Due diligence is the assessment of security risks presented by small business concerns seeking a federally-funded award using a risk-based approach, evaluating (1) the cybersecurity practices, (2) patent analysis, (3) employee analysis, and (4) foreign ownership of the small business concern.

Foreign Ownership
a. Does the level of foreign ownership or corporate governance structure allow for control and influence over the company’s key business decisions or provide access to key IP.
b. Is there, and what is the nature of, any connection to individuals or entities on any of the US Government’s Entity Lists?

Employee Analysis
a. So the personal and professional affiliations with foreign individuals and entities represent a risk?
b. Is there, and what is the nature of, any connection to individuals or entities on any of the US Government’s Entity Lists?

Patents
a. Do key personnel or does the company have a history of filing patents or transferring patents abroad?

Cyber
a. What is the company’s Security Scorecard score?
b. Is there a history of data and/or IT/IS breaches?

AFWERX uses the OSD R&E Risk Analysis Matrix to assign risk determinations for all proposals that complete the due diligence program.

Each small business applying for the SBIR and STTR programs under the DAF are required to disclose all funded and unfunded relationships with foreign countries, using the foreign disclosure form, for all owners and covered individuals. A covered individual is defined as all senior key personnel identified by the small business in the application (i.e., individuals who contribute to the scientific development or execution of a project in a substantive, measurable way). Applicants must include the following information on the disclosure form:

• the identity of all owners and covered individuals of the firm who are a party to any malign foreign talent recruitment program;
• the existence of any parent company, joint venture, or subsidiary of the firm that is based in or receives funding from, any foreign country of concern;
• any current or pending contractual or financial obligation or other agreement specific to a business arrangement, or joint venture-like arrangement with an enterprise owned by a foreign state or any foreign entity;
• whether the firm is wholly owned in a foreign country;
• any venture capital or institutional investment and if the investing entity has a general partner or any other individual holding a leadership role who has a foreign affiliation with any foreign country of concern;
• any technology licensing or intellectual property sales or transfers to a foreign country of concern during the 5-year period preceding submission of the proposal;
• any foreign business entity, offshore entity, or entity outside the United States related to the firm;
• any owners, officers, or covered individuals that have a foreign affiliation with a research institution located in a foreign country of concern; and information technology and information safeguarding plans.

1. Go to and create an account at www.projectspectrum.io/#/signup
2. Login at www.projectspectrum.io/#/login
3. Go to www.projectspectrum.io/#/courses-encite
4. Take note of the Username and copy the Password listed on the page.
5. Search for “FOCI” and select/click on the course you want to take. (You are looking for “Understanding FOCI”)
6. That will take you to www.encite.io/login/index.php where you login with the Username and Password provided on the previous page.
7. Click on “Enroll me”.
8. Click on “Enter”.
9. You should now be in the course!

RGI does not maintain a black list of any companies. We evaluate every proposal separately and therefore the risk levels can change from proposal to proposal as RGI learns more about the companies, the markets, the supply chains, or the key management personnel and their foreign relations, associations, affiliations, or financial investors.