it may receive.
• The Act also reflects the concern of Congress with subcontracting under the SBIR and STTR programs. It requires a report from GAO analyzing whether the use of subcontracting under these programs is consistent with the purposes of the programs.

In short, the Act adds several significant eligibility and reporting obligations for SBIR and STTR program contractors related to national security risks and foreign influence, among other things, as well as strict penalties for non-compliance. Given these significant rule changes, small businesses participating in the SBIR and STTR programs will need to revise their strategic planning and compliance programs accordingly.