# DOE Expands SBIR/STTR Security Due Diligence

The U.S. Department of Energy has expanded cybersecurity and research-security due diligence for SBIR/STTR applicants under the Small Business Innovation and Economic Security Act of 2026, which extends the statutory framework through September 30, 2031. Reviews can cover applicants’ cybersecurity practices and foreign affiliations, ownership, investment, licensing, joint ventures, and restricted-party connections. For the FY 2025 Phase II Release 2 Applied Science round, applicants must submit a body of evidence and requirements reporting instead of the usual cybersecurity self-assessment.

- Applicants to the specified Phase II round should account for the evidence and reporting package when preparing their submissions; it differs from the standard cybersecurity self-assessment.
- Small businesses and contractors pursuing DOE SBIR/STTR awards should be prepared to document cybersecurity practices and disclose the foreign-relationship and ownership information subject to review.
- The statutory framework extends through September 30, 2031, making these due-diligence considerations relevant to DOE small-business research awards beyond the FY 2025 round.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Policy
**Published:** November 02, 2026

### Government Entities
- U.S. Department of Energy (DOE)
- Cybersecurity and Infrastructure Security Agency (CISA)
- National Institute of Standards and Technology (NIST)

### Sources
- [U.S. Department of Energy expands SBIR/STTR cybersecurity due diligence framework](https://tradersunion.com/news/regulators/show/4068469-doe-expands-sbir-sttr-cybersecurity-framework) - Traders Union