A recent decision from the U.S. Court of Federal Claims delivers an important — and sobering — message to small businesses competing for federal innovation funding: Historical ties to foreign countries of concern can be sufficient, standing alone, to disqualify a company from receiving a Small Business Innovation Research (SBIR) award, even when those ties are decades old and were never concealed. In Kayhan Space Corp. v. United States, the court upheld the Air Force’s denial of an SBIR contract to a Colorado-based space software startup on national security grounds, rejecting the company’s challenges, including a claim that the agency had effectively blacklisted it from government contracting without going through the formal debarment process. The decision is notable both for what it permits agencies to do and for what it tells contractors about their limited options when a security review goes against them.

Background

Kayhan Space Corporation is a small business that develops launch collision avoidance software. Its flagship product, “Gamut,” helps spacecraft identify safe launch windows and avoid in-orbit collisions — a capability with obvious value to the U.S. Space Force, a military branch within the Department of the Air Force. In September 2023, Kayhan submitted a proposal in response to an Air Force Commercial Solutions Opening solicitation — a type of Department of Defense (DoD) acquisition procedure that seeks innovative commercial products or commercial services — that sought technology to reduce Space Force response times for on-orbit operations from weeks to hours.

After making a tentative selection for negotiations and award, the Air Force conducted a national security due diligence review. That review ended Kayhan’s bid because the Air Force determined that Kayhan’s two co-founders — both naturalized U.S. citizens who immigrated from Iran in 2005 and 2006 — had historical ties to two Iranian entities with documented connections to Iran’s Islamic Revolutionary Guard Corps (IRGC). Specifically, both founders had studied industrial engineering at Sharif University of Technology in Tehran, which the Air Force characterized as having a “cooperative relationship” with the IRGC, and which is subject to sanctions by the European Union, the United Kingdom, and Japan due to its links to Iran’s nuclear program. In addition, one Kayhan founder, Araz Feyzi, had previously worked as a “senior expert” at an entity owned and controlled by Pasargad Bank, an Iranian bank subject to U.S. Treasury sanctions for aiding malign Iranian activities, as well as with shareholders connected to the IRGC.

Neither connection had been disclosed on Kayhan’s foreign disclosure form. The Air Force’s Risk Mitigation Review Board (RMRB) assigned Kayhan a “High Risk” rating for Factor 2 (Foreign Ownership/Control) and a “Very High Risk” rating for Factor 5 (Foreign Affiliations) under the DoD Due Diligence Program’s Common Risk Matrix. After concluding that the security risks could not be adequately mitigated, the Air Force declined to make the award.

The Legal Framework: The SBIR Extension Act and Its Implementation

The SBIR and Small Business Technology Transfer (STTR) programs allow federal agencies to provide grants and contracts to small businesses to develop innovative technology and potentially commercialize it. Congress enacted the SBIR and STTR Extension Act of 2022 (Pub. L. No. 117-183) to combat documented exploitation of the SBIR program by foreign adversaries that, as Congress recognized, have been using “shell companies, planted government research, and state-sponsored talent programs” for that purpose. The act designated Iran, China, Russia, and North Korea as “foreign countries of concern” and mandated that every agency making SBIR awards assess security risks from applicants with ties to those countries — covering employee analysis, foreign ownership, financial obligations, and cybersecurity practices.

The DOD implemented the act through the May 2024 “Hicks Memo,” which established the DoD Due Diligence Program and a Common Risk Matrix, setting minimum standards for all DoD components. The Air Force followed with its own implementing instruction, AFI 61-102, in February 2025, establishing Risk Mitigation Review Boards empowered to make binding national security determinations for individual SBIR proposals.

The Court’s Holdings

1. The Air Force’s Risk Assessment Was Not Arbitrary and Capricious
   Kayhan’s primary argument was that the Air Force’s security assessment was facially unreasonable. The company contended that it was irrational to treat connections formed in the mid-2000s — before relevant sanctions were imposed and long before Kayhan existed — as evidence of present security risk.

   The court disagreed, applying the substantial deference that courts owe to military judgments in the national security context. Citing Trump v. Hawaii (PDF), a 2018 Supreme Court case, the court noted that “when it comes to collecting evidence and drawing inferences on questions of national security, the lack of competence on the part of the courts is marked.” Under that highly deferential standard, the Air Force’s conclusion was rational: It is not unreasonable to conclude that ties from a person’s college days and early employment history may persist, or that a sanctioned institution may have been engaged in concerning activities well before formal sanctions were imposed.

   Critically, the court found that the Air Force’s risk determination was based entirely on the founders’ attendance at Sharif University and Feyzi’s employment at a Pasargad Bank subsidiary — and that both factual predicates were supported by the record. What Kayhan characterized as unreasonable conclusions were, in the court’s view, “mere disagreements with the Air Force’s weighing of the facts and circumstances,” not cognizable grounds for overturning a national security determination.

2. The Air Force Complied with Applicable Statutes and Regulations
   Kayhan raised three statutory and regulatory compliance arguments, all of which were rejected.

   Kayhan argued that the act was not intended to authorize “limitless, backwards-looking dragnets” based on decades-old connections. The court rejected this, noting that Congress used the phrase “risk-based approach as appropriate” — language that signals broad agency discretion. Because the statute contains no temporal limitation on the evidence agencies may consider, the Air Force was within its authority to weigh 20-year-old institutional relationships.

   Kayhan also argued that the Common Risk Matrix precluded the Air Force from rating student attendance as an “affiliation” and required the agency to find only current foreign ties to assign a “Very High Risk” rating. The court rejected both arguments. It held that the Common Risk Matrix sets a floor, not a ceiling; the Hicks Memo repeatedly describes it as establishing “common minimum standards,” and components may go further. The court also found, importantly, that Feyzi was not merely a student — he held positions as a research assistant and teaching assistant at Sharif University, which constitute “indicators” of an affiliation under the program’s definitions. The court further declined to read a temporal limitation into the present-tense verb usage in the Common Risk Matrix, noting that the memo uses present tense inconsistently throughout.

   Moreover, Kayhan argued that the Air Force was required to give it an opportunity to respond to the security assessment before a final decision was made. The court found no such entitlement in the Air Force’s own guidance. The relevant provision uses the permissive “may” in describing the agency’s authority to “request supplemental information” — not the mandatory “shall” — and the “opportunity to respond” language in AFI 61-102 addresses the adequacy of notice content, not a guaranteed right to submit rebuttal evidence. Any procedural deficiency in the Air Force’s initial denial was also cured by a corrective action process stemming from an earlier bid protest at the Government Accountability Office, which provided Kayhan with a detailed, unclassified explanation of the grounds for non-selection.

3. Kayhan Failed to Establish De Facto Debarment
   Perhaps the most legally significant portion of the opinion addresses Kayhan’s de facto debarment claim. Kayhan alleged that since the passage of the SBIR Extension Act, it had submitted nine SBIR proposals to the Air Force and Space Force without a single award — and that this pattern, combined with the Air Force’s finding that its security risk “cannot be mitigated,” effectively blacklisted the company while avoiding the procedural protections of the formal debarment process.

   De facto debarment generally requires proof of “a systematic effort by the procuring agency to reject all of the bidder’s contract bids” — a “heavy burden” requiring a showing that the agency has “either stated or engaged in conduct demonstrating that it will not award the contractor future contracts.” The court found Kayhan fell far short of that standard on both prongs.

   On the “stated” prong, Kayhan offered extra-record declarations from corporate officers relaying double hearsay — that a former Air Force servicemember had told them an unnamed Air Force OSI employee had instructed him not to work with Kayhan. The court found this fell far short of the Art-Metal-USA, Inc. v. Solomon, 473 F. Supp. 1 (D.D.C. 1978), standard, where agency officials stated in depositions that they would not work with the contractor. Hearsay of this nature, the court held, is insufficient to overcome the government’s “presumption of regularity.”

   On the “conduct” prong, the court observed that this case concerned only one procurement and that the Air Force’s written determination in that procurement explicitly disclaimed the debarment effect, stating that the non-award “does not constitute a suspension, debarment, SBIR/STTR programmatic ineligibility, exclusion from all or any other Federal contracts.” The court distinguished MG Altus Apache Co. v. United States, 111 Fed. Cl. 425 (2013), where de facto debarment was found because the Army relied on an unreviewable vendor rating that was not prepared for the procurement at issue. Here, by contrast, the Air Force conducted an individualized assessment for the specific proposal before it for the procurement at issue.

Conclusion

Kayhan Space Corp. v. United States is an important early test of the SBIR Extension Act’s enhanced due diligence regime. The decision makes clear that the act gives agencies latitude to assess security risks, that the DoD Due Diligence Program’s Common Risk Matrix sets minimum — not maximum — review obligations, and that courts will generally defer to documented military judgments about what historical connections might pose a present security threat.

For small businesses in the defense and space technology sectors — particularly those founded or led by individuals with backgrounds involving countries of concern — the decision underscores the importance of proactive legal counsel before proposal submission, thorough foreign disclosure, and a clear-eyed understanding of what security screening may uncover.