CITI Program: What It Is & What It Covers

The CITI Program (Collaborative Institutional Training Initiative) is the online training platform most U.S. research institutions use to deliver and document research-ethics and compliance education — human subjects research, responsible conduct of research (RCR), good clinical practice (GCP), conflicts of interest, biosafety, export control, and related topics. It is not a regulation or a funder policy itself; it is the training infrastructure that institutions point at to satisfy regulations and policies that come from elsewhere (45 CFR 46, 42 CFR 50, NSF and NIH award terms, ICH E6). Understanding what CITI actually covers — and, just as importantly, what it doesn’t — matters for anyone administering research compliance, because “complete your CITI training” gets treated as a single, interchangeable requirement far more often than the underlying rules actually allow.

What the CITI Program is

CITI Program originated in 2000 as a collaboration between academic and commercial research centers focused on human subjects research (HSR) protections in biomedicine and the social sciences, administered through the University of Miami. In May 2016, BRANY (the Biomedical Research Alliance of New York) acquired the CITI Program; CITI now operates as a division of BRANY, which is itself owned by four New York City academic medical centers — NYU School of Medicine, Montefiore Medical Center, Mount Sinai, and Northwell Health. CITI reports over 3,000 subscribing organizations (including roughly 95% of Carnegie R1 research universities) and more than 15 million learners with over 25 million course completions to date.

Operationally, CITI is a subscription-based learning management system (LMS): an institution subscribes, configures which course “groups” apply to which learner populations, and CITI tracks completions, expirations, and quiz scores against that configuration. Learners who are not affiliated with a subscribing institution can also register and pay per-course as independent learners.

What CITI training covers

CITI’s course library spans several distinct compliance domains, each built and periodically updated by subject-matter authors and reviewed by content experts. The domains most relevant to research administration are:

Human Subjects Research (HSR) — IRB procedures, informed consent, and human-research-protections content aligned to the Common Rule (45 CFR 46) and FDA human subjects regulations, plus standalone modules for institutional/signatory officials, IRB chairs, and public health researchers.
Responsible Conduct of Research (RCR) — authorship, collaborative research, data management, mentoring, peer review, and research misconduct, in the format used to satisfy NSF and NIH funding-related training expectations. See CASRAI’s RCR training requirements guide for how NIH and NSF differ on this specific point.
Good Clinical Practice (GCP) — courses aligned to ICH E6 and applicable FDA regulations for clinical trial conduct; see CASRAI’s ICH GCP dictionary entry.
Conflicts of Interest (COI) — including a “COI Basic” course built to align with the U.S. Public Health Service (PHS) financial conflict of interest regulation at 42 CFR Part 50, Subpart F.
Animal Care and Use (ACU) — IACUC-facing content on animal welfare in research.
Biosafety and Biosecurity, Export Control, Information Privacy and Security, and Research Security — narrower compliance domains that individual institutions increasingly require alongside HSR/RCR, particularly as NSF and other federal agencies have expanded research-security training expectations.

Because each domain is delivered as separately assignable modules rather than one monolithic course, an institution typically configures different “curricula” for different learner roles (e.g., a biomedical PI on an NIH R01 gets a different module set than a graduate student on an NSF-funded project) rather than assigning the entire library to everyone.

What CITI training actually satisfies — and where it doesn’t

This is the point most often glossed over in institutional guidance, and it is worth stating precisely rather than treating “CITI training” as a single pass/fail requirement:

NSF’s Responsible and Ethical Conduct of Research (RECR) requirement can be satisfied entirely through CITI’s online RCR course — NSF leaves the delivery method to the institution’s discretion, and fully online instruction is acceptable.
NIH’s RCR instruction requirement (NOT-OD-10-019, NOT-OD-22-055) is different: NIH requires a minimum of eight contact hours with a substantial face-to-face/live-discussion component, and explicitly states that a plan relying entirely on online coursework is not acceptable except in narrow, well-justified circumstances. CITI’s online RCR course can supplement an NIH-compliant plan, but on its own it does not satisfy the NIH requirement. Institutions typically pair CITI with an in-person seminar, workshop, or discussion series to close that gap.
PHS financial conflict of interest (FCOI) training under 42 CFR 50.604(f) requires every “Investigator” to complete FCOI training before engaging in PHS-funded research and at least every four years thereafter (sooner if the institution’s policy changes materially, a new investigator joins the project, or noncompliance is found). CITI’s COI Basic course is widely used to satisfy this, but the regulation itself does not mandate CITI specifically — any training that covers the regulation, the institution’s own policy, and the investigator’s disclosure obligations qualifies. See CASRAI’s conflict-of-interest disclosure guide for the disclosure side of this same requirement.
IRB/human subjects approval is not itself a federal training mandate with a fixed hour count — it’s an institutional prerequisite. Most IRBs require current HSR training (commonly CITI) attached to a protocol before they will review it, but the specific course, refresher interval, and acceptable alternatives are set by each institution’s IRB office, not by 45 CFR 46 directly. See CASRAI’s IRB/REC approval process guide and the IRB dictionary entry.
NSF’s separate research-security training and certification requirements (effective in phases through late 2025) are administratively distinct from RECR — different course, different renewal cadence, different certifying party (the Authorized Organizational Representative certifies on the institution’s behalf). CITI offers research-security content, but completing RCR training does not by itself satisfy the research-security certification, and vice versa.

The practical consequence: “I completed my CITI training” is not a self-sufficient compliance statement. Which course, which module set, and which specific federal or funder requirement it maps to all matter, and they don’t always map one-to-one.

Institutional subscriptions, curricula, and learner records

Subscribing institutions configure CITI at the organization level — selecting which course groups exist, which learner populations are assigned to each, and (in many cases) adding institution-specific supplemental content on top of CITI’s base modules. This is why the “same” course (e.g., HSR Basic) can look somewhat different depending on which institution a learner is affiliated with.

Completion records live in the learner’s CITI account, not the institution’s system in isolation — CITI course completion records are imported into institutional administrative/compliance systems (commonly on a daily feed), and a learner keeps access to their own completion history and certificates independent of any single institutional affiliation. When a researcher moves between institutions, they typically add the new institution as an additional affiliation on the same CITI account rather than creating a new one; whether a given course completion transfers without retaking it depends on the receiving institution’s own policy (institutions set their own acceptance window, commonly somewhere between one and several years) and whether the learner is enrolling in the matching course stage (Basic vs. Refresher). Some institutions do not accept a “Verified CITI Training” report from another institution automatically and require the learner to reaffiliate and, in some cases, retake stage-appropriate modules.

Individual learners not affiliated with a subscribing organization can register directly and pay per course; independent-learner registration fees are set by CITI (and sometimes subsidized by a specific institution’s affiliate-pricing arrangement) rather than being a flat, published rate.

The interoperability gap

CITI completion data is portable between a learner’s own institutional affiliations inside the CITI platform itself, but there is no standard, machine-readable credential format connecting CITI completions to the broader research-information infrastructure — no routine linkage to a researcher’s ORCID iD, no common data element set that a CRIS/RIM system, a grants-management platform, and an IRB’s protocol-management system can all consume identically. Each institution builds its own local verification workflow (a completion report attached to a protocol, a nightly import into an eIRB or grants system, a manual check by a compliance office), which is a large part of why “training verified” so often means “verified by this specific institution’s own process” rather than something portable across institutions the way, say, an ORCID iD or a DOI is. This is the same underlying tracking problem CASRAI’s RCR training guide covers in more detail — CITI is the dominant training source, but it does not by itself close the cross-institutional verification gap.

Related compliance requirements

CITI training is one input into several distinct compliance processes that research administrators track separately. See also:

Frequently asked questions

Is CITI Program training free?

Not directly to the learner in most cases. Institutions pay a subscription fee that covers course access for their affiliated learners. Someone not affiliated with a subscribing institution can register as an independent learner and pay CITI’s per-course fee directly.

Does completing CITI training automatically satisfy my funder’s requirement?

Not automatically — it depends on the specific requirement. CITI’s online RCR course fully satisfies NSF’s RECR requirement, but does not by itself satisfy NIH’s RCR instruction requirement, which requires a face-to-face/live-discussion component NIH does not consider CITI’s online course sufficient to provide on its own.

How long is CITI training valid before it needs to be redone?

There is no single answer — it depends on which course and which policy is applied. PHS FCOI training must be renewed at least every four years under 42 CFR 50.604(f); many institutions set their own refresher intervals (commonly one to three years) for HSR and GCP courses, which is a local institutional decision layered on top of, not replacing, any federal minimum.

If I completed CITI training at my previous institution, do I have to redo it?

Usually you add your new institution as an affiliation on the same CITI account, and whether a specific prior completion transfers depends on the new institution’s acceptance window and whether you’re enrolling in the matching course stage. Some institutions require reaffiliation and a fresh completion rather than accepting another institution’s verified record automatically.

Is CITI Program the only training provider institutions use for these requirements?

It is the dominant one in the U.S. research sector, but the underlying regulations (45 CFR 46, 42 CFR 50, NIH’s RCR policy, NSF’s RECR policy) specify training content and delivery requirements, not a named vendor — an institution may build or use an alternative program as long as it meets the applicable regulation’s substantive requirements.