The Government Accountability Office has warned that agencies may be vulnerable to foreign adversaries seeking to steal proprietary data.

In a new report published Wednesday, the congressional watchdog looked at the implementation of 12 best practices the Small Business Administration established in March 2023 for agencies to manage risks associated with Small Business Innovation Research, or SBIR, and Small Business Technology Transfer, also known as STTR, programs.

GAO found that participating agencies applied only some of the best practices to their due diligence processes when screening small business applicants for research and development funding opportunities.  

Cyber as the primary attack surface for conflict is one of the key topics at the Potomac Officers Club’s 2026 Cyber Summit on May 21. Join government leaders as they discuss initiatives to strengthen federal cyber defenses. Register today.

Are Foreign Adversaries Targeting SBIR/STTR Programs?

Congress has previously raised concerns over the possibility that foreign adversaries are exploiting vulnerabilities in SBIR and STTR and in small businesses that participate in federally funded R&D programs.

In May 2025, Sen. Joni Ernst, R-Iowa, revealed that the National Institutes of Health flagged and denied SBIR/STTR applications of firms and people from China and Russia.

“The SBIR-STTR programs provide a valuable pipeline of technology that we cannot allow China and other foreign adversaries to steal,” Ernst, who serves as chair of the Small Business and Entrepreneurship Committee, said.

What Are the Gaps GAO Found in SBIR/STTR Programs?

In the report, GAO noted that the SBIR and STTR Extension Act of 2022 (Extension Act) requires agencies to incorporate applicable best practices into due diligence programs to manage potential foreign risks.

However, as of August 2025, all agencies assessed for the report incorporated three of the 12 best practices. Most agencies adopted additional practices, such as documenting their risk-based approach within their due diligence processes and disclosures of covered individuals or those associated with countries of concern.

GAO also pointed out that the Extension Act tasks agencies to assess applicant cybersecurity, but only nine of the 11 participating agencies have mechanisms in place for evaluating cyber practices.

The congressional watchdog provided 26 recommendations, most of which call on agencies to adopt all of SBA’s best practices on due diligence programs. One recommendation is urging the SBA to use interagency meetings to discuss the best practices.

The Cybersecurity and Infrastructure Security Agency has released new guidance aimed at helping critical infrastructure organizations and state, local, tribal and territorial governments address insider threats.

As CISA continues to publish guidance to help organizations strengthen their cybersecurity posture, collaboration between government and industry remains essential. The Potomac Officers Club’s 2026 Cyber Summit will bring together federal and industry leaders to discuss priorities shaping the cyber landscape. Book your spot at this May 21 event!

CISA said Wednesday the new resource, titled Assembling a Multi-Disciplinary Insider Threat Management Team, offers actionable strategies to help organizations prevent, detect and mitigate insider threats.

What Does the CISA Insider Threat Infographic Say?

According to CISA, an insider threat management team plays a key role in managing an organization’s insider threat program, tracking potential threats and mitigating the consequences of an insider’s malicious actions.

The infographic outlines the Plan, Organize, Execute and Maintain, or POEM, framework. Under the POEM framework, an organization should plan how it will use a threat management team, organize the team in alignment with the organization’s requirements, implement insider threat mitigation efforts and maintain the team’s viability.

For the execution phase, the infographic recommends that organizations implement mandatory training; coordinate analysis and response measures through process integration; and establish a hub to gather, review and analyze elements to improve information management, among other best practices.

What Did CISA Officials Say About the Insider Threat Guidance?

Acting CISA Director Madhu Gottumukkala said CISA seeks to provide organizations with practical strategies and actionable resources to help leaders build multidisciplinary teams and protect systems relied upon by the public.

Steve Casapulla, executive assistant director for infrastructure security at CISA, noted that the infographic reflects input from industry and government partners and aims to provide actionable guidance for establishing insider threat management teams.

“We encourage leadership to draw expertise from across departments for a holistic defense, while fostering a culture of trust where employees feel empowered to report concerns and stop threats before they escalate,” Casapulla added.

What Is CISA? 

CISA is an agency within the Department of Homeland Security that defends national, digital and physical infrastructure from cyberthreats.

The agency has led efforts to strengthen cybersecurity and critical infrastructure resilience through guidance and interagency collaboration. CISA worked with the FBI and other international partners to issue a joint guidance on secure connectivity principles for operational technology.

In December, CISA updated its Cross-Sector Cybersecurity Performance Goals to reflect evolving threats and integrate best practices across critical infrastructure sectors and launched a new platform to facilitate public-private collaboration in cybersecurity.

In addition, the agency recently released a new resource that identifies hardware and software categories that are expected to support post-quantum cryptography standards.