Research and Knowledge Security

Living Appendix – Operational Lists

Companion to the Best Practice

Contents

This document is the living operational register. It is maintained by the Chief Research Security Officer (CRSO) and updated on a fixed cycle; every table carries a “reviewed” date. It is the single, regularly-updated home for the specifics — the partner tiers, the source lists, the routing and contact register, the maintenance log, and the effectiveness dashboard.

Each table below is one of the lists named in the best practice. The short note before each table says what the columns hold and how the CRSO fills it. Cells shown as [tbd] or [like this] are specifics the ATHENE office has yet to confirm; named individual contacts are not printed here but kept in the CRSO’s working copy. Every table carries the date it was last reviewed.

1Country and region partner tiers

Scheme. The partner tiers are split by how the tier is set. Table 1 holds the tiers that follow directly from an external authority — EU, EEA, and NATO membership, and the EU sanctions and embargo regimes. Table 2 holds the tiers ATHENE sets by its own case-by-case judgment — the like-minded countries it treats as trusted, the systemic-rival tier, and the residual “assess on indicators” category. Both tables share the columns: the starting tier (the four tiers — trusted circle, systemic rival, high risk, embargoed or sanctioned — are defined in the best practice’s risk-and-chance method), the documented basis (source and edition), and the date last reviewed. Each country sits in exactly one row, taking the most specific category first (EU → EEA → other NATO → other like-minded).

2Named-organization watch sources

Scheme. Public sources screened for sanctioned or restricted organizations. What a listing triggers depends on the source. An EU sanctions or embargo listing is legally binding: cooperation or a transaction is prohibited to the extent the listing reaches the partner, the end-use, the funds, or the activity. A US listing (Entity List, SDN) is not binding under German law; it is a risk indicator that raises scrutiny and feeds the case-by-case judgment, and becomes binding only where US jurisdiction applies (US-origin items or software, US persons, or US-dollar clearing). Each source is consulted in its live online version: the EU consolidated sanctions list through the EU Sanctions Map (https://www.sanctionsmap.eu/), the US Entity List from the Bureau of Industry and Security (https://www.bis.gov/entity-list), and the OFAC Specially Designated Nationals list (https://ofac.treasury.gov/sanctions-list-service).

3Indicator sources

Scheme. For states and partners not settled by a sanctions listing, the tier and risk assessment rest on documented indicators rather than a static blacklist. The CRSO records which source and edition fed a given tier — this is what keeps the list auditable and stops it ossifying into an outdated verdict. The standing inputs mirror the red-flag indicator set ATHENE adopts from the Max Planck guideline [6], each consulted in its live online version.

4Routing register: functions by participating organization

Scheme. One row per participating organization; the columns name the office that holds each statutory function. Where an organization has no ethics organ of its own, the case routes to the Research Review Board (defined in the best practice). Named individual contacts are not printed here; they are held in the CRSO’s working copy.

Other research-security functions. Beyond the statutory functions of Table 5, research security also involves vetting people (guest researchers, doctoral candidates) and clearing cooperations and projects. Table 6 records who owns these per organization. The baseline sanctions-screening of personnel runs through the export-control function above; the entries here are the additional, organization-specific processes the CRSO confirms.

References

Imprint