Building a Research Security Function: The Owner, the Rules and the Forms, in 90 Days

Hello, this is Ryuta Hamamoto from TIMEWELL.

"We have not done anything yet. Where do we even start?"

That is the question I hear most often when research security comes up. Explainers about the regime have multiplied. What nobody has written down is where an institution with nothing in place should put its first step. The procedures manual will tell you that something is "necessary." It will not tell you what to do on Monday morning.

So this piece is about sequence. Who to name as the owner and which department should hold the work, how far to go with internal rules and forms, how to keep the checklist cycle turning, and which parts you do not need to carry in-house. If the regime itself is new to you, start with the complete guide to research integrity and research security and come back here.

Two things get misread more than anything else, so let me put them first. One, the manual does not ask for zero risk. It limits the technologies in scope and then asks for reasonable handling proportionate to the degree of risk¹. You do not need to brace yourself for "we cannot apply until the system is perfect." Two, the manual explicitly prohibits discriminatory treatment on grounds of nationality, race, religion, culture or the like¹. MEXT takes the same position². Blanket exclusion of researchers from a particular country or background sits outside what the regime was designed to do. Share those two points with your team at the outset and the later discussions hold their shape much better.

One more thing worth checking early. How far your export control arrangements have already been built is part of the foundation research security sits on. If you want a rough read on where you stand, our free export control self-check is a reasonable place to start.

Two things set the order: the foundation, and the deadline

Why begin with sequence at all? Two reasons.

The first is that the regime itself is built in layers. In its December 2024 policy direction, MEXT wrote that in ensuring research security, "as its foundation, it is first important that researchers themselves and universities and other institutions thoroughly carry out efforts to ensure research integrity, including securing transparency in research activities and autonomous risk management"². The Cabinet Office manual is constructed the same way, stating that measures to ensure research security are built on top of the thorough implementation of the research integrity work institutions have been doing all along¹.

Let me untangle the two terms, because they get used interchangeably and they are not the same thing. Research integrity is the set of understandings and behaviours expected of institutions and researchers to keep research activity sound, fair and transparent, and it applies to all research activity. Research security protects research activity from risks threatening national and economic security, and applies only to the research the state or the institution has judged needs protecting¹. Broad foundation, narrow structure on top. Once you see that relationship the order of work decides itself: you cannot bolt a research security procedure onto an institution with no working integrity declaration cycle underneath it. Integrity work is not new either. The starting point is the policy adopted at the Integrated Innovation Strategy Promotion Council on 27 April 2021.

The phrase "Specified Research and Development Program" recurs throughout this article, so here is what it means. Among competitive research funding programmes that presume publication of results, these are the ones the competent ministry has designated, in consultation with the funding agency, as potentially involving technologies on the list of critical technology areas¹. Not every competitive funding programme is in scope. Skip that point and your internal discussion swerves straight into "so do we have to do this for every research project?"

Narrowing what you protect is not a Japanese invention. In Europe and North America the shorthand is "small yard and high fence," or "as open as possible, as closed as necessary," and in June 2022 the G7 set out common principles framing research security as a responsibility shared between governments, funding agencies and institutions. Limiting the scope in order to protect an open research environment is the international common understanding, which is useful language to have when you explain this internally.

The second reason is the deadline. The Cabinet Office intends the manual to take effect from April 2026, and at the seventh meeting of the expert panel the secretariat stated it would "proceed with concrete measures towards the start of operation in April 2026"³. ATLA's Innovative Science and Technology Initiative for Security becomes a Specified Research and Development Program from the FY2026 call, with applications open from 13 March 2026 to noon on 20 May. JST's Strategic Basic Research Programs apply to projects newly selected in FY2026⁴. For any institution that intends to apply, the day the call opens is the real deadline.

Get the scope right here. In JST's FY2026 application guidelines, what was designated is the five CREST research areas only. PRESTO and ACT-X are outside the scope⁴. The five cover quantum science and technology, innovative ultra-long-life materials, real-environment intelligent systems, an interdisciplinary systems foundation for human-AI coexistence, and the fusion frontier of light with information, communications, sensing and materials. Institutions in scope are the "universities etc." and "companies etc." named in the commissioned research contract⁴. Read the programme title alone, conclude that all Strategic Basic Research is in scope, and you have put an unnecessary load on the whole campus. Read it too loosely the other way and you miss an area that does apply.

The risk management the regime asks for turns in four stages: risk identification, risk assessment, risk mitigation measures, and follow-up¹. The people in scope are the principal investigator, the representative on the collaborating institution side (Co-PI), and research participants belonging to the lead institution, which includes students¹. Building a function means deciding who turns those four stages, in what order, and leaving a trail that can be followed afterwards.

Here is the awkward part. The real risk management work starts once you are shortlisted, but the preparation has to be finished before you apply or it does not land in time. How the requirement came to be embedded as a condition of application is covered in Research Security as a Funding Condition.

The first decision is the owner and the department, not the rules

The first thing to do is not to write internal rules. It is to decide who owns the work.

The manual, in fact, does not specify a department. What it asks you to designate are "persons involved in the operation of the Specified Research and Development Program," which is a set of people, not a box on the org chart. Line up the surrounding documents, though, and an outline appears. Cabinet Office briefing materials illustrate the institution-side contact point as a "department responsible for preventing technology leakage." MEXT's notice on the advice desk asks that enquiries "be made centrally through the responsible department within the institution"⁵. And JST's FY2026 application guidelines say questionnaire responses are submitted "having obtained confirmation from the responsible department at the institutions of the principal investigator and the main co-investigators (including, where a department with responsibility for research security and research integrity has been established, that department)"⁴.

Nothing there says it is compulsory. Even so, the fact that a funding agency's application guidelines have started constructing sentences on the assumption that such a department exists carries weight. At a minimum, seen from outside, there has to be one place people know to ask.

So should you create one? There is primary data on this. In the supplementary questionnaire to the Cabinet Office's FY2025 follow-up survey, the most common approach was expanding an existing organisation. Among national research and development agencies, 26% created something new, 48% expanded an existing organisation, and 26% set up a committee or task force of departmental heads. Across 32 research institutions the split was 22%, 56% and 22%⁶.

I think that result is the practical answer. Security export control, conflict of interest management, industry-academia collaboration, HR, research integrity. The information research security needs is already held by those departments. What is missing is not an organisation, it is the lines connecting them. Build from scratch and you spend your first months re-establishing pipes to the departments that hold the data. In the same survey, on whether the institution had "put in place an organisational structure capable of appropriate management," 277 of 344 national, public and private universities had already done so, and adding the 23 planning to within the year takes it to roughly 90%⁶. Starting from nothing now puts you in the minority.

Ninety days. What to put where

From here I will lay this out in 90-day blocks. To be clear, the 90-day frame is not from any government document. It is a sequence I put together from the conversations I have been asked into, based on what the manual treats as necessary and on working backwards from the call schedules. Month one, decide the container. Month two, produce the paper. Month three, run it once. It is the four stages of risk management mapped onto your own calendar.

The first 30 days: measure where you are, decide the container

Three things in the first month.

Measure where you are. The Cabinet Office follow-up survey asks about institutional status across seven questions, covering organisational structure, mechanisms for objectively verifying facts, mechanisms for receiving updates to information, and more⁶. Those questions work as a self-assessment yardstick as they stand. Score yourself against them and you will know where the gaps are within the hour.

Decide the container. Take stock of existing departments and list who holds what information. Then designate the responsible department and name both an executive-level owner and a working-level owner. What matters is fixing the names, and it is fine if both roles are held alongside other duties. Start drafting rules while the answer to "who owns this?" is still "general affairs, probably" and you will stall halfway through. I have watched it happen.

Write down your external route. MEXT's research security advice desk was established by notice 7-Monkasho-Ka No. 54, dated 10 April 2025, issued jointly by the Director-General of the Science, Technology and Innovation Policy Bureau and the Director-General of the Higher Education Bureau. It is open to universities, junior colleges, inter-university research institute corporations and colleges of technology. The notice sets conditions: enquiries should be routed centrally through the responsible department, and should come after the institution has done some internal analysis and found itself unsure how to proceed⁵. Without an internal escalation route, in other words, you cannot use the desk at all. Responses to information security incidents are outside its scope.

Days 31 to 60: put the rules and forms on paper

Month two is documents. What you need to produce is more clear-cut than people expect.

Start with the research integrity checklist. The Cabinet Office and MEXT publish templates in two versions, one for researchers and one for institutions. The institutional template asks whether you have an advice desk; whether education and training opportunities exist; whether you have a mechanism to identify and address information where the institution has risk concerns; whether there is a procedure for the institution to verify and decide when signing memoranda and similar documents; whether you assess risk on the counterparty organisation and its members against the End User List and comparable lists in other countries; whether you have a mechanism to receive reports of subsidies, remuneration or goods provided by foreign institutions; and whether you can see the content and purpose of long or frequent overseas travel⁷. Write your internal rules so that you can answer yes to those questions and the design work goes much faster.

The manual makes it "necessary" for institutions to collect the information researchers declare on the basis of the checklist, and "necessary" to review the checklist in light of how it has been operating¹. Producing it once and filing it away is not what was contemplated. Write the annual declaration cycle, and how you receive updates in between, into the rules themselves.

Next, the three forms: the self-declaration form, the consent form, and the written declaration. The consent form covers two things. That the researcher declares personal data to the institution for the purpose of risk management and that the institution uses it only for that purpose, and that the institution may provide it to third parties for that purpose¹. Third parties here means the funding agency and relevant government bodies, plus the lead institution where the declaration is made to a collaborating institution. The written declaration carries one sentence: that the personal data declared is, to the signatory's knowledge, current as at the time of declaration and contains no false content and no omissions¹. When designing the forms, tabulate who you collect what from, split by PI, Co-PI and research participant. Students count as research participants, so work out in advance who in each lab is in scope.

Then add the contract review angle. For joint research contracts and other agreements the manual makes it "necessary" to verify the appropriateness of four things: the content of the cooperation, access to research data, the handling of inventions, patents and other intellectual property, and the terms of confidentiality¹. Due diligence on the collaborating institution itself only reaches "desirable," but those four contract points are in the necessary column. In most institutions this means adding review criteria to an existing contract flow. High priority, low cost.

Last, compress your emergency escalation and response flow onto a single page. Among the things the manual describes as desirable to have ready at the point of application are the designation of persons involved in the operation, thorough compliance with confidentiality obligations by those persons, and arrangements for escalation and response in the event of an emergency such as leakage of critical technology¹. That is the "desirable" column. Elsewhere in the same manual, though, verifying whether those arrangements were appropriately in place and functioning effectively, once critical technology has leaked, is "necessary"¹. The distinction came up at the expert panel, and the secretariat explained that the intention is not to require completed arrangements at the point of application³. Turn that around and the real message appears: after something happens, the state of your arrangements will be examined. One page of escalation flow up front strikes me as the rational move.

The manual is equally direct on where responsibility sits. Where declared information turns out to be false, that can be treated as improper receipt under the "Guidelines on the Appropriate Execution of Competitive Research Funding," and can trigger measures such as restrictions on future applications¹. On the other side, it states that where technology has nonetheless leaked despite sufficient measures having been taken, the research institution and the researcher do not bear responsibility¹. Put those two sentences side by side and the purpose of the whole exercise becomes visible. It is not to reduce incidents to zero. It is to be able to explain, afterwards, that reasonable measures were taken. Measures with no record behind them are not material for that explanation, which is exactly where forms and approval trails designed to leave a history earn their keep.

Days 61 to 90: run it once

Month three is about putting what you built into motion. The institutions I worry about most are the ones that assemble the paperwork and stop there, so do not skip this.

Run one dry run of due diligence. Due diligence is the process of verifying the appropriateness of institutions and researchers participating in the research, and the version conducted using public information alone is called open source due diligence, or OSDD¹. The manual's 13 verification items are these.

#	Item to verify	Past three years
1	Academic background
2	Research and employment history
3	Research funding received	Yes
4	Support other than research funding received	Yes
5	First, corresponding and co-authorship on published papers	Yes
6	Patent filing status	Yes
7	Participation in foreign talent recruitment programmes	Yes
8	Disciplinary history under the guidelines	Yes
9	Whether the person appears on a list
10	Whether the person belongs to a listed institution	Yes
11	Whether the person has relationships with researchers at listed institutions	Yes
12	Status as a "non-resident" or under a "specific category" in export control
13	Anything else the funding agency deems necessary

Items 3 through 8, plus 10 and 11, cover the past three years including the fiscal year in which you apply¹. Not every item runs three years back, so keep that straight when you design the form.

The scope sounds heavy, but the manual does not raise the bar on where information has to come from. Due diligence may be carried out using "self-declared information, open source information and other information that each lead institution can ordinarily obtain"¹. The tools it gives as examples are all public: academic paper databases, portals such as Google Scholar, researcher databases such as e-Rad and researchmap, IP databases such as J-PlatPat, METI's End User List, and the United States consolidated screening list¹. Pick one researcher and fill in all 13 items to the end within that range. You will find out exactly where you get stuck. How to gather the material item by item is covered in Due Diligence in Practice and How to Answer the Questionnaire.

Before you go live, share one thing internally. Appearing on any country's list is a regulatory designation. It is not a judgment about the organisation listed, or about the researchers who work there. The same goes for "specific categories" in security export control. The framework has applied since May 2022, and METI's own wording is that "specific categories are simply a categorisation of cases requiring individual verification during screening, and falling under a specific category does not mean the person is regarded as posing a security concern"⁸. Falling under one is not a reason to exclude anyone. You verify, and if a procedure is needed you follow it. Treating people differently on grounds of nationality or origin is, as noted at the top, prohibited by the manual itself¹. Distribute a checklist without explaining any of this and you generate a lot of avoidable tension on the ground.

Alongside that, try answering the questionnaire you would submit to the funding agency, as if today were the day. Some items will be unanswerable. That set is your remaining task list.

Running one round of training is worth doing too. Every statement about training in the current manual sits in the "desirable" column: institutions are encouraged to recommend training to researchers intending to apply, and researchers are encouraged to take it proactively¹. Some panel members argued for upgrading this to "necessary," and the secretariat kept the current wording on the grounds that the programmes do not yet exist³.

Which means the off-the-shelf material available today is thin. The manual does position the production of training material and the holding of briefing sessions as work for the government to do¹, but what can actually be inspected right now is roughly the research integrity near-miss casebook produced under a FY2024 MEXT commissioned project, plus the checklist templates mentioned earlier. MEXT's policy direction sets out three lines of work, supporting forums for inter-university collaboration, establishing an advice desk connected to relevant government bodies, and developing training material and programmes², with pilot activity from FY2025. My view is that running one session yourself with the casebook and the checklists beats waiting for the material to be finished.

Note too that the scope reaches research participants including students. What that means for how labs take people on is set out in Taking On Students and RAs Under Research Security.

Work out what you do not need to carry in-house

Run the 90 days and you will always be left with a piece that people cannot do by hand. Let me close on that.

External resources first. In FY2025 the Cabinet Office ran an open call for its programme supporting risk management arrangements for research security and integrity, and selected eight institutions, whose names were not published. The expert panel minutes note that under the FY2024 supplementary budget, funding went to 23 universities and research institutions³. For FY2026 a hands-on support programme aimed at funding agencies is running, with seven organisations approved: AMED, JST, JSPS, NARO (Bio-oriented Technology Research Advancement Institution), ERCA, NICT and JAXA. Support menus for research institutions change shape year to year, so check the Cabinet Office and MEXT pages periodically. There has also been reporting about a risk management support hub at a domestic university, but I have not been able to confirm primary material equivalent to a call document or selection result as of writing, so I will leave it there.

That leaves the largest remaining load, the due diligence work itself, and item 11 in particular: whether the person has relationships with researchers at listed institutions. That means tracing three years of joint or commissioned research, co-authored papers, and named co-presentations at conferences and similar events¹. Name matching does not finish the job. You are following a network of people, papers, patents and organisations. The manual acknowledges this, noting that where adequate due diligence is difficult using the listed public tools alone, using commercial information analysis tools or commissioning investigations from firms may also be considered¹.

What we have built at TRAFEED is infrastructure for precisely this layer. In Japan's security export control, covering list controls (which define what is regulated by item specification) and catch-all controls (which regulate based on end use and end user regardless of item), we developed it as the world's first AI agent service (as of March 2026, confirmed by our own research), on a knowledge graph of more than 200 million records: roughly 90 million papers, roughly 100 million patents and roughly 300,000 researchers, combined with company lists and national sanctions lists. In a joint proof of concept with Okayama University, we confirmed AI determination accuracy of over 95% using around 30,000 past screening records (our own research). We hold Japanese Patent No. 7862062 and are used by more than 20 organisations.

For an institution building a function, that base helps in two places. One is handling information scattered across departments as a single body. The centralised management the manual calls desirable does not require merging departments; aligning where information lives and how it is reached gets you there. The other is the due diligence itself. Walking co-authorship and co-filing edges one hop, then two, and surfacing whether a path reaches a listed institution, is something a graph structure handles as computation. Alongside researcher information, we are extending into shareholder and capital relationship research. Features specifically for research integrity and research security are still being built out, and are not something I can hand over as a finished product today.

To be explicit about the boundary: the final determination belongs to the research institution (for companies, to each firm's export control officer). What we can take on is assembling the material and leaving it in a form whose reasoning can be explained afterwards.

What to take away

• The regime sets the order. A working research integrity declaration cycle is the foundation, and the research security procedure sits on top of it
• The markers are the April 2026 start of operation and the opening day of the calls you intend to apply to. Preparation has to be finished before the call opens
• Scope is limited to Specified Research and Development Programs. At JST that covers the five CREST research areas only; PRESTO and ACT-X are outside it. Check before designing anything campus-wide
• The manual does not ask for zero risk. Where technology leaks despite sufficient measures, the institution and the researcher do not bear responsibility. The goal is being able to explain what you did
• The people in scope are the PI, Co-PIs and research participants including students. Appearing on a list, or falling under a specific category, is a regulatory designation and not a judgment about the organisation or the person
• The first move is not internal rules. It is naming the owner and the responsible department, and the data shows expanding an existing organisation beats creating a new one
• Month two is paperwork: the checklist revision, the self-declaration form, the consent form, the written declaration, the four contract review points, and the emergency escalation flow
• Month three is the dry run. Push one case all the way through and your remaining gaps take concrete shape
• Centralised management only reaches "desirable," but it is worth designing early

"Building a governance function" sounds like a large undertaking. Lay out what the 90 days actually contain and it comes down to fixing some names, producing four kinds of document, and running the thing once. The hard part is not the content. It is the first step of deciding whose job this is. The expert panel discussed the acute shortage of specialist staff and the need to train them³, and building from a position of not having the people is the same condition every institution faces.

So start with one name. It can be someone who already has a full role. Write it down this week, and the rest of the 90 days has something to attach itself to.

If you are working out where to begin at your own institution, talk to our TRAFEED team.

References and primary sources

Footnotes

1. Expert Panel on Ensuring Research Security and Research Integrity, "Procedures Manual for Ensuring Research Security," December 2025 (Cabinet Office) https://www8.cao.go.jp/cstp/kokusaiteki/integrity/yushikisha/guidelines_v1.pdf ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹ ↩²² ↩²³ ↩²⁴

2. MEXT, Science, Technology and Innovation Policy Bureau, "Direction of Concrete Measures on Research Security in MEXT-Related Programmes for Universities and Other Institutions," 18 December 2024 https://www.mext.go.jp/content/20241218-mxt_kagkoku-000039402_1-1rrr.pdf ↩ ↩² ↩³

3. Cabinet Office, "Summary Minutes of the Expert Panel on Ensuring Research Security and Research Integrity (7th Meeting)," 1 December 2025 https://www8.cao.go.jp/cstp/kokusaiteki/integrity/yushikisha/7kai/gijirokugaiyo.pdf ↩ ↩² ↩³ ↩⁴ ↩⁵

4. Japan Science and Technology Agency (JST), "FY2026 Strategic Basic Research Programs (CREST, PRESTO, ACT-X) Application Guidelines" https://www.jst.go.jp/kisoken/boshuu/teian/koubo/2026youkou.pdf ↩ ↩² ↩³ ↩⁴

5. MEXT, "Establishment of the MEXT Research Security Advice Desk (Notice)," 7-Monkasho-Ka No. 54, 10 April 2025 https://www.mext.go.jp/content/20250424-mxt_kagkoku-000039402_1.pdf ↩ ↩²

6. Cabinet Office, "Summary of FY2025 Research Integrity Follow-up Survey Results," December 2025 https://www8.cao.go.jp/cstp/kokusaiteki/integrity/ri_follow-up_fy2025/ri_fu_fy2025_sum.pdf ↩ ↩² ↩³

7. MEXT, "Checklist Template for Universities and Research Institutions," version of 29 June 2023 https://www.mext.go.jp/content/20230704-mxt_kagkoku-000019002_1.pdf ↩

8. METI, Trade Control Department, Security Export Control Policy Division, "On the Clarification of Deemed Export Management" https://www.meti.go.jp/policy/anpo/law_document/minashi/meikakukanitsuite2.pdf ↩