Evaluating research security as enterprise risk management

Higher education institutions (HEIs) are no strangers to risk management practices; however, recent geopolitical trends have resulted in HEIs needing to manage risks from hostile State-sponsored intelligence actions, such as espionage, foreign interference, hacking, and intellectual property theft. This in turn has led to many Western nations enacting processes and procedures for ‘research security’; that is, the protection of security-sensitive research through controls such as export limitations, sanctions, visa regulations, and funding policies. However, scholarly dissection and discussion of precisely how research security is done is distinctly lacking. This article conceptualises ‘research security’ as a form of risk management – specifically enterprise risk management (ERM) – in the HEI context. It aligns research security with previous scholarly consensus on ERM, embeds the practice of research security in an ERM landscape, and makes a number of propositions related to the manner of regulating the protection of sensitive research in an ERM framework. The utility of this examination is threefold. Firstly, it applies intellectual rigour to an emerging discipline that has lacked a coherent policy framework. Secondly, it aligns research security to the wealth of scholarly output on ERM (and offers opportunities for future explorations). Thirdly, it embeds in research security discourse the need for a nuanced and graduated discussion about risk that is largely absent from existing debates.