Safeguarding Research
What is Research Security?
Research security protects the integrity of your research from threats that could undermine Canada's national and economic security. It's about safeguarding your work against theft, misappropriation, and unauthorized transfer of ideas, research outcomes, and intellectual property.
This isn't abstract policy talk—it's practical protection for your research environment.
Why it matters: Canada's research ecosystem thrives on openness, transparency, merit, academic freedom, and reciprocity. These principles make Canadian research excellent. They also make it vulnerable. Foreign state actors, state-sponsored entities, and other bad actors actively target Canadian research to gain strategic, military, or economic advantages.
What's at stake:
- Your intellectual property: Research findings, data, methodologies, and innovations you've spent years developing.
- National security: Advanced technologies that could be weaponized or used for surveillance.
- Economic competitiveness: Innovations that drive Canadian prosperity.
- Your career: Funding eligibility, institutional reputation, and research partnerships.
- Public trust: The credibility of Canadian research as a whole.
Shared responsibility: Research security works only when everyone plays their part. Researchers, institutions, federal funding agencies (CIHR, NSERC, SSHRC, CFI), and the Government of Canada all share responsibility for protecting Canada's research ecosystem.
The reality check: Research security doesn't mean shutting down international collaboration. Canada values global partnerships—they're essential for advancing knowledge. But collaboration requires diligence. You need to know who you're working with, understand the risks, and take appropriate precautions.
Federal Guidelines & Resources
STRAC Policy
The Government of Canada's Policy on Sensitive Technology Research and Affiliations of Concern (STRAC) became effective May 1, 2024. This policy directly affects how Lakehead researchers can access federal funding from NSERC, CIHR, SSHRC, and CFI.
Here's what it means: If your research advances any sensitive technology area, you cannot have active affiliations with—or receive funding from—organizations that pose national security risks. Period. No exceptions.
Tri-Agency Guidance on STRACThe policy operates on two lists that work together:
- Named Research Organizations (NRO): 103+ foreign institutions connected to military, defence, or state security entities. If you're affiliated with any organization on this list while working on sensitive technology research, your federal grant application will be denied.
- Sensitive Technology Research Areas (STRA): 11 categories of advanced technologies (AI, quantum computing, genetic engineering, advanced weapons, etc.). If your research aims to advance these technologies—not just use them—STRAC applies to you.
Your Responsibility: Before applying for federal funding, you must review both lists. If your research advances a STRA, all named researchers on your grant must attest that they have no NRO affiliations. Past affiliations don't count—only current ones matter. If you hold an NRO affiliation, you must sever it before applying. The government plans to update these lists regularly, so please check them each time you apply for funding.
Does Your Research "Advance" a Sensitive Technology?
This is the critical distinction. Many researchers assume STRAC doesn't apply because they're "just using" existing technology. That's often wrong. Here's how to tell the difference:
Your research ADVANCES a STRA if it:
- Develops new capabilities, methods, or applications within a sensitive technology area
- Improves the performance, efficiency, or functionality of existing sensitive technologies
- Creates new knowledge that could enable others to develop sensitive technologies
- Produces results that have dual-use potential (civilian and military applications)
Your research likely does NOT advance a STRA if it:
- Uses commercially available AI tools as instruments without modifying them
- Applies existing technologies to study unrelated phenomena (e.g., using machine learning to analyze historical texts)
- Studies the social, ethical, or policy implications of sensitive technologies without developing them
When in doubt, assume it applies. Contact us for a consultation before submitting your grant application. Getting it wrong means your application gets denied—or worse, your funding gets clawed back later.
National Security Guidelines for Research Partnerships (NSGRP)
The NSGRP integrates national security considerations into the development, evaluation, and funding of research partnerships.
The Risk Assessment Form is a tool to identify and assess potential risks that research partnerships may pose to Canada's national security.
Additional Resources:
Provincial Guidelines
Ontario is implementing steps to ensure that national and provincial security within our world-class research ecosystem is of the utmost priority. The Ministry of Colleges and Universities has released the Research Security Guidelines for Ontario Research Funding Programs.
These requirements apply to: Ontario Research Fund (ORF), Early Researcher Awards (ERA), and other provincial research funding programs. Failure to comply may result in funding being denied or revoked.
What Ontario Requires
The provincial guidelines go beyond federal requirements in some areas. You must provide:
- Disclosure of collaborations with organizations of concern AND involvement with foreign entities: This is broader than STRAC—you need to disclose all foreign entity involvement, not just NRO affiliations.
- A completed risk checklist: The Mitigating Economic and Geopolitical Risk Checklist must be completed for all applications.
- A risk identification and mitigation plan: If risks are identified, you must describe specific measures to address them.
- An attestation: The Application Attestation Form confirms the accuracy of your disclosures.
Common Mistakes to Avoid
- Incomplete disclosures: Listing only formal affiliations while omitting visiting positions, advisory roles, or consulting relationships.
- Vague mitigation plans: "We will be careful" isn't a mitigation plan. Specify concrete measures: access controls, data handling protocols, IP agreements.
- Inconsistency between forms: Your checklist and attestation must align. Discrepancies trigger additional scrutiny.
We can help. The Mitigating Risk Checklist and Attestation Form can be confusing. Contact us before you submit—we'll review your forms, identify gaps, and help you write effective risk mitigation language that satisfies provincial requirements.
Risk Mitigation: Protecting Your Research
Risk mitigation isn't bureaucratic box-checking—it's the systematic process of identifying threats to your research and implementing practical measures to address them. Strong risk mitigation protects your work, maintains your funding eligibility, and demonstrates due diligence to granting agencies and collaborators.
Why it matters: The federal granting agencies assess your risk mitigation plan when evaluating funding applications involving private-sector partnerships or sensitive technology research. Weak or absent mitigation strategies can result in rejected applications, withheld funding, or terminated grants. High-risk partnerships with insufficient mitigation simply won't get funded.
How to Build Effective Risk Mitigation
- Start early: Conduct risk assessments at the beginning of partnership discussions.
- Conduct open-source due diligence: Research your potential partners thoroughly. Check their institutional affiliations, funding sources, and ownership structures.
- Validate through direct consultation: Talk directly with your potential partners about their affiliations and motivations.
- Assess alignment: Determine whether your partner's motivations align with yours.
Key Areas Your Risk Mitigation Plan Should Address
- Research team composition: Build a team with appropriate security clearances, institutional affiliations, and awareness of research security requirements. All named researchers must comply with STRAC Policy requirements if working in sensitive technology areas.
- Cybersecurity and data management: Implement robust protections for research data, methodologies, and intellectual property. This includes secure storage, access controls, encryption, and protocols for data sharing with partners.
- Agreement on research outcomes: Establish clear written agreements about intellectual property ownership, publication rights, and intended use of research findings. Define what happens if security concerns arise mid-project.
- Physical security: Control access to research facilities, labs, and equipment. Implement sign-in procedures for visitors and ensure only authorized personnel have access to sensitive areas.
- Monitoring and Reporting: Establish mechanisms to detect security incidents and report them promptly.
Implementation and Compliance
Once your mitigation plan is approved, you must implement it. This isn't optional. Your award agreement stipulates that you'll follow the mitigation measures you identified, and you must maintain them until you submit your final financial report.
Monitor your mitigation plan continuously. If circumstances change—new partners join, research scope shifts, or risks evolve—you must immediately update your risk assessment and notify the granting agency. Changes that increase national security risk require submitting a new RAF before proceeding.
The Reality
Strong risk mitigation enables research partnerships that might otherwise be too risky to pursue. It demonstrates professionalism, protects Canadian interests, and reassures international collaborators that you operate in a secure environment. Weak mitigation, conversely, jeopardizes funding, damages your professional reputation, and puts your research at risk.
Get help. Lakehead's research office can support you in developing risk assessments and mitigation strategies. Don't wait until you're facing a funding deadline—reach out when you first identify a potential partnership that might raise security concerns.
Travel Security
International travel for conferences, collaborations, and fieldwork exposes researchers to unique security risks. Foreign governments may target your devices, monitor communications, or attempt to acquire sensitive research information. Proper preparation before, during, and after travel is essential.
Key principles: Use clean devices when travelling to high-risk destinations. Assume any device searched at a border is compromised. Change all passwords when you return. Register with the Government of Canada before you leave.
Our dedicated travel security page includes destination-specific guidance, device preparation checklists, and information on booking a pre-travel consultation.
Travel Security Guidelines →Cybersecurity for Researchers
Your research data, methodologies, and intellectual property are valuable targets. Cybersecurity isn't just IT's problem—it's a core component of research security that protects your work from theft, manipulation, and unauthorized access.
Key principles: Use strong, unique passwords with multi-factor authentication. Be cautious with AI tools—some collect your data for training. Avoid third-party platforms for research websites. Protect survey data from bot contamination.
Security Alert: Do NOT use DeepSeek. Canadian security agencies have identified significant privacy and security risks, including potential foreign government access to user data. Use Lakehead's Google Gemini instead—your data is not used for AI training.
Our dedicated cybersecurity page covers AI usage guidelines, secure data storage, research website best practices, survey security, and more.
Cybersecurity Best Practices →Training Resources
Lakehead University Training
The Office of Research Services holds workshops and events around research security throughout the year. Subscribe to the Research & Innovation weekly bulletin for announcements.
Required Training: Register for the "Research Security Training" module on MyCourseLink (Self-Registration Page). This includes two ISED workshops:
- Introduction to Research Security
- Cyber Security for Researchers
ISED Self-Paced Courses (30-40 minutes each)
The Government of Canada offers three free courses on the ISED Learning platform (GCKey login available):
Public Safety Canada | Safeguarding Science (Live Workshops)
Public Safety's Research Security Centre offers Safeguarding Science, a series of 60-90 minute live workshops covering:
- Best practices for maintaining a security-conscious research organization
- Tools to recognize and mitigate research security risks
- Understanding sensitive and dual-use technology
Who Should Attend: Researchers, research staff, students, administrators, IT staff, and security personnel.
French virtual sessions available on the French Safeguarding Science page.
2026 Session Schedule
Click on a module below to view details. Registration links will be posted as they become available on the Public Safety Safeguarding Science page.
In-Person Option: The Research Security Centre offers scenario-based exercises to complement Module 1. Participants work in small groups to identify risks and propose mitigation strategies. Contact Public Safety Canada to arrange a session for your institution.