NSF 25-515: Security, Privacy, and Trust in Cyberspace (SaTC 2.0)

NSF 25-515: Security, Privacy, and Trust in Cyberspace (SaTC 2.0)

This program is one of the largest U.S. federal cybersecurity funding opportunities for interdisciplinary teams that can combine technical, social, and educational approaches to secure the digital ecosystem. It is officially posted as NSF 25-515, and the program page is maintained as “Security, Privacy, and Trust in Cyberspace (SaTC 2.0).”

The opportunity is currently active and open for proposals, with recurring target dates for full submissions and an annual cycle intended for both 2026 and 2027 planning.

Key details

What this opportunity funds

SaTC 2.0 is framed around building trust in the global cyber ecosystem by addressing vulnerabilities and social dimensions of security. It combines research on technical architecture, systems safety, privacy, and trust with workforce education outcomes.

This matters if your proposal is naturally cross-cutting:

• Technical advances in secure systems and trust mechanisms.
• Human factors, policy, and behavioral pathways that affect cyber risk.
• Evidence-based education models that expand cybersecurity workforce readiness.

The solicitation explicitly replaced the previous NSF 24-504 framing and now uses a Research (RES), Education (EDU), and Seedling (SEED) design. That structure is very useful during planning because it allows teams to apply under a clearer strategic slot instead of forcing every cybersecurity idea into one mold.

The program page and solicitation both emphasise that this is not just a technical-only program. It is not only about software, encryption, or network controls; it is about trust and social impact as well.

Who this is for (and who should pause first)

SaTC 2.0 is strong for:

• Research teams with at least one U.S.-based PI at a qualified campus institution.
• Groups combining technical and social/education components.
• Labs applying for systems + workforce outcomes.
• Multi-site teams with strong collaboration architecture.

It is not built for applicants using a for-profit primary appointment PI path.

The solicitation explicitly states PI, co-PI, or senior/key personnel must have either:

1. A tenured or tenure-track position, or
2. A primary full-time paid research or teaching role at a U.S. campus of an eligible organization.

Organizations with overseas branch campus limitations are not an easy fit unless the opportunity to justify activity is explicitly explained. Sub-awards to overseas campuses/offices of U.S.-based organizations are not permitted, so build your consortium structure accordingly.

Why this eligibility detail can block otherwise strong projects

Many teams invest months into proposal drafting and then discover one requirement is not met: PI appointment type, institution type, or PI proposal limits. SaTC enforces proposal limit constraints strictly:

• A maximum of four active submissions per PI/co-PI over a 12-month period.
• Within those four: up to two RES, one EDU, one SEED.
• Non-compliant proposals can be returned without review.

So before writing, run a personnel compliance check. This is a practical threshold test that many otherwise technically strong projects miss.

Tracks and budget envelopes: choose the right lane first

RES (Research)

RES is the main technical-research lane. It is capped at 1,200,000 USD total request, with standard duration up to 4 years. Budget above 600,000 USD triggers extra required structure:

• collaboration plan (if multiple investigators),
• potentially broader participation documentation if relevant to computing-heavy institutional context.

RES teams can also add an optional TTE (Transition to Education) plan up to 50,000 USD.

EDU (Education)

EDU is for cybersecurity/privacy/trust education and workforce-focused proposals, with a standard cap at 500,000 USD, typically up to 3 years. Projects can request up to an additional 100,000 USD under specified collaboration-focused education conditions and should include strong evaluation design tied to outcomes and metrics.

SEED (Seedling)

SEED is not generally open by default in a static date window. It is used for topics announced through Dear Colleague Letters (DCLs). If your idea is aligned to a new DCL in a defined period, budget is capped at 300,000 USD and duration to 2 years.

If your project is not tied to an active DCL, assume RES/EDU rather than waiting for a SEED trigger.

Proposal preparation workflow for 2026/2027 cycle planning

SaTC 2.0 publishes recurring target dates. For planning in the 2026/2027 context, read this as: submit early enough before the target cycle because target windows close into committee review rhythm.

Step 1: Decide submission route

You can submit via

• Research.gov (preferred for collaborative sets), or
• Grants.gov

Both routes require the same core policy compliance under PAPPG and program-specific conditions.

Step 2: Title format and submission metadata

Proposal title formatting is enforced by intent and not just convention. Design titles carefully:

• Start with SaTC 2.0 and include designation (RES, SEED, or EDU).
• Example structure: SaTC 2.0: RES: Project title.
• Collaborative sets follow special “Collaborative Research” conventions.

Use this consistently in planning templates and cover documents so review systems do not parse your proposal into ambiguous metadata.

Step 3: Build the required package

At minimum, prepare core documents and sections before final deadline:

• Project Personnel and Partner Institutions list (with roles, institutions, and all collaborators/subawardees).
• Project Summary with required keyword paragraph for RES/SEED.
• Collaboration Plan (required for multi-investigator budgets > 600,000 USD).
• Data Management and Sharing Plan (with explicit privacy and security practices).
• Broadening Participation in Computing plan, when applicable.
• Additional education-related planning if using EDU or RES+TTE.

The solicitation is explicit that missing required components can result in return without review. This program does not tolerate partially prepared submissions.

Step 4: Respect the review timeline

The NSF review structure is standard but exacting: pre-checks and post-checks can fail after submission. Practical guidance from NSF is to start several business days before the final target date so you have room for validation fixes.

Step 5: Build compliance around submission mechanics

If you go via Grants.gov, remember two-layer processing:

• Validate through NSF/Grants checks.
• Transfer into Research.gov after validation.

That transfer step can surface issues unrelated to your scientific content. Treat technical compliance as part of project design.

Submission strategy and preparation playbook

Start from reviewer questions

The program review criteria are still NSF’s two-board model:

• Intellectual Merit: does this advance knowledge and understanding?
• Broader Impacts: what societal value is generated?

SaTC-specific criteria then evaluate whether your scope matches budget, collaboration plan quality, transition-to-education quality (if included), and BPC quality where required.

A practical strategy: every section should answer one of these clearly in one sentence and one measurable metric. If your proposal relies on distributed collaboration, make the management model explicit and budget-backed.

Build for the evaluation layer

EDU and EDU-focused components are usually judged as strongly as technical outcomes. The program requires clear assessment and evaluation plans with metrics tied to stated outcomes. That means your proposal should include:

• measurable learning outcomes,
• dissemination method,
• and a timeline for feedback loops from pilot to production.

Avoid generic statements like “increase awareness”; specify what baseline and target indicators you will report.

Align proposal architecture to budget rules

If your budget crosses 600,000 USD for multiple investigators, collaboration plan and BPC requirements become much harder to treat as optional. Build those sections in the first draft, not at the end.

Also remember no voluntary committed cost sharing is allowed.

Use the right mix of institutions

Because PI limits are active and strict, include only those investigators who are essential to the science and execution. Over-staffed teams with weak role clarity are more likely to fail collaboration and implementation evaluations. Keep role matrixes simple and explicit.

Common mistakes and how to avoid them

1. Assuming “open” means relaxed

This is not a soft cycle. NSF programs return non-compliant proposals, including those exceeding budget limits or missing required documents.

2. Missing title convention

SaTC title formatting is explicitly structured. Even when content is strong, inconsistent titles and designation syntax create avoidable risk.

3. Ignoring PI limits

The proposal count rule is enforced. If your PI sits on many active submissions, one violation can block review for compliance reasons.

4. Submitting weak keyword and summary architecture

RES/SEED requires keyword list placement in summary. If missing, this can be interpreted as a review risk and can cost alignment.

5. Late submission behavior

The target dates are not strict deadlines for all outcomes, but missing target panels can delay or reduce chances. If submission is close to the target date, technical validation can quietly erase your chance at a near-term panel cycle.

6. Treating the collaboration plan as a short add-on

For large budgets with multiple investigators, collaboration architecture and project governance must be serious: role definitions, communication plan, meeting structure, integration of tools and shared milestones.

Practical checklist before submission

• Confirm PI role eligibility (tenure-track/full-time research/teaching in U.S. eligible institution).
• Confirm project designation (RES / EDU / SEED) and corresponding budget caps.
• Check PI proposal limit history in the last 12 months.
• Prepare personnel list format exactly and include all funded/unfunded collaborators.
• Draft Data Management and Sharing Plan with data provenance and access control provisions.
• Add clear metrics and evidence collection plan for EDU-related outcomes.
• Build BPC documentation if your budget triggers requirement.
• Validate keywords in summary.
• Run a compliance dry run on Research.gov or Grants.gov and leave internal buffer time.
• Register collaborators where needed and verify submission routing for collaborative submissions.

FAQ

Is this only for cybersecurity researchers?

No. The program spans cybersecurity research, social-behavioral dimensions, and education. The solicitation explicitly includes directorates beyond just computing disciplines, and welcomes interdisciplinary teams.

Can for-profit entities lead?

Primary PI appointments at for-profit non-academic organizations are not eligible for PI role in the way this solicitation defines PI constraints. Non-profit, research-oriented collaborators can be included depending on fit, but check role allocations carefully.

Is SEED open now?

SEED is available for topics announced through DCLs. Check active DCLs on the program page before planning a SEED submission.

What changed for this solicitation cycle?

The solicitation introduces updated research focus areas and revised structure including new designation clarity, target date frequency, and explicit limits/processes around PI proposal count, collaboration plan, and education transition content.

Are target dates strict?

They are target dates, and proposals are accepted beyond them, but late-by-panel submissions can miss review opportunities. Best practice is to submit ahead of target with technical buffer.

Is this a federal grant or only fellowship funding?

It is a federal grant solicitation with continuing and standard grant modes in the anticipated award structure.

What makes a winning SaTC 2.0 concept

Winning proposals map a real cyber problem to both research rigor and societal relevance.

The strongest concept narratives generally do three things well:

• identify a trust/security/privacy pain point with broad impact,
• connect the technical method to measurable systems outcomes,
• and show educational/workforce transfer where relevant.

Use explicit deliverables, not aspirational language. Include risk and privacy safeguards where relevant to avoid reviewer concerns around implementation maturity.

This is especially important because review in this program combines technical novelty with program-level utility and broader impact alignment.

Official links

• Official program page: https://www.nsf.gov/funding/opportunities/satc-20-security-privacy-trust-cyberspace
• Official solicitation: https://www.nsf.gov/funding/opportunities/satc-20-security-privacy-trust-cyberspace/nsf25-515/solicitation
• Program officer contact listed on the official page: [email protected] (contact for eligibility and solicitation questions via NSF guidance)
• PAPPG and NSF award guide pages linked through the solicitation

If you are planning to apply for the 2027 cycle, treat the above links as the source of record and confirm any DCL additions before finalizing a SEED strategy.