You Just Got Your NIH Phase I Award: What’s Next?

By Barbara Serafin, Chief Operations & Compliance Officer, BW&CO

A plain-English guide for new NIH SBIR and STTR Phase I awardees.

Who's Behind This Guide

I'm a compliance and submission specialist. My work lives in the parts of federal funding that most scientists would rather not handle: the registrations, the budgets, the reporting, and the quiet rules that determine whether an award functions the way it should.

Across more than 150 NIH SBIR and STTR engagements, I've seen what tends to happen after the award notice arrives. The difficulties are rarely scientific; they are almost always administrative. A registration lapses and freezes a drawdown. The books won't hold up to an audit. A reporting deadline passes that no one had tracked. None of it is difficult once you understand where the risks sit, and this guide is the concise version of what I wish every new awardee had in hand on day one.

First, congratulations. Winning a Phase I is a significant milestone.

A Phase I award, however, is not a lump sum deposited to your account. The funds are released through a federal payment system and must be drawn and spent under specific rules, and your compliance obligations begin on the award date, not the day you return to the lab. How you draw the funds, what you may spend them on, and what you must report (and when) are all manageable, and all too rarely explained. Below is the sequence I'd recommend.

Your First 30-60 Days: A Quick Checklist

Your Notice of Award (NoA) is the binding document for everything below. Read it closely: it states your budget, your reporting schedule, your indirect cost rate, and any award-specific terms or restrictions. Where this guide and your NoA disagree, the NoA wins.

• Read your Notice of Award in full. Find it in eRA Commons under Status. Note the project period, the approved budget by category, your reporting due dates, and any special terms of award.

• Confirm your federal registrations are still active. Your SAM.gov registration must be renewed every year, and a lapse will block your ability to draw funds. Confirm SAM.gov, eRA Commons, and your SBA Company Registry entry are all current.

• Get set up to receive funds. NIH pays through the HHS Payment Management System (PMS) on an advance-payment basis - you may draw funds before you have spent them, but only as you need them. Keep each draw to no more than three business days before you will disburse the cash. Make sure your organization is enrolled and the right person has access.

• Confirm who does what. Identify your Authorized Official / Signing Official, your PI, and whoever will handle drawdowns and reporting. Where you can, these should not all be the same person (more on that below).

• Save your PO and GMS contacts. Your Program Officer (scientific and programmatic questions) and your Grants Management Specialist (business, financial, and compliance questions) are named on your NoA. Add both to your contacts now; they are your first call before any change.

• Set up accounting to track the award separately. You need to show costs by award and by category, and to separate direct from indirect costs. A clean system now saves a painful cleanup later.

• Calendar every due date. Progress reports, financial reports, and invention reporting all have deadlines. Put them on a shared calendar the day you read your NoA.

• Calendar the 120-day closeout deadline. Your final reports are due within 120 days of the end of the project period. Note it at the outset so closeout is not a last-minute scramble.

Getting Paid - and Staying Compliant

NIH funds Phase I awards on an advance-payment basis through the HHS Payment Management System: you may draw funds before you have spent them. The constraint is timing. Federal cash-management rules expect you to draw only as the need arises - as a rule of thumb, no more than three business days before you actually disburse the funds - so that federal cash does not sit in your account. Drawing too early, or in larger amounts than you need, creates a cash-management problem and is exactly the kind of issue that surfaces in a review. A few habits keep this clean:

Spend only on allowable costs. For for-profit SBIR and STTR awardees, NIH applies the cost principles in FAR Subpart 31.2 - incorporated through Chapter 18 of the NIH Grants Policy Statement - rather than 2 CFR Part 200, to determine what you may charge to the award. Costs must be reasonable, allocable to the project, and consistently treated. Some everyday expenses, such as alcohol, lobbying, most entertainment, and bad-debt write-offs, are simply not allowable.

Document effort, not just dollars. One of the audit findings I see most often with small awardees is weak support for salary charges. If you charge a person's time to the award, you need records showing the effort actually went to the project. Set up timekeeping on day one, including for founders who pay themselves.

Understand your indirect (F&A) costs. Your award includes an indirect cost rate to cover overhead you cannot tie to a single project. The rate and basis are stated in your NoA - use that figure. If you do not yet have a negotiated rate, NIH has historically allowed small businesses to use up to 40 percent without one; the institutes are now handling this differently, however, so confirm what applies to your award with your Grants Management Specialist (GMS) before you build an internal budget.

Keep your paperwork. Keep receipts, payroll records, your accounting ledger, and your NoA together and backed up. Federal rules generally require you to retain records for three years from the date you submit the Federal Financial Report (FFR) that covers those costs, and your NoA can require longer.

Common Traps for Small SBIR/STTR Teams

A few issues come up again and again with small, lean teams. None are hard to avoid once you see them coming.

One person wearing every hat. When the founder is also the CEO, the PI, and the person who signs off on spending, you lose the separation of duties that keeps federal money defensible. You do not need a big team, but the person who approves an expense should not be the only one who requested and recorded it. Build in a second set of eyes, even a part-time bookkeeper, early.

The work-split rules are not a suggestion. For an SBIR Phase I, your small business must perform at least two-thirds of the work. For an STTR, your company must do at least 40 percent and your research-institution partner at least 30 percent. These thresholds are measured and enforced. If a subcontractor or partner creeps past their share, you can put the award at risk.

Human-subjects and animal work take longer than you think. If your project involves human subjects, you will likely need training for key personnel, a Federalwide Assurance (FWA), and Institutional Review Board (IRB) approval before you can spend a dollar on that work; companies without a university partner usually use a commercial IRB. If your project involves vertebrate animals, you will need an OLAW Animal Welfare Assurance and Institutional Animal Care and Use Committee (IACUC) approval of your protocol. And if any portion of the work meets the definition of a clinical trial, you will need to register it on ClinicalTrials.gov. Start these approvals immediately, because they gate the spending rather than follow it.

Do not quietly change an approved arrangement. Some post-award changes are yours to make, but others require NIH's prior written approval - among them a change in scope or objectives, a change in or replacement of the PI, a reduction of the PI's effort by 25 percent or more, the addition of a foreign component, and transferring a substantial portion of the work to a third party. Making one of these without checking can create a compliance problem, even when the change seems minor or saves money. When in doubt, ask your grants management specialist before you act.

Keep your foreign-disclosure filing current - this is new for 2026. NIH now requires SBIR and STTR recipients to submit a foreign disclosure form and keep it up to date throughout the award. Updates are due with each annual, interim, and final RPPR, and within 30 days of any change to ownership, covered individuals, or foreign relationships, submitted through the Additional Materials tool in eRA Commons. The requirement applies to active awards, not only new applications, and a material misstatement or an unreported, risk-posing change can lead to termination or repayment. Treat it as an ongoing obligation.

For SBIR, your PI must be primarily employed by the small business. On an SBIR award, your Principal Investigator's primary employment - more than half of their time - must be with the company for the duration of the project, so a founder-PI cannot simultaneously hold a full-time position elsewhere, such as a full-time faculty appointment. STTR differs: there, the PI may be primarily employed by either the small business or the research institution. Confirm this before the award begins, because it is an eligibility requirement rather than a formality.

A Note for STTR Awardees

If your award is an STTR rather than an SBIR, three differences matter from the start:

• You are required to have a formal partnership with a research institution - a U.S. university, nonprofit research institution, or FFRDC. This is not optional for STTR, and a federal laboratory cannot serve as the research partner.

• The work split is 40/30: your company performs at least 40 percent and the research institution at least 30 percent.

• You need a written intellectual property agreement between your company and the partner that spells out how rights and data are allocated. Put this in place early; it is far harder to negotiate after a dispute than before one.

Money First-Time Awardees Leave on the Table

Several sources of funding and support are built into the SBIR/STTR programs, and first-time awardees routinely overlook them.

• The fee (your profit). SBIR and STTR allow a fee of up to 7 percent of total costs in your budget. It functions as profit: it is yours to use at your discretion, and it does not have to be justified with receipts. If you did not include it, you left money behind - build it in next time.

• TABA (Technical and Business Assistance). In addition to your award, NIH will fund outside expert help with intellectual property, market research, regulatory strategy, and reimbursement planning - up to $6,500 in Phase I and up to $50,000 in Phase II. It generally must be requested in the application, so plan for it early.

• I-Corps. NIH offers an entrepreneurial training program that sends teams out to test their commercial assumptions with real customers. It is provided at no cost to selected awardees and directly strengthens the commercialization case your Phase II application will be evaluated on.

Start Positioning for Phase II Now

Phase I is a proof point, not the finish line. The teams that move cleanly into Phase II start preparing while Phase I is still running.

• Keep your data organized and your milestones documented. Your Phase II application, and your reviewers, will want clear evidence that you met your Phase I aims.

• Build your commercialization story as you go. NIH weighs whether there is a real path to market, so capture customer conversations and partnership discussions as they happen and fold them into your Commercialization Plan, which is where reviewers assess your path to market. (NIH is also moving away from open-ended letters of support toward short letters of collaboration, so do not rely on a stack of support letters to carry the argument.)

• Know your timeline. Phase II generally follows Phase I, and the application and review cycle takes months. Work backward from when you will need funding so there is no gap between phases.

• Close Phase I properly. The final progress report, final financial report, and final invention reporting each have deadlines. A clean closeout protects your eligibility and your reputation for the next award.

How BW&CO Can Help

BW&CO helps small biotech, defense, and deep-tech companies turn a federal award into funded, compliant research - without building a grants department to do it. We support awardees with post-award setup, budget and drawdown management, compliance and reporting, and getting Phase II-ready, so founders can stay focused on the science.

If you just received a Phase I award and want a second set of eyes on your setup, we are glad to help. Book a free 20-minute call for a conversation about where you are and what comes next.

SBIR and STTR Foreign Risk Review in 2026: What Reviewers Look For and What to Fix Before You Apply

Last updated: October 2026

SBIR and STTR are back and reauthorized through 2031. But the law that brought them back also raised the bar on one thing many founders never had to think about: foreign risk. Agencies now review your ownership, investors, team, intellectual property, and partners for ties to foreign countries of concern. If they find a problem, they can deny the award, and they may not tell you why.

The good news is that most companies that worry about this have nothing to fear. Having a foreign-born founder or an international collaborator does not disqualify you. What matters is whether specific ties exist, and whether you disclose them correctly. This guide explains what reviewers look at, which issues are real red flags, which ones are false alarms, and what to clean up before you apply.

What changed in 2026

Foreign risk reviews are not brand new. The SBIR and STTR Extension Act of 2022 first required agencies to run due diligence on applicants and introduced a standard disclosure of foreign affiliations and relationships. The 2026 reauthorization, signed in April 2026, kept that framework and expanded it.

Under the current rules, agencies review a wider set of risk factors, including:

• Foreign ownership and control of the company
• Investment relationships and funding sources
• Foreign affiliations of founders, officers, and key personnel
• Patents, licensing agreements, and technology transfer
• Joint ventures, subsidiaries, and parent companies
• Cybersecurity practices

Two practical consequences matter most. First, a finding in any of these areas can be grounds to deny an award, even if your science and your proposal are strong. Second, agencies may not always disclose the specific reason for a rejection, which means you may lose an award without learning what to fix. NIH has also published its own implementation of the process (NOT-OD-26-074), so biomedical applicants should expect it to be applied consistently.

Who the review applies to

Every small business applying for SBIR or STTR funding is subject to foreign risk review. It is not limited to defense work. Medtech, biotech, AI, energy, and aerospace companies all complete the same disclosures, and agencies such as NIH, NSF, DOE, NASA, and the Department of War all assess them. Defense and dual-use technologies tend to receive the closest look, but no agency treats this as optional.

What reviewers actually look at

Ownership and control

Reviewers want to know who owns and controls the company. A parent company, major shareholder, or board member tied to a foreign country of concern is one of the most serious red flags. Keep in mind that this is separate from basic SBIR eligibility, which generally requires the company to be majority owned and controlled by U.S. citizens or permanent residents, or by eligible U.S. entities.

Investors and funding sources

Foreign investment is not banned. Investment from an entity based in or controlled by a foreign country of concern draws scrutiny, especially if it comes with board seats, information rights, or influence over the technology.

Founders, officers, and key personnel

The biggest issue here is participation in a malign foreign talent recruitment program. Reviewers also look at current positions, appointments, and financial relationships with organizations in countries of concern. Where someone was born is not the question. What they are currently tied to is.

Patents, licensing, and technology transfer

Licensing or selling your technology or intellectual property to an entity in a country of concern, or having obligations to share it, is a significant risk factor. So are unclear IP ownership arrangements with foreign institutions.

Joint ventures, subsidiaries, and partners

Subsidiaries, joint ventures, manufacturing partners, and contractual obligations involving countries of concern all need to be disclosed and will be reviewed.

Cybersecurity practices

Agencies now look at whether you can protect the technology you are developing. Weak or undocumented security practices can count against you, particularly for defense and dual-use work.

Real red flags vs. common false alarms

These are the issues most likely to cause a denial:

• An owner, officer, or key team member currently participating in a malign foreign talent recruitment program
• A parent company, subsidiary, or joint venture based in or controlled from a foreign country of concern
• Investment from a country of concern that comes with control rights or access to the technology
• Licensing, selling, or committing to transfer your IP to an entity in a country of concern
• Undisclosed or inaccurately disclosed foreign relationships of any kind

These usually are not a problem on their own:

• A founder or team member who was born outside the United States
• Employees who are not U.S. citizens, as long as the company still meets SBIR ownership and principal investigator requirements
• Published academic collaborations with international researchers
• Investment from allied countries, properly disclosed
• Selling products to customers overseas, outside countries of concern

The common thread is disclosure. Many issues that look manageable become serious when they are left off the forms and discovered later.

Not sure where your company stands? On a free call, we walk through your ownership, investors, team ties, and IP agreements with you and flag anything that needs attention before you apply.

What to clean up before you apply

Run through this checklist before you start writing your proposal, not the week it is due:

• Map your cap table. Know every owner, investor, and their country of control, including fund limited partners where you have visibility.
• Collect team disclosures. Ask founders, officers, and key personnel to list current appointments, positions, and financial relationships, both domestic and foreign.
• Review your IP agreements. Confirm who owns your patents and know every license, option, and sponsored research agreement in place.
• List partners and suppliers. Identify any manufacturing, development, or distribution partners tied to countries of concern.
• Screen against restricted party lists. Check your company, partners, and investors against U.S. government restricted and denied party lists.
• Document your security practices. Write down how you protect sensitive data and technology, even if it is a short internal policy.
• Fix what you can, then disclose everything. Unwinding a problematic relationship takes time. Disclosing accurately always matters.

Free Download: Pre-Application Foreign Risk Checklist

Get this checklist as a one-page PDF covering ownership, investors, team, IP, partners, and security. Enter your details below and the download link appears right away.

What happens if you are flagged

If a reviewer finds an unresolved risk, the agency can decline to make the award regardless of your technical score. Because agencies are not always required to explain their reasoning, a denial can look like an ordinary rejection. That is why it pays to find and address issues before you submit rather than after.

The stakes continue after an award. Material misstatements in your foreign affiliation disclosures, or later changes that create ties to a country of concern, can lead to termination and to a requirement to repay award funds. Treat your disclosures as an ongoing obligation, not a one-time form.

Find out before the agency does. Book a free call and we will review your foreign risk exposure with you, so you can fix or disclose issues before you submit.

Frequently asked questions

Does having a foreign-born founder disqualify my company from SBIR or STTR?

No. Place of birth is not a factor in foreign risk review. Reviewers focus on current ties to foreign countries of concern, such as ownership, investment, IP agreements, and participation in malign foreign talent recruitment programs. Separately, your company must still meet SBIR ownership rules, which generally require majority ownership and control by U.S. citizens or permanent residents, or by eligible U.S. entities.

Which countries count as foreign countries of concern?

Foreign countries of concern include China, Russia, Iran, and North Korea, along with any other country designated under federal law. Ties to these countries receive the closest review.

Can my company accept foreign investment and still win an SBIR award?

Often, yes. Foreign investment is not banned, and investment from allied countries is common. Investment from an entity based in or controlled by a country of concern draws scrutiny, especially when it includes control rights or access to your technology. All foreign investment should be disclosed accurately.

Can my team collaborate with international universities or researchers?

Usually, yes. Ordinary scientific collaboration is not prohibited. The main risks are participation in malign foreign talent recruitment programs, undisclosed appointments or funding, and agreements that give a country of concern rights to your intellectual property.

Will the agency tell me if foreign risk was the reason I was not funded?

Not necessarily. Under the current rules, agencies may not always disclose the specific reason an application was denied on foreign risk grounds. That is why reviewing your risk before you apply matters.

What happens if I leave something off my foreign affiliation disclosure?

An incomplete or inaccurate disclosure can lead to denial of the application. If it is discovered after an award, it can lead to termination and a requirement to repay award funds.

When should I check my company for foreign risk issues?

Before you start writing your proposal, and ideally before you sign new investment, licensing, or partnership agreements. Some issues take months to resolve.

How BW&CO can help

BW&CO helps deep-tech, medtech, biotech, and dual-use founders win non-dilutive funding across NIH, NSF, the Department of War, NASA, DOE, and ARPA-H. Our Foreign Risk Scanner gives you a fast first read on potential issues, and our team can walk you through your agency fit, your eligibility, and what to address before you apply.

This article is for general information and is not legal advice. Foreign risk requirements vary by agency and solicitation. Review the current agency guidance and consult counsel for questions about your specific situation.

Open Topics Are Shrinking. Here Is How to Keep Funding Moving When You Have Demand.

For years, a broad open topic let a founder bring almost any dual-use technology to the Air Force and let the government decide whether it fit. That door is narrowing. More of the money now starts with a customer who has already defined the problem.

What changed

When AFWERX and SpaceWERX reopened SBIR and STTR solicitations after reauthorization this spring, they organized them around seven focus areas and a cohort-based model that groups related technologies against specific capability gaps. AFWERX describes its specific topics as having "clearly-defined requirements and a known Air Force customer built into the topic solicitation." The current DoW SBIR/STTR Release 6 window runs through October 21.

The practical effect is simple. The customer shows up before the topic does. If you wait for a solicitation to meet your first user, you are starting after the people who helped shape it.

Talk to new users before there is a topic

The companies that keep funding moving treat user conversations as continuous work, not a pre-proposal step. Two reasons.

First, one champion isn't a pipeline. Government advocates rotate, retire and move to new jobs. A single relationship can disappear in a PCS cycle.

Second, different users open different money. An operational unit, a program office, a lab and a sustainment organization each use different funding and different contracting routes.

In every conversation, try to leave knowing:

• What problem this person owns, and how they measure it today.

• Who else feels the same problem, in their organization or another one.

• Whether money exists this fiscal year or next, and what kind.

• Which contracting routes their office actually uses.

• What evidence they would need to see before acting.

When you already have demand

A user who wants your technology is the asset. The question is which route turns that interest into a contract. Here are the main ones, and what each needs.

A sponsored topic. Specific topics come from government customers. If your user has a real gap, ask whether they would sponsor a topic in a future release. It takes time, but it points a solicitation at the problem you solve.

TACFI and STRATFI. For companies with a current or recent Phase II, AFWERX matches SBIR funds with government or private dollars. TACFI provides $375,000 to $2 million with 1:1 cost share. STRATFI provides $3 million to $15 million in SBIR funds matched by $6 million to $45 million. Both need a government customer committed enough to put up money.

A public example: in 2020, the Texas Military Department secured $7.5 million from the National Guard Bureau, plus $6 million from AFRL and the Rapid Sustainment Office, to back an additive manufacturing startup through STRATFI, with the SBIR program matching those funds. The relationship began a year earlier, when an Air National Guard metals technician met the Phase I company during a customer discovery session.

SBIR Phase III. If the new work derives from, extends or completes earlier SBIR work, an agency can award a Phase III without a new competition. Phase III uses non-SBIR money, so the customer still has to find the funds.

Commercial Solutions Openings and OT consortia. These let a program office fund a prototype outside the SBIR calendar. They work best when the user can point the contracting office to an existing opening or consortium.

APFIT. For production-ready technology, APFIT provides $10 million to $50 million in procurement funding per project. Only a government organization can submit, on behalf of an eligible small business or nontraditional contractor. Companies can't apply directly.

The common requirement

Every route above needs a government person willing to act for you: sponsor a topic, commit matching funds, find Phase III money or submit a nomination. That is why the user conversations matter more now than the proposal writing.

Checklist

• List every government user you have spoken with in the last 90 days, and mark the ones who own a problem and a budget.

• Add at least two new users outside your current champion's organization.

• For each interested user, identify the money (type and fiscal year) and the contracting route their office uses.

• Match your stage to the route: Phase II for TACFI or STRATFI, prior SBIR work for Phase III, production readiness for APFIT.

• Decide what evidence you need to produce before the user can act.

Have demand? Let's talk

If you have a government user who wants what you've built and you're not sure which route fits, send me a message. I'm glad to talk it through.

Sources

• DVIDS, "AFWERX, SpaceWERX open new SBIR/STTR solicitations following reauthorization," Apr. 29, 2026

• AFWERX, Specific Topic

• AFWERX, Get Funded (TACFI, STRATFI, Release 6 dates)

• APFIT FAQ, OUSW(R&E)

• DVIDS, "149 FW taps into STRATFI program to scale additive manufacturing capabilities," Oct. 22, 2020

Featured photo: Soldiers familiarize themselves with legacy LRAS3 hand grips before evaluating FALCONS sensor prototypes during a Soldier Touch Point, February 2026. U.S. Army photo by M. Scott Bortot, via DVIDS. The appearance of U.S. Department of War visual information does not imply or constitute DoW endorsement.

Does the Continuing Resolution Mean My SBIR Won’t Be Funded?

No. FY2027 starts October 1 under a continuing resolution, and SBIR and STTR keep running. What can change is how fast agencies make award decisions.

Why this year is different from last year

Last fall, SBIR stopped because the program's legal authorization expired on September 30, 2025. Agencies couldn't issue new solicitations until Congress passed the Small Business Innovation and Economic Security Act, which was signed on April 13, 2026. That law authorizes SBIR and STTR through September 30, 2031.

The CR that starts October 1 is a funding question, not an authorization question. It keeps agencies funded at FY2026 rates through December 11, 2026.

Why SBIR money keeps flowing under a CR

SBIR doesn't have its own appropriation. Every agency with more than $100 million in extramural R&D must set aside 3.2% of that budget for SBIR. Agencies above $1 billion also set aside 0.45% for STTR. The 2026 reauthorization left those percentages unchanged.

So the SBIR budget follows the agency's R&D budget. Under the CR, that budget continues at the FY2026 rate, and the SBIR share continues with it. That applies to DoW, NIH, NSF, DOE, NASA and the other participating agencies.

The CR also blocks agencies from starting projects that had no FY2026 funding. SBIR isn't a new program, so that restriction doesn't stop it.

Where you may feel it

The practical risk is timing. Agencies often hold back on new commitments until they know their full-year budget. During last year's CR, NIH told grantees its institutes could issue continuing awards below the committed level.

For a founder, that can mean a longer gap between a positive review and a signed award, or a later start date than you planned.

The CR also ends on December 11. Congress will need to pass full-year funding or another CR by then.

What to do now

1. Keep submitting. Open solicitations remain open. The current DoW SBIR/STTR release, for example, closes October 21.

2. Ask about timing on pending awards. Ask your program officer whether they expect to fund your award before or after December 11.

3. Plan cash around the later date. If a delay of a month or two would put your company in trouble, line up bridge options now rather than in December.

4. Check whether you depend on anything new. A follow-on that requires a brand-new federal program or a larger production buy is more exposed than an SBIR award, because the CR bars those new starts.

The short version: a CR is a reason to plan for slower decisions, not a reason to stop applying.

This article is general information, not legal or financial advice.

Sources

• Crowell & Moring, "SBIR/STTR Programs Reauthorized After Six-Month Lapse," April 14, 2026: https://www.crowell.com/en/insights/client-alerts/sbirsttr-programs-reauthorized-after-six-month-lapse

• The White House, "Congressional Bill H.R. 6500 Signed into Law," September 2, 2026: https://www.whitehouse.gov/briefings-statements/2026/09/congressional-bill-h-r-6500-signed-into-law/

• Continuing Appropriations and Extensions Act, 2027, enrolled bill text, GovInfo: https://www.govinfo.gov/app/details/BILLS-119hr6500enr

• NIH, "NIH Operates Under a Continuing Resolution," NOT-OD-26-011, November 21, 2025: https://www.grants.nih.gov/grants/guide/notice-files/NOT-OD-26-011.html

• BW&CO, "DoW SBIR/STTR FY26 Release 6 Topics": https://www.bwcoconsulting.com/programs/dow-sbir-sttr-release-6

Photo: U.S. Air Force photo by David Dixon, via DVIDS. The appearance of U.S. Department of War visual information does not imply or constitute DoW endorsement.