Department of Defense (DoD) SBIR/STTR Research

SBIR and STTR awards are made to eligible small businesses. Universities may participate in the research through subawards or other permitted research arrangements.

For STTR projects, the small business must perform at least 40% of the research and development work and the partnering research institution must perform at least 30%. STTR projects also require an agreement between the small business and research institution addressing intellectual property rights and rights to carry out follow-on research, development, or commercialization activities.

Although the small business is responsible for submitting the DoD SBIR/STTR proposal, requirements contained in the solicitation, prime contract, or award may affect Stony Brook's proposed scope of work or be incorporated into the University's subaward or research agreement.

Researchers should therefore evaluate the requirements applicable to Stony Brook's portion of the project before agreeing to participate.

An important consideration is whether Stony Brook's portion of the project can remain fundamental research.

Consider whether:

• Stony Brook researchers will be free to publish the results of their research.
• Publication is subject only to limited review for proprietary information or patent protection rather than sponsor approval.
• Students and other appropriate University researchers may participate.
• The work is intended to produce openly disseminated scientific knowledge rather than restricted technical deliverables.

Publication approval requirements, dissemination restrictions, access restrictions, or other contractual limitations may affect the fundamental research analysis and may introduce export control or other research security requirements.

Contact ORS before agreeing to restrictions affecting publication, dissemination, or participation.

Many DoD SBIR/STTR topics involve technologies with military, defense, aerospace, cybersecurity, microelectronics, autonomous systems, advanced computing, or other sensitive applications.

DoD topics may expressly identify technology as restricted under U.S. export control regulations and may require disclosure of proposed foreign-national participation. Depending on the technology and scope of work, foreign persons may be restricted from performing certain project activities or accessing controlled technical information.

Researchers should contact ORS when:

• A topic or solicitation identifies export control restrictions.
• Stony Brook will receive export-controlled technical information, software, equipment, or materials.
• Foreign persons will participate in technical work that may involve controlled technology.
• The project involves international transfers of equipment, software, technology, technical information, or research materials.

ORS can determine the export control requirements applicable to Stony Brook's proposed activities.

DoD SBIR/STTR projects frequently involve technical information provided by the small business, DoD, a prime contractor, or another project participant.

This information may include:

• Proprietary company information.
• Engineering drawings or design files.
• Restricted software or source code.
• Technical specifications.
• Mission-specific or operational information.
• Federal Contract Information (FCI).
• Controlled Unclassified Information (CUI).
• Government-Furnished Information (GFI).
• Export-controlled technical information.

Receiving restricted information may affect where the work can be performed, who may access the information, how information may be shared, and what computing or information protection requirements apply.

Researchers should contact ORS before receiving restricted technical or government information for a proposed DoD SBIR/STTR project.

DoD increasingly incorporates cybersecurity requirements into contracts and solicitations involving Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

Depending on the project and applicable contract requirements, the small business or participating research institution may be required to demonstrate compliance with specified cybersecurity requirements, including applicable DFARS clauses, NIST SP 800-171 requirements, CMMC requirements, or other DoD safeguarding standards.

CMMC implementation is being phased into DoD contracting requirements and continues to evolve. Applicable CMMC requirements depend on the specific solicitation, contract, information involved, and required assessment level. Researchers should rely on the requirements stated in the applicable solicitation and award and consult ORS when CMMC requirements are identified.

Stony Brook researchers should not assume that ordinary University research computing resources satisfy project-specific DoD cybersecurity requirements.

ORS will review the requirements applicable to Stony Brook's scope of work and coordinate access to appropriate University resources when enhanced information protection or secure research computing is required.

DoD SBIR/STTR projects involving international activities may require additional research security or export control review.

Contact ORS when the project involves:

• Foreign research collaborators.
• Foreign persons participating in technical work.
• Work conducted outside the United States.
• International access to research systems or technical information.
• International shipments or hand-carry of research equipment or materials.
• Electronic transfers of software, technology, technical information, or research data outside the United States.
• Foreign organizations or entities subject to U.S. Government restrictions.

The presence of international participants does not automatically prohibit a project, but the specific technology, information, recipient, destination, and contractual requirements must be evaluated.

DoD SBIR/STTR requirements may appear in the:

• Topic description.
• Broad Agency Announcement (BAA).
• Request for Proposal or solicitation.
• Statement of Work.
• Prime contract.
• Proposed subaward.
• Research agreement.
• Data or information protection requirements.
• DFARS clauses or other incorporated contract provisions.

Researchers should pay particular attention to language involving:

• Export controls.
• Foreign nationals or foreign persons.
• Publication or dissemination restrictions.
• CUI or FCI.
• NIST SP 800-171.
• CMMC.
• Secure computing.
• Cybersecurity requirements.
• Proprietary technical information.
• Government-Furnished Information.
• Restrictions on sharing technical information or software.

The absence of a particular requirement in the initial topic description does not necessarily mean it will not appear later in the contracting or award process.

Most proposed DoD SBIR/STTR collaborations can proceed after the applicable requirements are identified.

Depending on the project, ORS may:

• Determine that no additional research security requirements apply to Stony Brook's scope of work.
• Determine whether Stony Brook's proposed work may qualify as fundamental research.
• Identify export control requirements.
• Review foreign person participation or international research considerations.
• Identify government or proprietary information protection requirements.
• Determine whether applicable requirements call for a Data Protection Plan, Technology Control Plan, or secure research computing environment.
• Coordinate with OSP during proposal development or agreement negotiation.
• Coordinate with other University offices, as appropriate.

Early review is particularly important because research security and cybersecurity requirements may affect the proposed scope of work, project personnel, computing environment, budget, or agreement terms.