NIH Research Security Training (RST)

NIH Research Security Training (RST) is the requirement, established by NIH Guide notice NOT-OD-26-017, that every “covered individual” on an NIH grant application — meaning every person listed as senior/key personnel — has completed research security training within the 12 months before that application’s due date. It applies to applications with due dates on or after May 25, 2026. RST implements Section 10634 of the CHIPS and Science Act of 2022 and sits within the government-wide research-security framework established by NSPM-33.

What makes the requirement distinctive

Two features separate RST from most other NIH training obligations:

• It is currency-based, not one-and-done. RST is measured against each specific application’s due date rather than held as a lifetime credential. Training that was completed but has fallen outside the 12-month window does not satisfy the requirement for a new submission.
• It uses a dual certification. Compliance is evidenced twice: an institutional certification by the Authorized Organizational Representative (AOR) on the SF424 (R&R) face page, and an individual certification captured through the person’s NIH Biographical Sketch in SciENcv.

Who is covered

The obligation attaches to individuals designated senior/key personnel on a specific application — the Program Director/Principal Investigator and any co-investigator or other named scientist contributing substantively and measurably to the project’s scientific development or execution. It does not, by itself, reach personnel who are not senior/key personnel on that application.

What it is not

RST is frequently confused with three adjacent obligations, and the distinctions are administrative as well as legal:

• Not the Other Support / biosketch disclosure rules. NIH notice NOT-OD-25-133 (effective October 1, 2025) governs how covered individuals complete Other Support and biosketch disclosures. RST governs training. Two notices, two compliance obligations — they are conflated because both flow from the same research-security push and both touch the SciENcv workflow.
• Not NSF’s requirement. NSF runs its own research-security training certification under Important Notice No. 149. It is parallel to NIH’s but legally and administratively separate; completing one does not discharge the other.
• Not RCR training. Responsible Conduct of Research training is tied to particular award mechanisms (notably training and career-development grants) and covers research ethics rather than security. A graduate research assistant named in an application’s personnel section but not designated senior/key personnel has no independent RST obligation for that application, even where an RCR requirement does apply to the same person.

Worked example

A principal investigator listed as senior/key personnel on an R01 renewal with a due date after May 25, 2026 completes a qualifying research security training module in March 2026 — inside the 12 months preceding the due date. At submission the institution’s AOR certifies completion on the SF424 (R&R) face page, and the PI’s own certification is captured through their NIH Biographical Sketch in SciENcv.

Counter-example

A co-investigator is added to a multi-PI application as senior/key personnel but last completed research security training 18 months before the due date. Because currency is measured per application rather than as a standing credential, that co-investigator must retake qualifying training before the application can be truthfully certified compliant.

Related CASRAI content

For the full procedural treatment — the training options that satisfy the requirement, certification and institutional tracking mechanics, and a compliance timeline for research-administration offices — see the NIH research security training requirements guide. See also research security and Other Support (NIH format).