Special Security Agreement: FOCI Board, NID, and Compliance

A Special Security Agreement is a mitigation contract between a foreign-owned U.S. company, its foreign parent, and the Defense Counterintelligence and Security Agency that lets the company hold a facility security clearance and perform classified defense work while the foreign owner keeps a real voice in the business. Unlike a Proxy Agreement or Voting Trust Agreement, which strip the foreign parent of nearly all management rights, an SSA preserves board representation for the foreign owner and places security guardrails around classified operations instead. Every SSA runs for five years from execution and must spell out how the company will prevent unauthorized access to classified and export-controlled information.¹

When an SSA Is the Right Instrument

DCSA requires some form of FOCI mitigation when a foreign interest effectively owns or controls a U.S. entity that needs a facility clearance. There is no single ownership percentage that triggers this. DCSA weighs the full picture: the size of the foreign stake, whether the foreign interest can appoint or remove senior management, dependence on foreign revenue, contractual and debt relationships, and related factors evaluated together.²

The SSA is the instrument to choose when the foreign parent needs to stay involved in business decisions. If the foreign owner is willing to hand nearly all management authority to cleared U.S. citizens, a Proxy Agreement or Voting Trust Agreement is the alternative, and those instruments carry no built-in restriction on the type of classified information the company can access. If the foreign interest has board representation but does not effectively control the company, a lighter Security Control Agreement may fit. The SSA sits in the middle: more foreign involvement than under a proxy, but access to certain categories of classified information will require a separate government approval.

The Board Structure That Makes an SSA Work

Board composition is the primary mechanism that keeps foreign influence in check. Two roles matter.

Outside directors are cleared U.S. citizens with no prior relationship to the company or its foreign parent. They must hold security clearances at or above the level of the facility clearance. Under an SSA, the number of outside directors must exceed the number of inside directors. That threshold is stricter than the Security Control Agreement, where outsiders only have to equal insiders.³

Inside directors represent the foreign parent. They have a direct voice in business decisions, which is the reason a company chooses an SSA in the first place. They cannot hold a majority of board seats, and they are excluded from access to classified information unless separately cleared and authorized.

The Government Security Committee

Every SSA company must establish a permanent Government Security Committee as a standing committee of the board. The GSC consists of the outside directors plus any officer directors cleared for classified access. The company’s Facility Security Officer serves as the principal advisor to the GSC and attends its meetings, and the GSC chairman must approve the appointment or replacement of the FSO.²

The GSC’s job is to make sure the company follows the law, maintains internal security policies, and promptly investigates and reports violations. It also reviews all interactions between the domestic company and its foreign affiliates to prevent unauthorized transfers of classified or export-controlled information. This is not an advisory body. It carries real authority over the company’s security posture.

The National Interest Determination Constraint

Companies cleared under an SSA face one constraint that proxy-type instruments do not. Access to what the rules call proscribed information requires a National Interest Determination. Proscribed information includes Top Secret material, Sensitive Compartmented Information, Special Access Programs, communications security material, and Restricted Data. Before the company can touch any of these categories, the government must formally determine that releasing the information to it will not harm U.S. national security.⁴

A detail worth pinning down: the NID request is not the contractor’s to file. The government contracting activity — the agency that wants the classified work performed — submits the NID request to DCSA with the company’s identifying information, the contract or program involved, a description of the technology to be accessed, and a justification for the access.⁴

DCSA validates the need, prepares a proposed NID, and returns it to the contracting activity for concurrence within 30 days. If the proscribed information involves communications security material, Sensitive Compartmented Information, or Restricted Data, the responsible control agency must also decide within 30 days. In practice, NID processing adds weeks or months before an SSA company can begin work on a proscribed-information contract, and bidders should build that delay into their planning.

What Goes Into the Application

Getting to a signed SSA starts with a documentation package for DCSA. Errors and gaps in these materials are the most common reason applications stall.

Standard Form 328

The foundation is Standard Form 328, the Certificate Pertaining to Foreign Interests. Its ten questions probe foreign connections from several angles: whether any foreign person holds 5 percent or more of equity securities, whether the company owns 10 percent or more of any foreign entity, whether non-U.S. citizens serve in senior management or on the board, whether any foreign person can influence the appointment of management, whether the company has contracts or debt obligations with foreign parties, whether it derives significant revenue from foreign sources, whether voting securities are held in nominee shares, whether board members hold positions with foreign entities, and a catchall on any other factors suggesting foreign control.⁵

Accuracy matters beyond the application itself. Knowingly providing false information on the SF 328 exposes signers to prosecution under the federal false statements statute, with penalties of up to five years in prison.⁶

Supporting Documentation

The submission also requires detailed organizational charts mapping the full ownership chain from the domestic company up to the ultimate foreign parent, a list of foreign stockholders showing citizenship and share percentages, and biographical sketches for the proposed outside directors demonstrating their qualifications, independence from the foreign interest, and eligibility for a high-level clearance. Prior military or government experience helps here. Financial records need to be cross-referenced against the SF 328 answers so no foreign investment goes undisclosed.

From Submission to Signed Agreement

The company submits the package to its assigned Industrial Security Representative at DCSA. The agency then reviews a FOCI Action Plan to assess the risks the foreign ownership presents and whether the proposed mitigation is adequate. Federal investigators conduct thorough background checks on proposed outside directors to confirm they qualify for the required clearances. That investigation alone can stretch several months, and overall timing depends on the complexity of the corporate ownership structure and whether proscribed-information access will trigger a NID. Straightforward ownership chains with pre-cleared outside director candidates move faster than multinational conglomerates with layered holding companies.

Signing the SSA is not the finish line. Execution starts a 45-day clock to submit implementation plans and puts the company under immediate compliance obligations.

Implementation Plans After Execution

The signed SSA is a framework. The operational detail lives in a set of plans the company develops and files with DCSA, most within 45 days of execution.

Technology Control Plan

The Technology Control Plan describes how the company will physically protect classified and export-controlled information. It must set out security measures that prevent unauthorized access by non-U.S. citizen employees, visitors, and affiliates. Access by foreign nationals and affiliates is limited strictly to information for which the government has granted specific disclosure authorization.⁷

Electronic Communications Plan

The Electronic Communications Plan covers every digital channel between the company and its foreign affiliates: email, phone, video conference, fax, and server access. Video conferences with affiliates are treated as visits and must comply with the SSA’s visitation requirements. The plan must include a network diagram showing which systems are shared and which are walled off from foreign access, along with policies for firewalls, remote administration, and separate email servers where appropriate.⁸

The ECP must address technical security controls drawn from NIST Special Publication 800-53, including identification and authentication, least-privilege access control, audit logging and monitoring, configuration management, incident response, and physical protection. Any configuration change that would allow additional sharing of IT resources with foreign affiliates requires DCSA approval before implementation. Maintenance personnel on covered systems must be U.S. citizens under direct contract with the company.⁸

Visitation Plan and Situational Plans

The Visitation Plan governs contact between the domestic company’s personnel and representatives of foreign affiliates. Any deviation from the SSA’s visitation requirements needs DCSA’s written approval in advance. If the GSC sets a required advance notice period for visit requests, that period must be documented and filed with DCSA.⁷

Two more plans may apply depending on the situation. An Affiliated Operations Plan is required whenever the company enters into operational relationships with foreign affiliates such as shared services, and each shared service has to be individually documented with a description, risk assessment, and mitigation procedures. A Facilities Location Plan is required when the company operates in close physical proximity to a foreign affiliate — the same building, campus, or adjoining space — in a way that could compromise compliance with the SSA.⁷

Ongoing Compliance and Reporting

An SSA is not a set-and-forget arrangement. The compliance load is continuous.

Annual Compliance Report

On each anniversary of the SSA’s effective date, the company’s CEO and the GSC chairman jointly submit an implementation and compliance report to DCSA. The report must describe how the company carried out its obligations, document any changes to security procedures and why they were made, disclose any acts of noncompliance (accidental or deliberate) with the steps taken to prevent recurrence, describe changes in key management, and give a chronological summary of all transfers of classified or export-controlled information to foreign affiliates along with the government authorization relied on for each transfer.⁹

The report must confirm that all records concerning visits and communications between the company and its foreign affiliates have been reviewed and are in order. Any issues bearing on the SSA’s effectiveness, including attempts by affiliates to influence company management, must be disclosed.

Annual Meeting and Certifications

Representatives of DCSA, the board, the CEO, CFO, Facility Security Officer, and Technology Control Officer must meet at least once a year to review the SSA’s purpose and effectiveness.⁹ Additional meetings can be called when circumstances require.

Three groups execute annual certifications reaffirming their obligations. GSC members certify upon appointment and at each annual meeting with DCSA. Cleared officers certify on the effective date and each anniversary. Inside directors certify before the effective date and on each anniversary. These certifications create a documented record that every person in a position of influence has personally acknowledged the security requirements binding them.

What Happens if the Company Falls Out of Compliance

Failing to meet SSA obligations carries real consequences. A company that does not maintain its mitigation measures, or that fails to report changes in foreign ownership or control to DCSA, risks an adverse impact on its facility security clearance.¹⁰ A company determined to be under FOCI is ineligible for a facility clearance until the FOCI factors have been favorably resolved.

Losing the facility clearance does not just stop one contract. It disqualifies the company from bidding on or performing any classified work. Employees holding personal clearances through the company may see those suspended or transferred. The GSC also has an affirmative duty to ensure the company complies with U.S. export control laws, and export control violations discovered during compliance reviews can trigger separate civil and criminal enforcement by other federal agencies. Deliberately false information on the SF 328 or elsewhere in the process is a federal crime punishable by up to five years’ imprisonment.⁶

How CFIUS Review Fits Alongside the SSA

Foreign acquisitions of U.S. defense contractors often trigger two separate reviews: a FOCI review by DCSA and a national security review by the Committee on Foreign Investment in the United States, which sits at the Treasury Department. CFIUS reviews transactions that could result in foreign control of a U.S. business when national security implications are present.¹¹

The two reviews overlap but answer different questions. CFIUS weighs whether to allow the acquisition itself, block it, or impose conditions. The DCSA FOCI process addresses whether and how the company can hold a facility clearance after closing. The reviews can run in parallel, but they often move at different speeds; CFIUS review is generally shorter, while FOCI mitigation and any associated NIDs can take considerably longer. Federal rules direct DCSA to prioritize FOCI review when a CFIUS review is underway, and DCSA must keep CFIUS updated on the status of mitigation.

A common structural move for companies going through both reviews is to create a cleared subsidiary specifically for classified work. The SSA then applies only to that subsidiary, so the foreign acquirer can keep broader control over the non-classified commercial business while FOCI mitigation is limited to the entity that actually handles classified information. Acquirers facing both reviews should plan for parallel legal and consulting workstreams, because each process requires different submissions, different timelines, and coordination with different federal agencies.

1
Defense Counterintelligence and Security Agency. Mitigation Agreements
2
eCFR. 32 CFR 117.11 – Foreign Ownership, Control, or Influence (FOCI)
3
Center for Development of Security Excellence. Industrial Security Oversight (IS184) Student Guide
4
Defense Counterintelligence and Security Agency. National Interest Determinations
5
U.S. Nuclear Regulatory Commission. SF-328, Certificate Pertaining to Foreign Interests
6
Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally
7
Defense Counterintelligence and Security Agency. FOCI Action Planning and Implementation
8
Defense Counterintelligence and Security Agency. Electronic Communications Plan Template
9
Defense Counterintelligence and Security Agency. Special Security Agreement Template
10
Defense Counterintelligence and Security Agency. Foreign Ownership, Control or Influence
11
U.S. Department of the Treasury. CFIUS Frequently Asked Questions