When procuring good and services for your research, it is important to bear in mind that your choice of vendor and the goods and services your purchase could introduce potential security risks.
These risks often centre around access to your research data, or to the research infrastructure and assets you use. Inappropriately sourced goods and services could ultimately lead to the theft, interference or unauthorized transfer of data and knowledge and could also impact your funding eligibility, reputation and your research partnerships. In more extreme instances it could even impact the personal security of individuals on your research team.
The type of equipment you purchase can also introduce risks in and of itself. A non-exhaustive list of risks include:
- Data management issues
- Network vulnerability issues
- Foreign-government control
- Legal liabilities, implication in on-going lawsuits
This document is intended to highlight some approaches to mitigating these risks and to help inform purchasing decisions that can protect the interests of you, your partners, collaborators and funders. It does not constitute legal advice and further guidance is available through the Government of Canada's Research Procurement Guidebook and Procurement Case study.
Risks and Mitigating Approaches
Access to assets and infrastructure
Export controls, sanctions and international laws
Changing contexts of your purchase
Potential impacts
Poor procurement decisions could have a number of direct impacts on your research activities. These include:
Funding
Your eligibility for future government funding opportunities can be affected by your procurement choices. It’s important to conduct due diligence whereby you complete a sufficient amount of research about your vendors to learn how working with them might impact the security of your research at all stages of the research. Update and submit any relevant documentation, such as attestations to relevant funders, if vendors change at any point in the project.
Intellectual property ownership and commercialization
Depending on the type of engagement with a vendor, you might inadvertently expose your research insights (including those that may be patentable) to the vendor, thereby increasing the risk of having your intellectual property stolen. At a minimum, efforts to commercialize your research may also be delayed if security-related considerations such as sanctions or political turmoil are not properly accounted for when planning the work. This could force you to find a new vendor, posing added administrative work and potential delays to your research project.
Partnerships
Poorly managed or mitigated risks from vendor relationships could lead other partners to end their collaborations with you or severely restrict future engagements. This not only restricts the ability to access important research data for collaborations, it could also affect the ability to access funding opportunities with those partners.
Reputation
Purchasing or accessing goods and services creates a relationship to the vendors, and can be seen as an implicit endorsement of a business’ goods, services or practices. Even if you do nothing wrong, engaging in business with vendors with known legal issues, lack of transparency about their operations, or negative reputations can cause negative repercussions to you and your work. It can also affect the reputation of the university and Canadian research more broadly, depending on the nature of the relationship in question.