Weaving the Threads: What the Checklist Can’t Answer

Recent moves at NIH and the Department of War confirm it: research-security policy has evolved from compliance to judgment. Universities’ governance hasn’t caught up.

Last month, the National Institutes of Health published two guidance documents that explain, perhaps better than they intended, how the federal government now expects research universities to govern foreign research relationships.

The first, issued on June 1, reminds institutions that “foreign components,” NIH’s term for significant portions of NIH-funded research carried out abroad or by researchers employed by foreign organizations, must be disclosed, and often approved in advance, throughout the life of an NIH award.¹ The guidance illustrates the point with familiar situations. A principal investigator learns from a manuscript draft that a domestic collaborator had been working with a foreign institution. A postdoctoral researcher accepts a faculty position overseas, and the paper lists the new institution rather than the laboratory where the work was performed. In each case, the publication reveals a foreign research relationship that NIH expects the institution to proactively disclose to the agency.

The second notice, published on June 18, explains why that matters. It summarizes NIH’s foreign-interference cases since 2017, involving 721 scientists and 273 cases in which the agency contacted institutions, and describes how the agency now identifies many of them.² The leading source is no longer referrals from the FBI. It is NIH staff comparing grant disclosure records against published papers and finding the discrepancies themselves. Across the matters NIH reviewed, undisclosed foreign affiliations appeared in over 87 percent. The publication record has become an audit trail.

The disclosure problem creates real institutional exposure, but it is only one part of the issue. The affiliation listed in a manuscript is where the decision becomes visible. The decision itself is the substance.

Once viewed that way, the harder cases come into focus, even though the guidance never names them. Should a doctoral student be granted continued remote access to university research systems after graduation to complete remaining research tasks if the student has accepted employment overseas? Should a scholar’s J-1 appointment be renewed if an institution with which the scholar has a historic affiliation has been newly added to the 1286 list? Should the university license IP to a company that a former faculty member starts that is doing business with the U.S. subsidiary of a 1260H-listed company? Each often arrives as a compliance question but really requires institutional judgment and expertise from numerous disciplines and offices, including immigration, export control, cybersecurity, intellectual property, and academic affairs.

The same posture appears across the government—most clearly in the fundamental-research decision matrix used by the Department of War (as the Defense Department is now known)³—and it has held across two presidential administrations: a foreign connection calls for assessment rather than an automatic answer, calibrated to its significance. That is the environment in which research institutions are now expected to govern themselves.

Research compliance programs, however, were built for a different one.

The old bright lines have dissolved. The fundamental research exclusion, which once placed published academic work safely outside export control, no longer settles these questions on its own; dual-use technology and foreign-influence concerns have turned what looked like routine research compliance into decisions with national-security stakes. Verifying disclosures, completing certifications, screening against restricted-party lists—the traditional administrative tasks, still necessary, do not answer the question now being asked: whether, given the research itself, the collaborators involved, the geopolitical setting, and the institution’s own mission, a foreign collaboration is a risk worth accepting.

None of this means the checklist is dispensable. The disclosures still must be filed, the restricted-party screens still run, the certifications still matter. The checklist is indispensable. It is also insufficient. What it cannot do is make the judgment the decision requires.

News from the DoW underscores the point. On July 13, 2026, the Department suspended the November 2026 transition to Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program—a regime that reaches university research enterprises holding defense contracts—and held its remaining implementation milestones in abeyance pending a 60-day review.4 The memo is explicit that the underlying obligations remain: contractors must still safeguard covered defense information under DFARS 252.204-7012 and meet the NIST SP 800-171 standards through self-assessment. What the Department set aside was the third-party certification apparatus built on top of them, having judged its cost to the defense industrial base no longer worth bearing. The official who signed it, the Department’s chief information officer, wrote that adversaries will not be defeated “with compliance checklists.” Even in the checklist’s home territory, the government concluded the checklist was not the thing that wins.

No single office naturally holds every perspective these decisions require. Faculty and academic leaders understand the science and what an opportunity is worth to the institution’s mission. Research and compliance officers navigate the FAR flow-downs; university counsel advises on false-claims risk and intellectual property; government relations reads the political environment; the cybersecurity office understands the technical realities of access and infrastructure. It is little surprise that these matters can stall between functions. The government is asking universities to exercise integrated, risk-based judgment across verticals that naturally operate separately, and the risk is a widening gap between what an institution certifies and what its researchers are actually doing—precisely the gap NIH’s June notices show the agency has learned to read.

There is no single right structure for this. What these decisions require is a way to integrate academic, legal, research-security, technical, and strategic perspectives into a single recommendation before the question reaches whoever must resolve it. Some institutions do this through a standing cross-functional body; others through a designated senior owner with authority to convene the right people quickly; others through less formal means. Integrated judgment is a kind of muscle memory that institutions develop through practice by pulling the right teams of cognizant leaders together to grapple with difficult cases. The federal government increasingly expects institutions to exercise informed, risk-based judgment in service of both their own missions and the nation’s research-security interests. The task is no longer simply to comply. It is to build the institutional capacity to exercise judgment deliberately, consistently, and well in service of the academic and national mission.

AJM Institutional Counsel and Strategy advises universities, colleges, and health systems on developing governance structures and decision-making frameworks for exactly this kind of integrated institutional judgment.

NOTES

1.  National Institutes of Health, “Acknowledging Foreign Components throughout NIH Application and Award Processes,” NIH Extramural Nexus, June 1, 2026 (accompanying Guide Notice NOT-OD-26-084). https://grants.nih.gov/news-events/nih-extramural-nexus-news/2026/06/acknowledging-foreign-components-throughout-nih-application-and-award-processes

2.  Patricia Valdez et al., “Brief Summary of NIH Foreign Interference Cases,” NIH Office of Extramural Research, June 18, 2026. https://grants.nih.gov/sites/default/files/foreign_interference_report.pdf

3.  “2026 Department of War Component Decision Matrix to Inform Fundamental Research Proposal Mitigation Decisions,” released March 9, 2026. https://basicresearch.defense.gov/Portals/61/Documents/Academic%20Research%20Security%20Page/2026%20DoW%20Component%20Decision%20Matrix%20to%20Inform%20Fundamental%20Research%20Proposal%20Mitigation%20Decisions.pdf

4.  Department of War, Office of the Chief Information Officer, Memorandum 26-P-1023, “Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review of Cybersecurity Maturity Model Certification Requirements,” July 13, 2026 (signed by Kirsten A. Davies, Chief Information Officer). https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf