K.1.13 Research Security Policy | Marine Biological Laboratory

Marine Biological Laboratory Policy No. K.1.13
Division of Research
Initiated by: Director of Research
Approved by: MBL Director/President
Effective Date: October 1, 2025
Distribution: All scientiﬁc staff
Responsible Office: Office of Research Compliance / Research Security Program
Review Cycle: as required by federal guidance

1.0 Policy Statement

The Marine Biological Laboratory (MBL) aims to ensure that all research activities performed by its researchers reflect MBL’s primary goals of education, research, and scholarly inquiry, conducted in a rigorous and open manner. Researchers are expected to be transparent in their compliance with all applicable institutional and sponsor requirements. This Research Security Policy provides clarity regarding the compliance requirements expected of researchers.

In alignment with NSPM-33, the CHIPS and Science Act of 2022, and federal agency requirements, the institution will maintain a comprehensive research security program designed to:

Protect research from undue foreign inﬂuence, exploitation, or unauthorized access
Promote transparency and accountability in research activities
Enable secure international collaboration consistent with academic values

The institution affirms that all members of its research community are responsible for adhering to and supporting the implementation of a comprehensive Research Security Program. The institution shall establish, maintain, and certify policies and controls necessary to ensure compliance with this policy and all applicable regulatory requirements.

2.0 Purpose

This policy establishes the framework for a coordinated institutional Research Security Program that:

Meets federal research security requirements
Deﬁnes expectations for researchers and administrators
Integrates training, disclosure, cybersecurity, and risk management
Supports the institution’s mission of open and collaborative research

It also enables the institution to adapt to evolving regulatory requirements, recognizing the dynamic nature of research security obligations.

MBL is committed to fostering a culture of compliance with respect to research security. Accordingly, MBL will:

Maintain and update this policy in response to changes in the federal compliance landscape.
Maintain and operate a cybersecurity policy (MBL Policy as provided under H.2 Information Technology) that aligns with cybersecurity guidance to be developed by the National Institute of Standards and Technology (NIST)
Provide research security-related training for the MBL community, including:
- Export control training
- Foreign travel security training (not yet available)
- Research security training
Maintain records of covered individuals’ completion of required training and provide notice to individuals who have not fulfilled training requirements.
Operate a travel reporting system that records international travel conducted by covered individuals for official purposes as of the effective date of this policy.
Provide guidance to MBL personnel on research security matters.
Engage with funding agencies to implement mitigation measures for research security risks, as required.
Certify compliance with applicable federal training, reporting, and disclosure requirements on behalf of MBL and its covered individuals.

3.0 Scope and Applicability

This policy applies to:

All individuals participating in federally funded research (“Covered Individuals”)*
Administrative and compliance personnel supporting research activities

*Covered Individuals include anyone who contributes in a substantive and meaningful way to a federally funded research project, regardless of title or compensation.

4.0 Deﬁnitions

4.1 Covered Individual:

As defined by federal guidelines, an individual who:

Contributes to a substantive, meaningful way to the scientific development or execution of a research and development project carried out under a federal research award; and
is designated as a covered individual by the applicable federal research agency.

4.2 Research Security:

Safeguards protecting research from unauthorized access, disclosure, or exploitation, including risks from foreign interference.

4.3 Malign Foreign Talent Recruitment Program (MFTRP):

A Malign Foreign Talent Recruitment Program, as defined in the CHIPS and Science Act of 2022. In brief, an MFTRP is a program, position, or activity sponsored by an entity in a foreign country of concern that provides compensation or remuneration in exchange for obligations or activities that are contrary to U.S. interests, such as the unauthorized transfer of intellectual property developed under a federal research award.

4.4 Disclosure Requirements:

Federal requirements to report affiliations, funding sources, outside activities, and other support related to research.

5.0 Research Security Program Components

The institution will maintain a coordinated program incorporating the following elements:

5.1 Governance and Oversight

The Director for Research/Office of Sponsored Programs/Chief Finance & Operations Officer has overall responsibility for the Research Security Program
Authority may be delegated to designated compliance offices
A Research Security Working Group will review policies, standards, and risks prior to implementation
Policies and procedures will be updated regularly to reﬂect new federal requirements

5.2 Risk Assessment and Management

The institution will:

Identify and assess research security risks across programs and projects
Implement mitigation plans in coordination with funding agencies
Monitor emerging threats and regulatory changes

5.3 Disclosure and Transparency

Covered Individuals must:

Fully disclose all required information related to:
- Outside activities and ﬁnancial interests
- Foreign affiliations and appointments
- Other support and resources
Update disclosures at proposal submission, award stage, and throughout the project lifecycle
Ensure accuracy in biosketches, current and pending support, and progress reports

5.4 Training Requirements

All Covered Individuals must complete Research Security Training that includes:

International collaboration risks
Export control regulations
Cybersecurity practices
Disclosure obligations
Foreign travel security

Training must:

Be completed prior to proposal submission or within 12 months before submission
Be renewed periodically (e.g., annually or as required by sponsor)
Be tracked and enforced by institutional systems

Failure to complete required training may result in removal from proposals or projects.

5.5 Cybersecurity

The institution will:

Implement cybersecurity controls aligned with federal standards (e.g., NIST guidance)
Protect sensitive data, systems, and intellectual property
Provide training and resources on secure research practices
Requirement to report cybersecurity incidents is outlined in H.2.3 Information Technology Security Policy.

5.6 International Travel and Collaboration

Covered Individuals must:

Report all international business travel, which each center tracks via JotForm and compiles into an Excel sheet for review by the Director of HR.
Covered Individuals are required to complete MBL’s online IT Security Training, the Research Security Training provided to them under the CITI Program and follow IT Security Policies.
Exercise caution when traveling with devices or sensitive data as described in the training.

The institution will provide guidance on secure international collaboration while maintaining openness in research.

5.7 Export Controls and Compliance

Researchers must comply with applicable export control laws and regulations, including:

Restrictions on transfer of controlled technologies
Requirements for licenses and approvals
Institutional review of high-risk collaborations

5.8 Prohibited Activities

Covered Individuals are prohibited from:

Participating in Malign Foreign Talent Recruitment Programs (MFTRP)
Engaging in undisclosed foreign affiliations or commitments
Transferring intellectual property without authorization

Certiﬁcation of non-participation in MFTRPs may be required at proposal submission.

6.0 Roles and Responsibilities

6.1 Covered Individuals

Covered Individuals are responsible for:

Completing required training
Providing complete and accurate disclosures
Maintaining awareness of research security risks
Reporting suspected violations or security concerns
Ensuring compliance of Key personnel

6.2 Principal Investigators (PIs)

PIs must:

Ensure all Key personnel meet training and disclosure requirements
Verify compliance prior to proposal submission
Maintain oversight throughout the project lifecycle

6.3 Research Administration, Office of Sponsored Programs

Authorized Organizational Representative (AOR) will:

Verify compliance prior to proposal submission
Maintain records of training and disclosures
Support implementation of research security requirements

6.4 Director of Information Technology will:

Support implementation of research security requirements
Ensure IT systems, infrastructure, and controls align with research security and cybersecurity requirements
Assist in safeguarding sensitive research data and systems in accordance with applicable policies and standards
Collaborate with the Authorized Organizational Representative (AOR) and Office of Sponsored Programs to ensure technical compliance

6.5 Institutional Leadership

Senior leadership will:

Ensure implementation of a compliant research security program
Allocate resources to support compliance
Oversee policy enforcement and updates

7.0 Compliance, Monitoring, and Enforcement

7.1 The institution will:

Monitor compliance through audits, reviews, and Grant Management systems
Investigate potential violations
Coordinate with federal agencies as required

7.2 Failure to comply may result in:

Removal from research projects
will be subject to investigation, and appropriate actions and responses will be determined by the Authorized Organizational Representative (AOR) and sponsors. All actions will be taken in accordance with applicable federal agency requirements and institutional policies.
Loss of funding or eligibility for federal awards
Civil or criminal penalties, where applicable

8.0 Reporting and Incident Response

All members of the Research Institution must:

Report suspected violations, security breaches, or undisclosed activities
Cooperate with institutional investigations

The institution will maintain conﬁdential reporting mechanisms and ensure appropriate follow-up actions.

9.0 Continuous Improvement

Recognizing the evolving nature of research security:

The institution will regularly review and update this policy
New federal guidance will be incorporated promptly
Training and procedures will be revised to address emerging risks

10.0 Procedures and Resources

Office of Sponsored Programs: Conﬂict of Interest (COI)/ Conﬂict of Commitment (COC) disclosures; Grant Management & Records
Training Programs & Resources: CITI Program (includes COI; Biomedical Responsible Conduct of Research (RCR); Research Security Training); MBL’s Information Technology Security Awareness Program (Intranet/ sign-in required); RCR Training (in-person); Grant Workshop (in-person); Information Security Resources
Travel Reporting System: Each Center uses the MBL Employee Travel Form (Intranet/ sign-in required) to record travel, and the information is then submitted to HR for recordkeeping.

11.0 References

Contacts

Director of Division of Research (DDR): Anne Sylvester
Email: asylvester@mbl.edu

Director of Sponsored Programs (DOSP): Diane E. Cook
Email: dcook@mbl.edu

Director of Information Technology: Scott Koerner
Email: skoerner@mbl.edu