NSF’s research-security package is easiest to misread when institutions treat it as one compliance event. The public record instead shows separate checkpoints with different actors, dates and systems: proposal-stage certifications, annual post-award MFTRP certifications for certain investigators, an institutional Foreign Financial Disclosure Report, and training evidence the institution must be able to produce. Important Notice No. 149 was published on June 30, 2025, updated on November 24, 2025, and, with NSF’s implementation FAQ, places the main IN-149 proposal changes into effect on December 2, 2025, after a shutdown-related delay. IN-149 implementation FAQ
For proposal offices, the immediate point is that training, organizational certifications and senior/key personnel certifications do not sit in one field. NSF says each senior/key person must have completed required research-security training within the 12 months before proposal submission, and the authorized organizational representative certifies that completion for all identified senior/key personnel. NSF also says organizational certifications belong on the Cover Sheet, while senior/key personnel certifications attach to the Biographical Sketch and Current and Pending (Other) Support components. IN-149 implementation FAQ
The MFTRP rules create a second workflow that research offices should not collapse into proposal review. NSF says a person currently party to a Malign Foreign Talent Recruitment Program cannot serve as a senior/key person on an NSF proposal or on any NSF award made after May 20, 2024. Separately, NSF says PIs and co-PIs on active awards made on or after May 20, 2024 must certify annually in Research.gov whether they do or do not participate in an MFTRP. The FAQ adds two scope limits that matter in audits: proposal-submission certifications apply only to the proposed project, and awards made before the effective date of IN-149 are not subject to the notice’s new requirements. IN-149 implementation FAQ research security portal
The FFDR is a third workflow, and it belongs to the direct-recipient institution, not to individual investigators. NSF says each institution of higher education receiving NSF funding must submit an FFDR through Research.gov. Under IN-149, the annual report covers current foreign financial support from sources associated with foreign countries of concern when the aggregate value reaches $50,000 or more per source in the reporting period, and negative reports are still required. NSF also says the requirement does not apply to subaward entities or individual beneficiaries. The administrative implication is analytical rather than speculative: an institution cannot assume that investigator disclosure files alone answer an institutional FFDR obligation with different thresholds, scope and filer. research security portal IN-149
Training adds a fourth checkpoint: evidence retention. NSF says institutions may use NSF-recognized SECURE Center modules or other commercial or locally developed training if the content covers the required topics. But NSF also says its web modules do not save a training record; users can download or print a completion certificate, and a learning management system is optional. In practice, that means compliance turns on an institution’s ability to collect proof, not on use of any single platform. training page research security portal
The most important caution for 2026 readers is timing. The training page still contains wording that the notice went into effect on October 10, 2025, while the FAQ says implementation was delayed by the October 1 to November 12, 2025 lapse in appropriations and became effective on December 2, 2025. That discrepancy makes the notice and FAQ the safer records for date-sensitive workflow design. The same caution applies to future-facing statements in IN-149: the notice says NSF intends to expand annual post-award MFTRP certification beyond PI and co-PI roles and intends to make FFDR information public, but the records here do not establish that either step had been implemented by October 25, 2026. training page implementation FAQ IN-149
