Foci Mitigation: Facility Clearances under Foreign Ownership or Contro

Foreign ownership, control, or influence means a foreign interest has the ability to affect a company in ways that could put classified information or national security at risk. Foreign ownership refers to a foreign person or entity holding a stake in the company, control refers to the power to direct its management or decisions, and influence refers to other means, such as contracts, debt, or relationships, that could let a foreign interest affect the company. Even without majority ownership, significant influence can trigger FOCI considerations.

Companies disclose foreign interests to the government on a standard form, the SF-328 Certificate Pertaining to Foreign Interests, which the government uses to assess whether and how a company must mitigate. Because FOCI captures a range of relationships beyond simple ownership, the disclosure and analysis often overlap with foreign investment compliance more broadly.

FOCI mitigation is required because a company under foreign influence cannot hold a facility security clearance unless the risk to classified information is adequately addressed. The government's concern is that a foreign interest could gain access to classified information or pressure the company in ways that harm national security, so it conditions clearance eligibility on neutralizing that risk. Without acceptable mitigation, a company may be denied a clearance or have an existing one revoked, which can disqualify it from classified contracts.

Access to classified work is often essential to defense and government contractors, so maintaining a clearance through proper mitigation can be vital to the business, and it supports the protection of classified and export-controlled information. The requirement reflects the balance between allowing foreign investment and safeguarding classified information.

Board resolutions and security control agreements are mitigation instruments used for lower levels of FOCI. A board resolution is generally appropriate when a foreign interest holds a minority position without board representation rights, and it formally excludes that interest from access to classified information and from decisions affecting classified work. A security control agreement is used when foreign involvement is more substantial, such as foreign board representation, but still does not amount to control, adding governance measures like cleared officials and a government security committee while the company remains under U.S. .ontrol.

These lighter instruments work because the foreign interest's ability to influence classified matters is limited to begin with. They rely on governance safeguards rather than restructuring ownership, which generally makes them less burdensome than the arrangements used for higher levels of foreign control.

Special security agreements, proxy agreements, and voting trusts are the instruments used when a foreign interest effectively owns or controls a U.S. .ompany. A special security agreement allows the foreign owner to have board representation while establishing structures that insulate classified work, including cleared U.S. .irectors and a security committee that oversees compliance, so a foreign-owned company can perform classified contracts under strict safeguards.

Proxy agreements and voting trusts go further and are the most stringent options, used where foreign control must be fully separated from classified operations. Under these arrangements, the foreign owner's voting rights are exercised by cleared U.S. .itizens, proxy holders or voting trustees, independently of the foreign owner, who retains financial ownership but gives up day-to-day control. Because these structures provide the strongest insulation, they are used where the foreign interest would otherwise have controlling influence, often alongside foreign investment review of the underlying transaction.

FOCI mitigation is overseen primarily by the Defense Counterintelligence and Security Agency, which administers the National Industrial Security Program for most cleared contractors. This agency evaluates whether a company is under FOCI, reviews and approves the proposed mitigation instrument, and monitors the company's ongoing compliance with the arrangement. The applicable requirements are set out in 32 CFR Part 117, the federal industrial security rule that governs how classified information is protected in industry.

Because this oversight is continuous, a mitigated company interacts with the agency throughout the life of its clearance, not only when the arrangement is first put in place. Government contractors generally address FOCI as part of their broader obligations when performing classified government contracts.

FOCI mitigation, especially at higher levels, requires specific governance structures designed to keep classified work insulated from foreign influence. These commonly include a government security committee made up of cleared directors and officers responsible for security compliance, cleared outside directors who are U.S. .itizens, and a facility security officer who manages the security program.

Depending on the mitigation agreement, the company may also need supplemental plans, such as an Affiliated Operations Plan, Technology Control Plan, Electronic Communications Plan, Visitation Plan, or Facilities Location Plan, to control affiliate services, communications, access, and facility separation. Because regulators expect these mechanisms to be genuinely implemented and maintained, building effective governance is a core part of mitigation and closely related to a company's overall regulatory compliance program.

A national interest determination can come into play when a company mitigated by a special security agreement needs access to particularly sensitive proscribed information, such as Top Secret information, sensitive compartmented information, special access program information, communications security material, or restricted data. A company operating under an SSA may still need a national interest determination before accessing such information, with the government assessing whether access is consistent with the national security interests of the United States.

Certain exceptions may apply, including for qualifying NTIB-related entities under Section 842 of the National Defense Authorization Act for Fiscal Year 2019 and current agency guidance reflected in 32 CFR Part 117. The National Technology and Industrial Base currently comprises the United States, the United Kingdom, Australia, and Canada, but the availability of that relief depends on the ownership structure, the information involved, and the government's determination, so this is an area to confirm against current rules.

FOCI mitigation frequently arises alongside foreign investment in U.S. .ompanies, and it is important to distinguish it from the separate national security review of transactions. When a foreign investor acquires or invests in a U.S. .ompany with a facility clearance, two things can happen in parallel: the transaction itself may be reviewed for national security concerns, and the cleared company must arrange FOCI mitigation to keep its clearance.

A practical point matters for deal planning: even after a transaction clears national security review and closes, the facility clearance can be affected until the FOCI mitigation arrangement is approved. Coordinating the timing of both processes is essential when structuring foreign investment in cleared companies.

FOCI mitigation and CFIUS review often arise in the same transaction, but they answer different questions: CFIUS reviews the national security risk of the foreign investment and can impose conditions or block a deal, while FOCI mitigation determines whether the cleared company can keep its facility clearance after foreign involvement is introduced. CFIUS operates at the transaction level, and FOCI mitigation operates through the industrial security program.

The two can overlap when a foreign acquisition of a cleared company triggers both, but they are handled by different authorities. Even after CFIUS clears a deal and it closes, the facility clearance can remain affected until the FOCI mitigation is approved, so CFIUS compliance and clearance mitigation are generally planned together.

A company should address FOCI mitigation early, ideally before or during any transaction that introduces foreign ownership, control, or influence into a cleared or clearance-seeking business. Identifying FOCI and planning mitigation in advance helps avoid disruption to the clearance and to classified contract performance, since an unaddressed FOCI situation can jeopardize the clearance. Early planning also lets the company and any foreign investor structure the arrangement in a workable way.

Mitigation can significantly affect governance and the foreign owner's role, so building it into deal planning rather than addressing it after the fact is far more effective. Companies navigating foreign investment in cleared businesses often coordinate FOCI mitigation with deal timing, governance, and clearance-risk issues from the outset, drawing on related foreign investment law considerations.

If FOCI is not adequately mitigated, a company can be denied a facility security clearance or have an existing clearance revoked, which can prevent it from performing classified contracts. The government will not allow access to classified information where foreign influence poses an unacceptable risk, so failing to put acceptable mitigation in place has direct and serious consequences for a cleared contractor. Losing a clearance can mean losing eligibility for significant government work.

Beyond the clearance itself, unaddressed FOCI can complicate transactions and create compliance problems. The stakes lead companies facing FOCI to treat mitigation as essential, often addressing it alongside related concerns such as protecting sensitive technology and meeting export control obligations that frequently arise for the same businesses.

Several issues can delay facility clearance approval in a FOCI situation. Incomplete or inconsistent SF-328 disclosures, unresolved questions about the ownership structure, lengthy negotiation of the mitigation instrument, and the time needed to put governance structures and supplemental plans in place can each slow the process. Where access to proscribed information is involved, additional determinations may add time depending on the circumstances.

Overlapping transaction review can also affect timing, since the clearance may remain unsettled until mitigation is approved even after a deal closes. Because these delays can interrupt classified contract performance, identifying and addressing the likely bottlenecks early, including accurate disclosures and a realistic mitigation plan, helps keep the clearance on track.

FOCI stands for foreign ownership, control, or influence. It describes a situation where a foreign interest has the ability, through ownership, control, or other means such as contracts, debt, or relationships, to potentially affect a U.S. .ompany in a way that could compromise classified information or national security. A company is considered under FOCI when such foreign involvement exists, even if it falls short of majority ownership, because significant influence alone can raise concerns. When a cleared or clearance-seeking contractor is under FOCI, the government generally requires that the foreign interest's ability to affect classified work be reduced or neutralized through an approved mitigation arrangement before the company can hold a facility security clearance.

A company needs FOCI mitigation because it cannot hold a facility security clearance while a foreign interest could improperly influence its classified work. The government conditions clearance eligibility on neutralizing that risk, so a company under foreign ownership, control, or influence must adopt an approved arrangement that insulates classified operations. Without acceptable mitigation, the company may be denied a clearance or have one revoked, disqualifying it from classified contracts. For defense and government contractors, that can be existential, which is why FOCI is taken seriously.

The main FOCI mitigation instruments escalate in stringency with the degree of foreign ownership or control. For limited foreign interest, a board resolution can exclude the foreign owner from classified matters. For more substantial involvement short of control, a security control agreement adds governance safeguards. When a foreign interest owns or controls the company, a special security agreement allows ownership while insulating classified work through cleared directors and a security committee. For significant foreign control, a proxy agreement or voting trust vests voting rights in cleared U.S. .itizens, fully separating the foreign owner from control of classified operations. The right instrument depends on the facts, including the size of the foreign stake and the sensitivity of the work involved.

FOCI mitigation and CFIUS review are distinct but related processes that often arise together. CFIUS examines whether a foreign investment creates national security risks at the transaction level and can impose conditions or block a deal. FOCI mitigation addresses whether a cleared company can keep its facility security clearance despite foreign ownership or control, operating through the industrial security program rather than transaction review. They answer different questions and are handled by different authorities, but a foreign acquisition of a cleared company can trigger both. Even after CFIUS clears a deal and it closes, the facility clearance can remain affected until the FOCI mitigation is approved, so companies generally address both together when structuring such deals.

FOCI mitigation is approved and overseen primarily by the Defense Counterintelligence and Security Agency, which administers the National Industrial Security Program for most cleared contractors under 32 CFR Part 117. The agency determines whether a company is under FOCI, reviews and approves the mitigation instrument, and monitors ongoing compliance. Oversight is continuous, so a mitigated company maintains required governance structures, such as a government security committee and cleared officials, and interacts with the agency throughout the life of its clearance rather than only at the outset.

Yes, a foreign-owned company can hold a U.S. .acility security clearance, but generally only with acceptable FOCI mitigation in place. Depending on the degree of foreign ownership or control, it may use a special security agreement, which permits foreign ownership while insulating classified work, or a proxy agreement or voting trust that vests voting control in cleared U.S. .itizens. These arrangements let the company perform classified contracts under safeguards that prevent the foreign owner from accessing classified information or controlling classified operations. So foreign ownership does not automatically bar a clearance, but the company must adopt and maintain a government-approved arrangement appropriate to its level of FOCI.