What Is Foreign Ownership, Control, or Influence (FOCI)?

A U.S. company is under foreign ownership, control, or influence when a foreign entity holds enough power to direct decisions affecting the company’s management or operations in ways that could expose classified information or compromise classified contracts. The Defense Counterintelligence and Security Agency (DCSA) makes that determination under the National Industrial Security Program Operating Manual, codified at 32 CFR Part 117.¹ Once DCSA identifies a FOCI concern, the company has two paths: negotiate a mitigation agreement that walls the foreign influence off from classified work, or lose the ability to hold a facility security clearance.²

The label matters because a facility clearance is often the gate to classified defense work. A company that cannot hold one cannot perform on classified contracts, and for defense-focused firms that can shut down a major revenue stream.

What DCSA Looks At

DCSA analysts don’t rely on a single indicator. The regulation requires them to weigh all relevant factors together to decide whether a company is under FOCI, whether it can access classified information, and what protections are needed. The factors in 32 CFR 117.11 include:³

Whether the foreign government has a record of economic or government-targeted espionage against the United States.
Whether the company has faced enforcement actions for transferring controlled technology without authorization.
How well the company has followed U.S. laws, regulations, and contractual obligations.
The type and classification level of information the company would access.
The extent of foreign ownership, traced through immediate, intermediate, and ultimate parent entities.
Whether relevant security or information-sharing agreements exist between the U.S. and the foreign government.
Whether a foreign government directly or indirectly owns or controls the company.
Any other factor that shows a foreign interest’s ability to influence the company.

Context changes the weight of any single fact. A 5% foreign ownership stake typically draws less concern than a 5% stake paired with board representation, large foreign-sourced debt, and foreign nationals in key executive roles. Companies approaching a facility clearance application should map their entire ownership chain and financial relationships before filing. Gaps in self-awareness create delays.

How Foreign Interests Get Disclosed: The SF 328

Standard Form 328, the Certificate Pertaining to Foreign Interests, is the disclosure document every company must complete as part of the facility clearance process.⁴ DCSA updated the form in 2025 to reach further into private equity and venture capital fund structures, foreign academic relationships involving software research and intellectual property, foreign loans, and gifts or funding tied to endowments and grants.⁵

The form asks for detailed answers about stock ownership and the identity of foreign stockholders, the citizenship and foreign ties of officers and directors, and any contracts or agreements with foreign interests that could affect company management. Preparing it well means running a genuine internal audit. You need a comprehensive organizational chart tracing every parent company and subsidiary back to the ultimate beneficial owner, plus financial statements showing any debt instruments held by foreign lenders.

The SF 328 is not filed on a set calendar. A new submission is required when the company seeks an initial facility clearance or an upgrade, reports a change in foreign ownership or influence, reports a new excluded parent entity, or renews a mitigation agreement.⁵ Waiting for an annual cycle to disclose a material ownership change is not an option.

The Five Mitigation Agreements

When DCSA determines that foreign influence is significant, the company and the government negotiate a mitigation agreement. The type depends on how much control the foreign interest holds. Each adds progressively more restrictions and oversight.

Board Resolution

This is the lightest tool. It applies when a foreign entity owns stock but doesn’t hold enough voting power to seat a board representative. The company’s board formally resolves to exclude the foreign owner from any access to classified information or influence over classified work.⁶

Security Control Agreement

A Security Control Agreement (SCA) applies when the foreign interest is entitled to board representation but does not effectively own or control the company. At least one Outside Director who is a cleared U.S. citizen must be appointed to the board, and the Outside Directors oversee the security program. A practical advantage: an SCA imposes no restrictions on the categories of classified information the company can access.²

Special Security Agreement

A Special Security Agreement (SSA) is used when the foreign interest effectively owns or controls the U.S. company.⁶ It requires multiple Outside Directors and stricter controls. The foreign owner keeps its investment value but is legally barred from controlling classified operations. An SSA also limits access to certain categories of classified information. Working with Top Secret material, Sensitive Compartmented Information, Special Access Programs, Communications Security material, or Restricted Data first requires a National Interest Determination confirming that release to the company won’t harm national security.⁷ That is one of the most significant practical differences between an SCA and an SSA.

Voting Trust and Proxy Agreement

These are the most restrictive and are functionally similar. Under a Voting Trust, the foreign owner transfers legal title of its stock to DCSA-approved U.S. citizen trustees. Under a Proxy Agreement, the foreign owner transfers voting rights to approved proxy holders. In both cases, the trustees or proxy holders exercise ownership prerogatives with complete independence from the foreign stockholders.⁶ The foreign owner effectively loses all management control and voting power.

Who Serves as Outside Director, Proxy Holder, or Trustee

Qualifications are strict. Outside Directors, proxy holders, and trustees must be resident U.S. citizens who can effectively separate the foreign owner from classified work. New appointees must be completely disinterested individuals with no prior involvement with the company, its affiliates, or the foreign owner, and they must hold a security clearance at the level of the company’s facility clearance.² DCSA also looks at how many other boards a candidate already sits on, because overcommitted directors can’t provide the active oversight these roles demand.

Life After the Agreement Is Signed

Getting a mitigation agreement in place is not the finish line. Companies operating under a Voting Trust, Proxy Agreement, SSA, or SCA carry ongoing obligations for the life of the agreement, starting with a permanent Government Security Committee (GSC) inside the board of directors.

The GSC is the internal watchdog. It typically includes the trustees, proxy holders, or Outside Directors alongside any officer directors who hold security clearances. Its members make sure the company follows applicable laws and regulations, maintain policies to protect classified information, and investigate and report security violations when they occur. The company’s Facility Security Officer serves as the GSC’s principal advisor and attends every GSC meeting, and the GSC chairman must approve any appointment or replacement of the FSO.² The structure keeps the security program reporting up through cleared U.S. citizens rather than through the foreign ownership chain.

One year after the mitigation agreement takes effect, and each year after that, the GSC chairman must submit an annual implementation and compliance report to DCSA. The report describes how the company is meeting its obligations, documents any changes to security procedures, and details every act of noncompliance, whether accidental or deliberate, along with corrective action taken. Changes or upcoming changes to key management personnel, board members, or organizational structure also must be disclosed.²

DCSA also meets at least once a year with the GSC at the company’s location. The meeting runs in two parts: DCSA first meets privately with the Outside Directors, proxy holders, or trustees, then reconvenes with the full board, GSC members, key management, and the FSO.⁸ The split lets DCSA have a candid conversation with the cleared independent members before the wider group joins. Topics include the annual compliance report, current and future classified contracts, and any pending National Interest Determinations.

What Happens If a Company Won’t Comply

DCSA does not treat FOCI violations as paperwork problems. The agency reserves the right to impose whatever security measures it considers necessary to prevent unauthorized access to classified information, up to denying, terminating, or revoking a company’s facility clearance.² Revocation ends classified work.

Even short of that, the annual compliance cycle creates accountability. Patterns of noncompliance signal to DCSA that the mitigation agreement isn’t working, which can lead to tightened restrictions or termination. A company that proves unable or unwilling to negotiate and implement an acceptable mitigation measure will have its facility clearance invalidated.²

FOCI Is Not CFIUS

Companies working through foreign acquisitions often bump into both processes and assume clearing one clears the other. It doesn’t. The DCSA FOCI process and a Committee on Foreign Investment in the United States (CFIUS) review operate under independent legal authorities with different timelines and considerations.⁹

CFIUS reviews whether a transaction involving foreign investment threatens national security broadly. Filings can be voluntary or mandatory. Mandatory declarations are triggered when a transaction involves a foreign government acquiring a substantial interest in a business that deals with critical technologies, critical infrastructure, or sensitive personal data, or when the business produces or designs critical technology subject to export controls.¹⁰ When both processes run at once, DCSA is notified of the CFIUS filing and evaluates the proposed FOCI mitigation plan for any facility under its cognizance. If the FOCI process hasn’t started or isn’t finished when a CFIUS notice is filed, DCSA prioritizes it.⁹ Planning for both tracks from the start of a transaction avoids bottlenecks that can stall an acquisition.

1
eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual (NISPOM)
2
eCFR. 32 CFR 117.11 – Foreign Ownership, Control, or Influence (FOCI)
3
eCFR. 32 CFR 117.11 – Foreign Ownership, Control, or Influence (FOCI)
4
U.S. General Services Administration. Certificate Pertaining to Foreign Interests
5
Defense Counterintelligence and Security Agency. Updated SF 328 – Industry Information Paper
6
Defense Counterintelligence and Security Agency. Mitigation Agreements
7
Defense Counterintelligence and Security Agency. National Interest Determinations
8
Center for Development of Security Excellence (CDSE). OD/PH Module 6 – Initial Meeting, Annual Compliance Report, and Annual Meeting Student Guide
9
Center for Development of Security Excellence (CDSE). Understanding Foreign Ownership, Control or Influence (FOCI) Student Guide
10
U.S. Department of the Treasury. CFIUS Frequently Asked Questions