The Government Accountability Office has warned that agencies may be vulnerable to foreign adversaries seeking to steal proprietary data.
In a new report published Wednesday, the congressional watchdog looked at the implementation of 12 best practices the Small Business Administration established in March 2023 for agencies to manage risks associated with Small Business Innovation Research, or SBIR, and Small Business Technology Transfer, also known as STTR, programs.
GAO found that participating agencies applied only some of the best practices to their due diligence processes when screening small business applicants for research and development funding opportunities.
Cyber as the primary attack surface for conflict is one of the key topics at the Potomac Officers Club’s 2026 Cyber Summit on May 21. Join government leaders as they discuss initiatives to strengthen federal cyber defenses. Register today.
Are Foreign Adversaries Targeting SBIR/STTR Programs?
Congress has previously raised concerns over the possibility that foreign adversaries are exploiting vulnerabilities in SBIR and STTR and in small businesses that participate in federally funded R&D programs.
In May 2025, Sen. Joni Ernst, R-Iowa, revealed that the National Institutes of Health flagged and denied SBIR/STTR applications of firms and people from China and Russia.
“The SBIR-STTR programs provide a valuable pipeline of technology that we cannot allow China and other foreign adversaries to steal,” Ernst, who serves as chair of the Small Business and Entrepreneurship Committee, said.
What Are the Gaps GAO Found in SBIR/STTR Programs?
In the report, GAO noted that the SBIR and STTR Extension Act of 2022 (Extension Act) requires agencies to incorporate applicable best practices into due diligence programs to manage potential foreign risks.
However, as of August 2025, all agencies assessed for the report incorporated three of the 12 best practices. Most agencies adopted additional practices, such as documenting their risk-based approach within their due diligence processes and disclosures of covered individuals or those associated with countries of concern.
GAO also pointed out that the Extension Act tasks agencies to assess applicant cybersecurity, but only nine of the 11 participating agencies have mechanisms in place for evaluating cyber practices.
The congressional watchdog provided 26 recommendations, most of which call on agencies to adopt all of SBA’s best practices on due diligence programs. One recommendation is urging the SBA to use interagency meetings to discuss the best practices.
