Research Security Reflections: Building Capacity and Capability

Capacity and capability continue to be the focus of most conversations I’m having with research security practitioners. In the tactical research security (RS) sense, capacity is throughput: how many RS due diligence reviews an office can complete, how quickly, with the staff it has. Capability is reach and rigor: what kinds of risk can a RS office actually identify, adjudicate, document and defend.

In fact, at a recent Research Security Workshop at Clemson University, a Senior Counterintelligence Officer stressed the importance of “building capacity and capability in the research security community” in his closing remarks. The phrase has stuck with me, as each conversation I have reinforces what I see as the two imperatives for building stronger research security programs.

But while capacity and capability are not the same constraint, they do not have the same remedy. An institution can be strong in one while badly exposed in the other. Hiring adds capacity but does not automatically produce capability. Procuring access to a bibliometric data analysis platform adds capability but does not return a single hour to an overloaded reviewer.

With that distinction in mind, here is what is important for Research Security officers to be thinking about now:

• • The capacity gap is now structural, not transitional. This is important for mid-sized and smaller institutions that are now building research integrity, security and compliance capacity. It’s also important for teams that are conducting research security activities with limited staff, which is the case more often than not. But federal requirements do not scale down to match institutional size. The same expectations land on a team of 12 the same way they land on a single person who also owns export controls, conflicts of interest, and facility security. That is not a temporary staffing dip waiting on the next budget cycle. It is the operating condition of most of the field.

• • Sponsor divergence taxes capacity and capability at the same time. Current guidance principles on capacity and capability are converging; implementation is not. Reading three sets of agency guidance brings up capability questions, albeit manageable ones. Maintaining parallel review standards across sponsors, documenting which standard governed which determination, and reproducing that decision logic under audit eighteen months later, after the original reviewer has moved on – that’s a capacity question. And the simultaneous stressors on both capacity and capability are where programs quietly break.

• • Some capability gaps cannot be staffed away. We need more touchpoints amongst sponsors.Law enforcement audiences and research security practitioners work on the same kinds of problems without much of a shared reference point. For example, federal audiences need a working grasp of how research funding flows, and they also need to know how to work with university campuses. With holistic risk identification becoming more prominent, now is all the more reason for national security and research security leadership to sit at the same table.

• • The community’s demand needs support on their judgements, not more reference material. Research security practitioners are spending less and less time with experts for policy interpretation on things like counterintelligence, export controls, CUI, international travel, supply chain risk and due diligence analysis. Instead, they focus on what is in front of them: Here is the case actually sitting on my desk, and here is why the guidance does not cleanly resolve it. Practitioners are not looking for another document that tells them what to consider. They are looking for help converting what they already know into a defensible determination, faster.

Taken together, these bring us to a single leverage point. The research security community is not short on threat awareness, policy guidance or risk indicators. Where it is short on capability, the answer is expertise and shared practice. Where it is short on capacity, the answer is technology that carries the repeatable work. The highest-value systems do both at once. They encode good analytic judgment once and then run it consistently at volume, so that capability built by an experienced reviewer is not trapped in that reviewer’s inbox.

That is the problem we must build against. The priorities that take center stage in my conversations and in others are the ones we have organized around: preserved provenance so every determination can be traced to its evidence; change detection so a profile reviewed last quarter does not go stale in silence; structured feedback so analysts can correct the record; and workflows that produce an output an RSO can hand to leadership, compliance or counsel without rebuilding it. The goal is not to replace the reviewer’s judgment. It is to give that judgment the throughput the mission now demands.

If your program is working through the same equations, building capability while the capacity to apply it stays fixed, we would welcome the conversation to collaborate. Please get in touch at researchsecurity@finchai.com.