FOCI Mitigation Measures: Structures, Negotiation, and Compliance

When a foreign interest can shape how a cleared U.S. company operates, the Defense Counterintelligence and Security Agency requires a formal safeguard before that company can keep touching classified information. FOCI mitigation measures come in five basic forms, ordered by how deep the foreign involvement runs: a board resolution for passive minority investors, a Security Control Agreement when a foreign owner has a board seat but not control, a Special Security Agreement when the foreign owner effectively controls the company, a Voting Trust or Proxy Agreement when full separation of management is required, and tailored non-ownership measures when the pressure point is debt, revenue, or contracts rather than stock.¹ The rule set lives in 32 CFR Part 117, the National Industrial Security Program Operating Manual.

What Triggers the Need for Mitigation

No single factor automatically forces a company into a mitigation agreement. DCSA weighs several indicators together, along with the espionage record of the relevant foreign government, the company’s compliance history, and the sensitivity of the classified work involved.

Ownership is the most familiar trigger. A foreign person or entity holding 5% or more of any class of voting securities must be disclosed. Revenue dependency counts too: 5% or more of total revenue or net income from a single foreign source, or 30% or more from all foreign sources in aggregate, is treated as a pressure point.² Significant debt owed to a foreign lender lands in the same bucket, particularly when the debt could convert to equity.

Personnel connections matter as well. Foreign nationals serving as officers, executives, board members, or senior managers raise concerns, as do U.S. board members who simultaneously hold positions with foreign entities.³ Consulting and licensing agreements that give a foreign party leverage over decision-making fit here too.

Every company seeking or maintaining a facility clearance discloses these factors on Standard Form 328, the Certificate Pertaining to Foreign Interests. Its ten questions map directly onto the factors above, with a deliberately open-ended tenth question asking whether anything else might indicate foreign control or influence.² Vague or incomplete answers invite additional scrutiny and slow the review.

The Five Mitigation Structures

The right structure depends on how much authority the foreign interest actually has. Getting placed under the wrong one wastes time and money, so the distinctions matter.

Board Resolution

The simplest tool. A board resolution applies when a foreign investor holds a minority stake that does not entitle them to a board seat.¹ The board passes a binding resolution acknowledging the investment, excluding the foreign investor from access to classified or export-controlled information, and confirming they have no involvement in classified programs.⁴ If the foreign stakeholder later gains additional control, such as veto power over board decisions, the company will need a more stringent arrangement.

Security Control Agreement

An SCA applies when the foreign interest does not effectively own or control the company but is entitled to board representation.³ The foreign owner can appoint an Inside Director for general business decisions, but at least one Outside Director must also sit on the board. That Outside Director must be a U.S. citizen with a security clearance, must have no prior relationship with the company or its foreign owner, and must be capable of independent judgment.⁵ A Government Security Committee monitors compliance. One meaningful advantage of the SCA over more restrictive agreements: no access limitations on the types of classified information the company can handle.

Special Security Agreement

When a foreign interest effectively owns or controls the company, DCSA typically requires an SSA.³ The SSA preserves the foreign owner’s right to board representation and a voice in general business management, but denies majority board representation and bars unauthorized access to classified information.¹ Outside Directors and a Government Security Committee are mandatory. The critical difference from an SCA: SSA companies face restrictions on certain categories of classified information unless the government issues a National Interest Determination.

Voting Trust or Proxy Agreement

The strongest insulation. A Voting Trust or Proxy Agreement is used when a foreign entity effectively owns or controls the company and the government requires full separation of management authority. Under a Voting Trust, the foreign owner transfers legal title of their stock to U.S. citizen trustees. Under a Proxy Agreement, the foreign owner keeps legal title but grants all voting rights to independent Proxy Holders.¹ Either way, the trustees or proxy holders take full responsibility for management decisions. They must be U.S. citizens, hold clearances at the facility’s level, and have no prior ties to the foreign entity.⁵

Non-Ownership Measures

Not every FOCI problem involves stock. When the concern is financial dependency, consulting arrangements, or other non-ownership factors, DCSA can impose tailored corrective measures instead of a formal agreement. Options include modifying or terminating loan agreements with foreign lenders, diversifying revenue away from a single foreign source, demonstrating financial viability independent of foreign funding, and physically separating classified work from foreign-connected operations.³ These can be combined with each other or paired with an ownership-related agreement when the situation calls for it.

The Proscribed Information Ceiling

Companies operating under an SSA, Voting Trust, or Proxy Agreement face an access ceiling that catches many buyers by surprise. Certain categories of classified information are considered proscribed, and the company cannot touch them without a National Interest Determination confirming that access will not harm national security. The proscribed categories are Top Secret, Sensitive Compartmented Information, Special Access Programs, Communications Security, and Restricted Data.⁶

The company itself does not request the NID. The Government Contracting Activity, meaning the agency awarding the contract, submits the request to DCSA with the contract number, a description of the technology, and a justification for the access.⁶ When a proscribed category falls under another agency’s jurisdiction, that agency must separately concur, and a single non-concurrence blocks access. Companies under an SCA face no proscribed-information restrictions, which is a real reason to preserve the SCA structure when the foreign interest’s involvement stops short of effective control.³

Factor this ceiling into acquisition planning before a deal closes. Which contracts a foreign-owned defense company can compete for depends directly on which agreement it ends up under.

How the Agreement Gets Negotiated and Signed

The process starts with the SF 328 and supporting documents submitted through the National Industrial Security System, DCSA’s secure web platform for facility clearance and FOCI matters.⁷ Beyond the form itself, DCSA typically wants an organizational chart showing the U.S. entity, its parent companies, and foreign affiliates; a complete list of foreign government contracts, including commercial-product contracts; and the company’s articles of incorporation and bylaws. Debt figures need to identify foreign lenders, amounts owed, and any security interests. Revenue figures need to break out single-source and aggregate foreign percentages.²

Once the submission is received, DCSA assigns an Industrial Security Representative as the primary point of contact through negotiation. Timelines depend on complexity. Straightforward cases with passive minority ownership can move quickly. Complex situations involving majority foreign ownership, multi-layered corporate hierarchies, or proscribed-information access can take six months to a year or longer. Delays in responding to requests for clarification extend that further, and the company cannot access classified information until the agreement is finalized.

When DCSA is satisfied with the proposed safeguards, the agency drafts the final mitigation agreement. Company leadership signs it, and where the agreement requires Outside Directors, those individuals sign and complete their clearance applications. DCSA then issues a determination letter confirming that the FOCI is adequately mitigated. That letter stays on file and will be reviewed at future inspections.

For companies going through a foreign acquisition, a separate review by the Committee on Foreign Investment in the United States may run in parallel. CFIUS and DCSA operate under different legal authorities and consider different questions, but they interact: if a company will not negotiate an acceptable mitigation plan or fails to comply with FOCI reporting, DCSA can recommend a full CFIUS investigation into the underlying transaction.³

Living Under the Agreement

Signing is not the finish line. Companies operating under an SCA, SSA, Voting Trust, or Proxy Agreement must implement and maintain two internal security plans. A Technology Control Plan details how the company prevents unauthorized access to technical data by foreign nationals, covering badging, escort procedures, segregated work areas, and visitor controls. An Electronic Communications Plan documents separation of networks and email between the U.S. company and its foreign affiliates, including firewalls, monitoring, and separate infrastructure.⁸ Both plans need DCSA approval before implementation.

The Government Security Committee, made up of the Outside Directors (or trustees or proxy holders) together with the company’s Facility Security Officer, functions as the internal watchdog. The GSC and the company’s CEO submit an annual compliance report to DCSA, due one year from the agreement’s effective date and every year after.⁹ That report is substantive. It must describe how the company is carrying out its obligations, document any noncompliance (whether accidental or deliberate) with corrective steps, flag changes to key management personnel, and give a chronological summary of every transfer of classified or export-controlled information to foreign affiliates along with the government authorization relied on.

Material changes to ownership or management structure must be reported as they happen, not just at annual review. New foreign contracts, changes in board composition, and new foreign debt all qualify. DCSA uses those disclosures to decide whether the existing agreement still fits or needs to be upgraded.

What Happens If You Get It Wrong

DCSA does not treat FOCI violations as paperwork problems. If a company cannot or will not negotiate an acceptable mitigation plan, its facility clearance will be invalidated.³ If the security measures in place prove insufficient to prevent unauthorized access, the clearance can be revoked outright. No facility clearance means no work on classified contracts, and existing contracts may be terminated. For companies whose revenue depends on defense work, that is an existential threat.

Fallout extends past the clearance. DCSA can recommend a full CFIUS investigation into the transaction, and CFIUS has authority to unwind completed deals that threaten national security. Misrepresenting foreign ownership or control on government forms can expose the company and its officers to liability under the False Claims Act, which allows the government to pursue treble damages and per-claim penalties.¹⁰ The regulation also expressly preserves the authority of any federal agency head to limit, deny, or revoke access to classified information under that agency’s own jurisdiction, so DCSA is not the only entity with the power to pull the plug.³

1
Defense Counterintelligence and Security Agency. Mitigation Agreements
2
U.S. Nuclear Regulatory Commission. SF-328, Certificate Pertaining to Foreign Interests
3
eCFR. 32 CFR 117.11 – Foreign Ownership, Control, or Influence (FOCI)
4
Center for Development of Security Excellence. Introduction to DCSA, FOCI, and FOCI Mitigating Agreements Student Guide
5
Center for Development of Security Excellence. Administering the FOCI Agreement and Compliance Student Guide
6
Defense Counterintelligence and Security Agency. National Interest Determinations
7
Defense Counterintelligence and Security Agency. National Industrial Security System (NISS)
8
eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual (NISPOM)
9
Defense Counterintelligence and Security Agency. Special Security Agreement
10
Office of the Law Revision Counsel. 31 U.S. Code 3730 – Civil Actions for False Claims