Results from COGR’s Survey on Research Institutions’ Experiences with DoD Policy for Risk-Based Security Reviews of Fundamental Research April 2024

THE REASON A DOD COMPONENT IS REQUESTING A SECURITY RISK MITIGATION PLAN IS NOT ALWAYS CLEAR The correspondence received from DoD units requesting institutions to provide a security risk mitigation plan does not always clearly specify the reason(s) prompting the request for a plan. [...] Just over 41% of institutions that received plan requests reported that the DoD clearly identified the reason the plan was requested, while approximately 37% reported that DoD identified a reason in over 50% of requests that they received. [...] FREQUENCY AT WHICH DOD UNIT IDENTIFIED A CLEAR REASON(S) FOR REQUIRING A RISK MITIGATION PLAN (TOTAL RESPONDERS: 41) 36.60% (N=15) 41.50% (N=17) 0% of the time < 25% of the time 26%-50% of the time >50% of the time 4.90% 17.10% (N=2) (N=7) 4 3. [...] After submitting plans, 20 institutions reported that it took between one to five hours to negotiate the terms of the final risk mitigation plan with the DoD funding unit, with 19 institutions reporting negotiation times of six to ten hours. [...] The majority of institutions were successful in negotiating acceptable plans with DoD, but in a number of cases awards could not be finalized because the institution and DoD component were unable to agree upon a security risk mitigation plan.