NSPM-33 research security policy uses the phrase “covered individual” in two overlapping but legally distinct ways, and confusing them is one of the more common mistakes research administrators make when scoping disclosure obligations. This guide sets out who actually qualifies as a covered individual under each definition, what each tier must personally disclose, when those disclosures are due, and what happens if they’re inaccurate or missing.
For the institutional-level research security program requirements that sit alongside these individual disclosure duties, see NSPM-33 Research Security Program Requirements: The Four Mandated Elements. For the specific certification mechanics tied to foreign talent recruitment programs, see Malign Foreign Talent Recruitment Program (MFTRP): Definition, Disclosure, and Consequences.
Two definitions, one overlapping population
1. The disclosure-guidance definition. The National Science and Technology Council’s January 2022 Guidance for Implementing National Security Presidential Memorandum 33 (NSPM-33) directs federal research agencies to standardize disclosure requirements for individuals it groups into two tiers:
- Tier I — principal investigators, co-principal investigators, and other senior/key personnel named on a federal research and development proposal or award, plus, on the agency side, program officers and intramural researchers.
- Tier II — peer reviewers and members of advisory committees or panels who evaluate proposals or provide scientific advice to an agency, but who aren’t themselves performing the funded research.
This is the definition that drives biographical sketch and Current and Pending (Other) Support disclosure obligations — see below.
2. The CHIPS and Science Act definition. Section 10632 of the CHIPS and Science Act of 2022 (codified at 42 U.S.C. § 19231 et seq.) uses “covered individual” for a narrower, statutory purpose: identifying who is subject to the Malign Foreign Talent Recruitment Program (MFTRP) participation prohibition and certification requirement, and, under Section 10634 (42 U.S.C. § 19234), who must complete research security training before an application can be submitted. In practice this population is essentially the same as Tier I above — PIs, co-PIs, and other senior/key personnel — but the legal hook, the certification language, and the consequences for non-compliance are different, because they flow from a different statute. See NSPM-33 for how the presidential memorandum and the CHIPS Act provisions relate to each other.
For most research administrators the practical takeaway is: if someone is a PI, co-PI, or named senior/key personnel on a federally funded proposal, they are a covered individual under both definitions simultaneously, and both sets of obligations below apply to them.
Who qualifies as a Tier I covered individual
Tier I status attaches regardless of the level of effort committed or whether the individual receives salary or compensation from the award. Agencies have consistently applied this broadly:
- The principal investigator on a federal R&D proposal or award
- Any co-principal investigator
- Other individuals identified by the institution as senior/key personnel — typically anyone who contributes in a substantive, measurable way to the scientific development or execution of the project, including responsibility for its design, conduct, or reporting
- On the agency side, program officers and intramural (in-house) researchers involved in the award
This mirrors the population NSF Important Notice No. 149, NIH’s research security training notice, and DOE Policy Flash PF 2025-04 each independently target for research security training certification — see NSF Research Security Training Requirements, NIH Research Security Training Requirements, and NIH Senior/Key Personnel Training Requirements for the agency-specific mechanics and effective dates.
Who qualifies as a Tier II covered individual
Tier II is narrower and covers people evaluating research rather than performing it: peer reviewers assigned to review proposals, and members of federal advisory committees or panels who provide scientific input to an agency. Because Tier II individuals aren’t executing the funded work, their disclosure burden is lighter — it exists primarily to manage conflicts of interest and undisclosed foreign affiliations in the review process itself, not to document the full support picture of a research project.
What Tier I covered individuals must disclose
The NSTC guidance directs agencies toward a standardized set of disclosure categories, implemented through each agency’s biographical sketch and Current and Pending (Other) Support forms (increasingly the shared SciENcv-based NSPM-33 Common Form architecture used by NSF and NIH alike):
- Biographical sketch — all professional appointments and positions, domestic and foreign, whether or not they are remunerated, including titled or honorary positions at foreign institutions. See Biosketch (NIH-style) and NSF Biosketch (SciENcv) for the format each agency currently requires, and NIH Biosketch Worked Example for a filled-in sample.
- Current and Pending (Other) Support — all resources made available to the individual in support of research, domestic or foreign, financial or in-kind (including office/lab space, equipment, or personnel), regardless of whether they relate to the specific project being proposed. This explicitly includes participation in a foreign talent recruitment program, even when uncompensated. See Current and pending support, Other support (NIH format), and NIH Other Support Template: Foreign Disclosure and Certification Rules.
- Foreign talent recruitment program participation and MFTRP certification — a covered individual must disclose any foreign talent recruitment program they participate in, and separately certify they are not a party to a malign foreign talent recruitment program under 42 U.S.C. § 19232(a). See Foreign talent recruitment programme and the MFTRP guide for exactly what makes a program “malign” and what the certification requires.
- Conflict of commitment — outside positions, consulting arrangements, or affiliations that could compete for the individual’s time or professional loyalty with their obligations under the federal award. See Conflict of Commitment (COC).
- Foreign travel security reporting — at institutions that have implemented the foreign travel security element of a research security program, covered individuals engaged in international travel connected to a federally funded project must report itinerary and purpose in advance. See Foreign Travel Security Policy: What Research Institutions Must Require Before International Trips.
- Research security training certification — completion of an approved research security training module, generally within 12 months prior to proposal submission, certified by the individual and the institution. See Research Security Training: What It Is and Which Agencies Require It.
- A persistent digital identifier — agencies are increasingly requiring or strongly encouraging an ORCID iD for senior/key personnel to support disclosure verification and cross-agency matching. See ORCID iD for NIH Senior/Key Personnel.
What Tier II covered individuals must disclose
Tier II disclosure is narrower and agency-specific, but generally covers: current affiliations and professional appointments relevant to conflict-of-interest screening for the proposals or topics under review, financial interests that could bias the review, and, increasingly, participation in foreign talent recruitment programs. Tier II individuals are not typically required to file a full biographical sketch or Current and Pending Support statement in the way Tier I personnel are, because they are not receiving the award funding or executing the research.
When these disclosures are due
Timing varies by agency and by disclosure type, but the general pattern is:
- At proposal submission — biographical sketch, Current and Pending Support, MFTRP certification, and (where applicable) proof of completed research security training are typically due with the proposal itself, or, for training, within the 12 months preceding submission.
- Just-in-time / pre-award — some agencies collect or update disclosures again once an application is selected for funding but before the award is issued.
- Post-award updates — support and affiliation disclosures generally must be updated whenever they materially change during the life of the award, not only at renewal. Mechanisms differ by agency: NIH captures updates through the Research Performance Progress Report (RPPR), while NSF requires an annual Research.gov certification from PIs and co-PIs under Important Notice No. 149.
Because agencies have been revising these requirements on a rolling basis since 2022 — NSF Notice 149, NIH’s research security training notice, and DOE Policy Flash PF 2025-04 have each been issued or updated within the last two years — institutions should confirm current deadlines against the specific agency’s live guidance rather than assume timing is uniform across funders.
How this differs from an institution’s research security program obligations
The disclosures above are personal obligations of the covered individual. They’re distinct from, though closely tied to, the institutional research security program (RSP) that NSPM-33 requires certain federally funded institutions to maintain. An RSP’s four mandated elements — cybersecurity, foreign travel security, research security training, and export control training — are institutional infrastructure; a covered individual’s disclosures are what that infrastructure runs on. See NSPM-33 Research Security Program Requirements: The Four Mandated Elements for the institutional side of the picture.
Consequences of inaccurate or missing disclosure
Consequences differ depending on which obligation is at issue. Under the MFTRP certification statute specifically, if an agency learns a covered individual participated in a malign foreign talent recruitment program, it may require the individual’s substitution or removal from the project, reduce award funding, or suspend or terminate the award (42 U.S.C. § 19233(a)(3)); the statute doesn’t itself legislate debarment under 2 CFR Part 180, though an agency’s independent debarment authority remains available separately. More broadly, a false certification or material omission on a federal disclosure form can also expose the individual and institution to False Claims Act or other federal fraud liability, independent of any research-security-specific consequence. See the consequences section of the MFTRP guide for the full breakdown of what triggers agency action and what doesn’t.
Checklist for research administrators
- Identify every Tier I covered individual on a proposal — PI, co-PI, and everyone the institution designates as senior/key personnel — regardless of whether they’re requesting salary support.
- Confirm each has a current biographical sketch and Current and Pending Support statement in the agency’s required format, disclosing all domestic and foreign support, paid or unpaid.
- Confirm MFTRP certification is on file and current for each covered individual, and that none is a party to a foreign talent recruitment program that would trigger the prohibition.
- Verify research security training completion is documented within the applicable agency’s lookback window before submission.
- Track post-award changes to support, affiliations, or foreign travel that require an update, not just a renewal-cycle refresh.
- Separately confirm any Tier II reviewers or panel members the institution puts forward have completed the narrower disclosure the review role requires.
Frequently asked questions
Is a graduate student or postdoc a covered individual under NSPM-33?
Generally only if the institution designates them as senior/key personnel on a specific proposal or award — being funded by a federal grant as a trainee doesn’t, by itself, make someone a covered individual in the NSPM-33 sense. The designation follows the substantive-contribution and named-personnel test, not funding source alone.
Does “covered individual” mean the same thing at every federal agency?
The underlying Tier I/Tier II framework comes from a single government-wide NSTC guidance document, and the CHIPS Act definition is likewise government-wide by statute, so the core population is consistent. What varies by agency is implementation detail: which training modules are accepted, exact submission and update timing, and the specific form used to collect disclosures.
Do unpaid or in-kind foreign appointments still have to be disclosed?
Yes. Both the biographical sketch and Current and Pending Support disclosure categories explicitly cover unpaid, honorary, and in-kind positions and support — compensation isn’t the trigger for disclosure, participation and access are.
Is a covered individual under the MFTRP statute the same person as a Tier I covered individual under the NSTC disclosure guidance?
In practice, almost always yes — both definitions center on PIs, co-PIs, and senior/key personnel. They remain legally distinct because they derive from different authorities (the CHIPS and Science Act versus the NSTC’s NSPM-33 implementation guidance), which is why an institution can’t assume satisfying one automatically satisfies the other; both sets of forms and certifications still need to be tracked.
