I’m writing to share two policy updates from NIH that may affect your research and funding. Unlike some recent announcements from NIH, these updates are not – in the main – new, but some timelines have accelerated and some details have changed. ��Please review the following summary carefully, and make sure your NIH research remains in compliance with the relevant policies, below.

Beginning July 1, 2025, all Author Accepted Manuscripts for NIH-funded research must be deposited in PubMed Central (PMC) upon acceptance and made publicly available without embargo on the Official Date of Publication.

Key Points:

• The Author Accepted Manuscript is the final version post-peer review but before publisher formatting. This is the required version for submission.
• The Final Published Article is the journal’s formatted version. While submission of the Final Published Article is an option (for journals with agreements with NLM), it is not required for compliance.
• Compliance is free—researchers are not required to pay article processing charges to meet the new policy.

Impact on Researchers:

Researchers can comply in one of two ways:

• Submit the Author Accepted Manuscript to PubMed Central upon acceptance.
• Or submit the Final Published Article (if the journal has an agreement with NLM).

Resources:

The Ģ����ý Libraries’ team is available for assistance. They have also created ��highlighting the most recent updates on funding agency public access policies.

The NIH has announced significant updates to its Genomic Data Sharing Policy, which took effect on January 25, 2025. These changes aim to enhance the security and management of controlled-access data, highlighting the increasing significance of data protection in an evolving global research landscape.

Key Points:

• Genomic data repositories must now comply with the NIST SP 800-171 standard, which introduces stricter security requirements. The University is actively working towards this.
• Approved users of NIH controlled-access data must attest that their institution complies with NIST SP 800-171. This includes those using third-party IT systems or Cloud Service Providers (CSPs) for data analysis and storage.

Impact on researchers:

• The policy is not retroactive. Approved users under existing Data Use Agreements or similar agreements signed before January 25, 2025, can continue under those terms until renewal.
• Researchers seeking to access controlled human genomic data from genomic data repositories (e.g., dbGaP) must either attest that their systems meet NIST SP 800-171 requirements (which is coming) or have a documented plan of action on progress toward adoption (which will be available within the coming weeks).

Resources:

If approved users are seeking renewal of their Data Use Agreement or are looking to access controlled human genomic data from a repository, they should contact Amy Crosby in the Office of Research & Project Administration to ensure compliance.

The NIH also has available.

As always, if you have questions on any of the above and are not sure who to reach out to, please contact the Office of the Vice President for Research.

Regards,
Steve

Stephen Dewhurst, PhD
Vice President for Research
Ģ����ý

The post NIH Public Access Policy & Genomic Data Sharing Policy Updates appeared first on Office of the Vice President for Research.

As required by NSPM-33 (2021) and the CHIPS and Science Act of 2022, the Office of Vice President for Research has introduced a new research security training program in that certain individuals involved in federally funded research must complete.

• Department of Energy Requirement: Beginning May 1, 2025, all “Covered Individuals” (e.g. PIs, Co-PIs, project directors, senior/key personnel, and others identified as Covered Individuals by a federal funding agency) listed on Department of Energy (DOE) award applications must certify to DOE that they have completed research security training. Additional Covered Individuals that later join a DOE award proposed on or after May 1, 2025 will also be required to take this training before participating in award activities.

To meet Department of Energy (DOE) certification requirements:

• • Before May 1, 2025: All PIs and faculty planning to submit applications to DOE on May 1, 2025 must complete Research Security training by May 1, 2025.
  • After May 1, 2025: PIs and faculty must have completed Research Security training prior to the date of an application to DOE.

To facilitate compliance, it is strongly recommended that all PIs and faculty currently engaged in DOE-funded research take this training by May 1, 2025.

• Other Federal Agency Requirements: Other federal funding agencies are in the process of implementing similar Research Security training requirements that apply to “Covered Individuals” (e.g. PIs, Co-PIs, project directors, senior/key personnel, and others identified as Covered Individuals by a federal funding agency). It is likely that the National Science Foundation will adopt Research Security training requirements as of October 2025, and other funding agencies will follow thereafter. These requirements have not been finalized, and the Office of the Vice President for Research will update the research community as other agencies announce their requirements.
• Application Submission and Training Requirement: Beginning May 1, 2025, the Office of Research and Project Administration (ORPA) is prohibited from submitting DOE applications where applicable Covered Individuals have not satisfied their research security training requirements. Similar stipulations will apply to other federal proposals as applicable funding agencies implement their training requirements. The University will track training completion through MyPath.
• Instructions and FAQs: For instructions on how to complete this training and answers to other frequently asked questions, please visit the Office of Vice President for Research website.

Regards,

Stephen Dewhurst, PhD
Vice President for Research

Joe Doyle
Research Security Officer and Global Operations Director

The post Research Security Training appeared first on Office of the Vice President for Research.

As many of you may be aware, NIH released a “Supplemental Guidance” late yesterday indicating that “”, effective February 10th.����We appreciate that this unexpected change����is��.����Please be aware that we are working actively with our government relations team and our national organizations, including AAMC, AAU and COGR, to address this issue.����We are also closely monitoring the situation and will provide updates as they become available.

Sincerely,
Steve

Stephen Dewhurst, PhD
Vice President for Research
Ģ����ý

The post NIH Indirect Cost Rate appeared first on Office of the Vice President for Research.

Last week, I received many expressions of concern and uncertainty with respect to ongoing changes that affect the major federal funding agencies that support our research enterprise, including NIH, NSF, DOD and more.

Two prominent actions that have been widely reported are the����through February 1st, and an��.����Related to this, there is also a temporary pause on new NIH awards and ongoing changes to certain federal Program Announcements.����A valuable����at universities such as ours was posted recently��on the website of the��.

That said, there is also much that we do not yet know.

My counterpart at the University of Michigan, Skip Lupia (who is also a UR alum), wrote to his research community at the end of last week and noted that “”����He went on to add that such changes affect all those who receive funding from, or partner with, those federal agencies.

As an institution, we have established a process to monitor and review these transition actions, including recent����from the new administration, as well as other changes that may affect our research programs, and related activities.����We are also working in close concert with our��, and with the national organizations that represent the interests of major research universities such as ours, including the����and the��.

Our University’s mission is to��Learn, Discover, Heal, Create—and Make the World Ever Better.����Research is at the core of that mission and fuels the innovation, creativity and new knowledge that saves lives, improves the human condition, generates new technologies, and drives economic growth. As valued members of our research family, you make that happen.��It is your hard work, energy and commitment that results in positive change, every single day.

We will continue to assess the situation and keep you updated as new information becomes available, and we will provide guidance to help you navigate any applicable changes as they occur.����Our Office of Research and Project Administration��can help address any questions you may have, related to federal grant submissions, reports and other matters such as no-cost extension (NCE) requests.�� It’s important to note that, even during times when study sections and communications with NIH staff are suspended, grant submission and reporting deadlines remain in place (unless explicitly paused or changed).�� If you have additional comments, we welcome your input at��SrVPforResearch@rochester.edu.

I have long felt grateful to be part of the amazing and deeply resilient research family here at the URochester.����As my colleague, Paige Lawrence, recently wrote: “the best thing about working here – is being able to work with such wonderful, dedicated, kind and creative people.”����Thank you for what you do and for who you are.

Sincerely,
Steve

Stephen Dewhurst, PhD
Vice President for Research
Ģ����ý

The post Research and the Federal Transition appeared first on Office of the Vice President for Research.

In January 2023 and October 2023, I shared information regarding the University’s research security program. Below are some new updates regarding federal mandates that will inform the continuing evolution of the University’s research security program.

Regards,
Steve

Steve Dewhurst, PhD
Vice President for Research

��

Guidelines for Research Security Programs at Covered Institutions

Only July 9, 2024, the Office of Science and Technology Policy (OSTP) issued (the Guidelines).�� The Guidelines require that certain research institutions (including the University) certify to federal funding agencies that the institution has established and operates a research security program, that includes specific elements relating to: (1) cybersecurity; (2) foreign travel security; (3) research security; and (4) export control – as outlined in more detail below.

A key aspect of the Guidelines is that they also specify that “covered individuals” (see “Definitions”) will be required to take new trainings that relate to these core elements.

Fortunately, the University has some flexibility in terms of how we can provide those trainings.�� The Office of the Vice President for Research, together with other University stakeholders, will therefore review and evaluate applicable training modules made available by federal agencies, as well as other training options that may be available or developed (e.g., thru CITI).�� The goal of this effort will be to identify materials that deliver quality educational training on the subject matter in a format that does not add unnecessary burden on our faculty.

Cybersecurity:

The University is required to implement a cybersecurity program consistent with a “cybersecurity resource for research institutions” within one year after the National Institute of Standards and Technology (NIST) of the Department of Commerce Information Security publishes the requirements for that cybersecurity resource.

• What Happens Next: Earlier this year, members of Information Security, in conjunction with University IT, ISD and Office of Research IT, began to contact University departments and units that conduct federally funded research to inventory the types of equipment and devices used in their federally funded research.�� To best position researchers and departments to comply with the future NIST cybersecurity program requirements, these Security and IT teams will continue this inventory process.�� The University will implement the required cybersecurity program elements within one year after NIST publishes the cybersecurity resource.
• How This Impacts You: Depending on the cybersecurity program requirements that NIST ultimately publishes, the University and departments may be required to update security practices to achieve compliance.�� Our focus will be to meet the cybersecurity program requirements in a way that minimizes any negative effects on research, and this process may indeed optimize research IT infrastructure across University schools.

Foreign Travel Security:

The University must implement periodic training on foreign travel security to covered individuals engaged in international travel.

Also, the University must implement a travel reporting program, to include an organizational record of international travel, for covered individuals participating in research and development awards when a federal research agency has determined that security risks warrant travel reporting.�� Please note that our current understanding is that such a determination will be specifically included in the terms of the award (i.e., in the federal agency’s Notice of Award, NOA or contract), however, it remains to be seen whether federal research agencies will incorporate this travel reporting requirement as a standard award term.

• What Happens Next: Once the training materials/requirements are made available by a federal research agency, the University will implement periodic training on foreign travel security to covered individuals within one year.�� In parallel, we will review our processes to ensure that researchers are aware of when the terms of a specific federal award require travel registration.�� Finally, the University will also review its travel policies and procedures to ensure that covered individuals register their travel in the University’s travel registration system, when the terms of an award require this.
• How This Impacts You: Moving forward, you may be required to take periodic training on foreign travel security and to register your travel in the University’s travel registration system.

Research Security Training:

The University is required to implement a research security training program for all covered individuals, and to ensure that each covered individual completes such training.

• What Happens Next: The University will implement periodic training on research security as required by the federal agencies.
• How This Impacts You: Moving forward, you may be required to complete research security training.

Export Control Training:

The University must ensure that covered individuals who perform research and development involving export-controlled technologies complete training on U.S. export control and compliance requirements.

• What Happens Next: The University will implement periodic training on export control and compliance as required by the federal agencies.
• How This Impacts You: Moving forward, you may be required to complete export control training.

Timeline:

Within six months of July 9, 2024, federal research agencies are required to submit their plans to OSTP for updating their research security policies to include the elements specified in the Guidelines.�� These updated policies will go into effect no later than six months after they have been submitted and finalized.

The Guidelines state that federal research agencies should ensure that covered institutions have adequate time, but not more than 18 months after the effective date of their plans, to implement the requirements of the Guidelines.

Definitions:

“Covered Individual” means: an individual who (a) contributes in a substantive, meaningful way to the scientific development or execution of a research and development project proposed to be carried out with a research and development award from a Federal research agency; and (b) is designated as a covered individual by the Federal research agency concerned.

In practical terms, the vast majority of University faculty/investigators (PI, co-PI, Senior Scientist, etc.)��who are��conducting research efforts��under a federal award are considered “covered individuals” under this definition.

For More Information:

The Office of the Vice President of Research (OVPR) will publish additional information on the research security program requirements as it becomes available.�� The OVPR website also provides other resources on research security matters.

The post Research Security Program Update appeared first on Office of the Vice President for Research.

I am writing to inform you of federal requirements regarding malign foreign government talent recruitment programs as defined in the CHIPS and Science Act of 2022 (the “CHIPS Act”).

The CHIPS Act requires that each federal research agency establish a policy requiring that covered individuals (including senior and key personnel) certify that they are not part of a malign foreign talent recruitment program (defined below) in the proposal submission and annually thereafter. The CHIPS Act also prohibits research and development awards from being made for any proposal in which a covered individual is participating in a malign foreign talent recruitment program. Agencies are beginning to implement these requirements. As such, University researchers who currently participate in a malign foreign talent recruitment program are not eligible for federal research funding.

Federal agencies will require University researchers to certify that they are not members of a malign foreign talent recruitment program in the proposal submission and annually thereafter throughout the duration of the award. NSF is the first agency to require this certification, beginning May 20, 2024. The certifications are included in the new “Common Forms” of Biographical Sketch and Current and Pending (Other) Support. NIH has communicated that it expects to adopt the Common Forms in January 2025.

More details, including how you can get advice on complying with these requirements, are described at the end of this message.

We also remind you to follow these standard compliance practices:

• Review the University’s guidance on foreign talent recruitment programs.
• Fully disclose your outside engagements (domestic and foreign) in accordance with University and federal requirements. This includes annual and ad hoc disclosures through Reporting of Outside Financial Interests, as well as disclosures made through the Biographical Sketch and Current and Pending (Other) Support forms.
• Carefully consider the acceptance of an international appointment or affiliation, particularly in foreign countries of concern (defined by law as including China, Russia, North Korea, and Iran), as these appointments or affiliations may meet the CHIPS Act definition of a malign foreign talent recruitment program.
• Review Guidance and Advice for Faculty who Engage in Outside Consulting.
• Review other guidance on research security topics.

Thank you for your attention to this important matter.

Regards,
Steve

Steve Dewhurst, PhD
Vice President for Research

The post Research Security Update: Foreign Talent Recruitment Programs appeared first on Office of the Vice President for Research.

As we all know, generative AI is profoundly changing many aspects of our lives – including research and scholarship.�� In an effort to continuously update our guidance to the research community, I’m writing to share some updated information from our major federal research sponsors (NIH, NSF) and some related advisory guidance related to the use of generative AI tools in research.

In June of 2023, NIH issued a new policy that .�� NIH Deputy Director Mike Lauer provided additional details/insights through his blog, in a piece entitled .

More recently (December, 2023), NSF issued a very similar Policy Memo to its extramural research community, indicating that “.”

The also notes that: “Any information uploaded into generative AI tools not behind NSF’s firewall is considered to be entering the public domain. As a result, NSF cannot preserve the confidentiality of that information. The loss of control over the uploaded information can pose significant risks to researchers and their control over their ideas”.

The NSF memo draws attention to the potentially serious unintended consequences that may result from uploading unpublished research papers, data, or scholarly works into ChatGPT or other generative AI tools that do not explicitly guarantee the confidentiality of any uploaded information.�� Please keep this in mind.

Best,
Steve

Stephen Dewhurst, PhD
Vice President for Research
Ģ����ý

The post Updated Advisory Guidance on the Use of Generative AI in Research appeared first on Office of the Vice President for Research.