Bolstering Research Security of Sbir and Sttr Awards
Section 2 · Sec. 2 ·
What this chapter is about
This part adds security checks to two award programs for small firms. An agency must ask whether a firm is a security risk. It may turn a firm down if the firm is tied to a listed group. It must tell the firm it was turned down and why. Being turned down does not bar the firm from asking again.
The document says “is amended”Who acts: Federal agencies running SBIR or STTR programsHow: statuteSec. 2 in the PDF
What the document says
“evaluate whether a small business concern presents a security risk for any reason, through measures including-- ``(A) the due diligence process required under subsection (vv); ``(B) disclosures submitted under this subsection; or ``(C) coordination with the intelligence community”
Subsection (a)(1)(B) inserts a new paragraph (15) into subsection (g) of section 9 of the Small Business Act (15 U.S.C. 638), and subsection (a)(2)(B) inserts the same words as a new paragraph (19) of subsection (o). The inserted words name three measures the evaluation may run through: the due diligence process required under subsection (vv), disclosures submitted under the same subsection, and coordination with the intelligence community as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 3003), with Federal law enforcement, and with other counterintelligence capabilities of the Federal Government.
What the document actually says
“evaluate whether a small business concern presents a security risk for any reason, through measures including-- ``(A) the due diligence process required under subsection (vv); ``(B) disclosures submitted under this subsection; or ``(C) coordination with the intelligence community”
That sentence, in plain words
The agency must check if a small firm is a security risk. It can check in three ways. It can use the review this law calls for. It can use what the firm has told it. It can ask spy and police agencies.
What this is about
This adds a step to how an agency picks who gets money. The agency looks at the firm before it hands over funds. The same words go into two places in the older law.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
The document says “is amended”Who acts: Federal agencies running SBIR or STTR programsHow: statuteSec. 2 in the PDF
What the document says
“has a security risk connecting the small business concern to an entity, including any affiliates of the entity, or individual on-- ``(i) the UFLPA Entity List maintained by the Department of Homeland Security;”
Subsection (a)(1)(C)(vi) adds a new subparagraph (D) to the paragraph of subsection (g) that lists grounds for denial, and subsection (a)(2)(C)(vi) adds a matching subparagraph to subsection (o). The new ground reaches a connection to an entity, including any of its affiliates, or to an individual on any of eight lists: the UFLPA Entity List kept by the Department of Homeland Security, the Non-SDN Chinese Military-Industrial Complex Companies List kept by the Treasury Department's Office of Foreign Assets Control, the Section 889 Prohibition List established under section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115-232) and kept by the Defense Department, the list of Chinese Military companies required under section 1260H of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (10 U.S.C. 113 note) and kept by the Defense Department, the Military End User List and the Entity List kept by the Commerce Department's Bureau of Industry and Security, the List of Equipment and Services kept by the Federal Communications Commission, and the Withhold Release Orders and Findings List kept by U.S. Customs and Border Protection. The version written into subsection (o) opens with the words 'has a foreign risk' where the version written into subsection (g) says 'has a security risk'.
What the document actually says
“has a security risk connecting the small business concern to an entity, including any affiliates of the entity, or individual on-- ``(i) the UFLPA Entity List maintained by the Department of Homeland Security;”
That sentence, in plain words
A firm can be turned down if it is tied to a listed group. The tie can be to the group or to a branch of it. The tie can also be to a person on a list.
What this is about
Eight lists are named. Other parts of the government keep them. They name groups and people the United States has flagged. One list is about forced labor. Some are about arms and the Chinese army. One is about phone gear.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
The document says “is amended”Who acts: Federal agencies running SBIR or STTR programsHow: statuteSec. 2 in the PDF
What the document says
“has a security risk with a primary source that is classified; or ``(F) has a security risk that the Federal agency determines warrants a denial;”
The same two amendments add subparagraphs (E) and (F) alongside the list-based ground. Subparagraph (E) reaches a security risk whose primary source is classified. Subparagraph (F) reaches a security risk that the Federal agency determines warrants a denial. Both wordings are written into subsection (g) and into subsection (o).
What the document actually says
“has a security risk with a primary source that is classified; or ``(F) has a security risk that the Federal agency determines warrants a denial;”
That sentence, in plain words
A firm can be turned down for a risk that is a secret. It can also be turned down if the agency decides the risk is bad enough.
What this is about
Some proof is kept secret. The law lets the agency act on it anyway. The last ground has no set test. The agency makes the call.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
The document says “is amended”Who acts: Federal agencies running SBIR or STTR programsHow: statuteSec. 2 in the PDF
What the document says
“the Federal agency provides to the small business concern, as appropriate pursuant to the discretion of the Federal agency and in a manner that does not compromise national security, a notification-- ``(i) advising the small business concern of such determination; and ``(ii) identifying the basis for such determination”
Subsection (a)(1)(D) inserts a new paragraph (17) into subsection (g), and subsection (a)(2)(D) inserts a matching paragraph (21) into subsection (o). Subparagraph (A) of each calls for a process. Where an agency denies an application on the basis of a security risk determination, or makes such a determination about a firm, the agency provides a notification advising the firm of the determination and identifying its basis. The notification is given as appropriate pursuant to the agency's discretion. The version in subsection (g) qualifies it as a manner that does not compromise national security; the version in subsection (o) says security.
What the document actually says
“the Federal agency provides to the small business concern, as appropriate pursuant to the discretion of the Federal agency and in a manner that does not compromise national security, a notification-- ``(i) advising the small business concern of such determination; and ``(ii) identifying the basis for such determination”
That sentence, in plain words
The agency tells the firm what it decided. It also tells the firm why. It does this in a way that keeps secrets safe. The agency decides how much to say.
What this is about
A firm turned down for a risk gets told about it. The law leaves the agency room to say less. The reason may touch on secrets.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
The document says “is amended”Who acts: Federal agencies running SBIR or STTR programsHow: statuteSec. 2 in the PDF
What the document says
“a policy that clarifies that receipt of an award decision denying an application does not prohibit the small business concern from being eligible for an award in a subsequent award cycle;”
Subparagraph (B) of each newly inserted paragraph calls for a policy. The policy clarifies that receiving an award decision that denies an application does not prohibit the small business concern from being eligible for an award in a later award cycle. The same words go into subsection (g) and subsection (o).
What the document actually says
“a policy that clarifies that receipt of an award decision denying an application does not prohibit the small business concern from being eligible for an award in a subsequent award cycle;”
That sentence, in plain words
Being turned down once does not shut a firm out. The firm can still ask for an award next time.
What this is about
The agency has to write this down as a policy. That way a firm knows a no is not forever.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
The document says “is amended”Who acts: Federal agencies running SBIR or STTR programsHow: statuteSec. 2 in the PDF
What the document says
“assess, using a risk-based approach as appropriate-- ``(i) the cybersecurity practices of a small business concern; ``(ii) patent analysis; ``(iii) employee analysis; ``(iv) foreign ownership of a small business concern seeking an award”
Subsection (a)(3)(A) rewrites subparagraph (A) of subsection (vv)(2) of section 9 of the Small Business Act. As rewritten it names eight subjects to assess using a risk-based approach as appropriate: cybersecurity practices, patent analysis, employee analysis, foreign ownership of the applicant firm including the financial ties and obligations of the firm and its employees to a foreign country, person or entity, which are to include surety, equity and debt obligations, foreign affiliations of a covered individual, owner or other key personnel with an entity in a foreign country of concern, investment relationships with an individual or entity in such a country, technology licensing agreements or joint ventures including joint venture-like agreements with such an individual or entity, and business relationships between a covered individual, owner or other key personnel and such an individual or entity.
What the document actually says
“assess, using a risk-based approach as appropriate-- ``(i) the cybersecurity practices of a small business concern; ``(ii) patent analysis; ``(iii) employee analysis; ``(iv) foreign ownership of a small business concern seeking an award”
That sentence, in plain words
The agency sizes up each firm. It weighs how big the risk is first. It looks at how the firm guards its computers. It looks at its patents, its staff, and who abroad owns part of it.
What this is about
This is a background check on the firm. Eight things are named to look at. Some are about money from other countries. Some are about deals with groups abroad.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
The document says “is amended”Who acts: Federal agencies running SBIR or STTR programsHow: statuteSec. 2 in the PDF
What the document says
“examine any relationship of a small business concern seeking an award to any entity or individual included on the lists described in subsections (g)(16)(D) and (o)(20)(D).”
Subsection (a)(3)(C) adds a new subparagraph (C) to subsection (vv)(2). It ties the due diligence program to the eight lists this section put into subsections (g) and (o), by calling for an examination of any relationship between an applicant firm and any entity or individual on those lists.
What the document actually says
“examine any relationship of a small business concern seeking an award to any entity or individual included on the lists described in subsections (g)(16)(D) and (o)(20)(D).”
That sentence, in plain words
The check must look for any link to a listed group or person. The lists are the ones named earlier in this part.
What this is about
The same eight lists are used twice. They are a ground to say no. They are also part of the check itself.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
The document says “is amended”Who acts: CongressHow: statuteSec. 2 in the PDF
What the document says
“Section 4(b)(4) of the SBIR and STTR Extension Act of 2022 (Public Law 117-183; 136 Stat. 2183) is amended by striking ``3 years'' and inserting ``8 years''.”
Subsection (b) amends section 4(b)(4) of the SBIR and STTR Extension Act of 2022 (Public Law 117-183; 136 Stat. 2183) by striking '3 years' and inserting '8 years'. The section is headed GAO Study. What that provision of the 2022 Act requires is not recorded here, because that Act is not indexed on this site.
What the document actually says
“Section 4(b)(4) of the SBIR and STTR Extension Act of 2022 (Public Law 117-183; 136 Stat. 2183) is amended by striking ``3 years'' and inserting ``8 years''.”
That sentence, in plain words
This changes a rule in a law from 2022. It takes out three years. It puts in eight years.
What this is about
The heading calls this a study. The older law is not part of this site. So what the study covers is not recorded here.
No action is recorded against this proposal. That is not evidence that none has been taken, and nobody has yet read it against the record. See what the tracker does not yet cover.
Each distinct thing the section adds: the duty to evaluate security risk, the new ground for denial built on eight named lists, the two further grounds, the notice owed to a denied applicant, the policy on later award cycles, the rewritten due diligence assessment, the new duty to check applicants against the lists, and the change to the deadline for a study under a 2022 Act.
The purely mechanical amendments are not recorded proposal by proposal. The section renumbers paragraphs, strikes an 'and' or an 'or' at the end of a clause, and updates cross references to match the new numbers. Those are recorded only where they change what somebody must do.
The section works by amending section 9 of the Small Business Act (15 U.S.C. 638) and, in one subsection, the SBIR and STTR Extension Act of 2022. Neither of those is indexed here, so what they said before this Act and what they say once it is applied are not recorded. The site records only the words this Act itself contains. The section writes nearly the same text twice, once into subsection (g) and once into subsection (o), and the differences between the two versions are noted where they exist.
