Recent announcements by the Department of War (DoW) and the National Science Foundation (NSF) signal ongoing federal concern with the interactions IHEs have with foreign entities deemed to pose a risk to U.S. national security. IHEs should act now to proactively audit engagements with any listed foreign entities of concern and establish robust compliance measures. Recent announcements by the Department of War (DoW) and the National Science Foundation (NSF) signal a continue

On July 31, 2026, China's State Council released new Regulations on the Administration of Entry and Exit that will standardize and enhance China’s oversight of entry and exit across multiple areas of regulatory concern. U.S. institutions should act now to identify all relevant travel to and from China by institutional stakeholders, evaluate any associated risks, and take steps to mitigate risks. On July 31, 2026, China's State Council released new Regulations on the Admini

On July 24, 2026, the CAC released a Q&A on Cross-Border Data Transfer Security Management that clarifies key compliance expectations. Of particular note, the CAC Q&A emphasizes the need for data minimization in cross- border transfers of job applicant resumes to overseas headquarters or affiliates. On July 24, 2026, the Cyberspace Administration of China (CAC) released guidance clarifying and heightening its compliance expectations in certain cross-border data transfer si

The Shanghai municipal branch of the Cyberspace Administration of China (“CAC”) has fined the online travel agency Ctrip RMB 10 million, citing failure to fulfill cross-border data security assessment obligations and illegal outbound transfer of personal information. This action marks a new escalation in China's enforcement of its data protection laws, including one of the most substantial fines imposed under the PIPL to date. On June 13, 2026, the Shanghai municipal branc

A new NPRM from the Office of Management and Budget (OMB) would significantly reshape federal discretionary grantmaking and allow expanded discretion for the administration to affect its priorities throughout the grantmaking lifecycle. Institutions with programs or collaborations involving China or other countries of concern should assess the potential impact of the proposed regulations now. On May 29, 2026, the Office of Management and Budget (OMB) published a notice of

In early May 2026, criminal threat actors gained unauthorized access to the Canvas LMS and claimed to have exfiltrated 3.65 TB of data. The threat actors issued ransom demands first targeting Instructure, the company that owns and operates Canvas, and then targeting over 300 IHEs. Though the immediate threat against IHEs appears to have been resolved through an “agreement” reached between Instructure and the cybercriminals, affected IHEs should continue to implement their b