- Industrial Security
- Field Operations
- Foreign Ownership, Control or Influence (FOCI)
- - FOCI News and Updates
- - FOCI Mitigation Instruments
- - In-Process Companies
- - Foreign Acquisitions
- - Required Documentation
- - FOCI Action Plan
- - Implementation Procedures
- - National Interest Determinations
- - ODs/PHs/VTs
- - Facility Security Officers
- - DSS FOCI Conferences
- - FOCI FAQs
- - Business Analysis & Mitigation Strategy (BAMS)
- International
- Industrial Security Integration & Application (IP)
- NISP Agencies
- NISP Library
- Special Programs
FOCI FAQs
NATIONAL INDUSTRIAL SECURITY PROGRAM
DEFENSE SECURITY SERVICE (DSS)
FOREIGN OWNERSHIP, CONTROL OR INFLUENCE (FOCI)
Below are answers to the most frequently asked questions regarding US companies participating or sponsored for participation in the National Industrial Security Program. Please keep in mind that the below responses may not be all inclusive. There may be situations where additional requirements may apply. (Refer to Chapter 2, Section 3, National Industrial Security Program Operating Manual (NISPOM). (The NISPOM can be found here)
- When is a company determined to be under foreign ownership, control or influence (FOCI)?
- Can a company obtain a facility security clearance (FCL) if found to be under FOCI?
- How do you determine if a company is under FOCI?
- How often should a company submit the SF 328?
- What criterion is used in determining if a company is under FOCI?
- Can non-US citizens serve as key management personnel at the company?
- Can officers and/or directors of the foreign parent organization or one of its affiliates also serve as an officer and/or director of the cleared company?
- What are the methods in which a company can mitigate its FOCI factors, if considered to be under foreign ownership, control or influence?
- When is the Security Control Agreement used?
- What are a PA and a VTA?
- Does the PA or VTA require that the company be an economically viable business entity?
- What is the role of the Proxy Holder and Trustee?
- Does the SSA have access limitations?
- Who should initiate the NID process?
- When can a Board Resolution be used to mitigate FOCI?
- Can a company be collocated with its foreign parent organization or one of its affiliates and still be cleared through the auspices of a PA, VTA, or SSA?
- Can a company receive any administrative support services from its foreign parent or one of its affiliates?
- What should I consider when selecting a nominee for Outside Director, Proxy Holder or Trustee?
- How is the term "disinterested" defined?
- When a company submits an Outside Director, Proxy Holder or Trustee nomination, is the nominee automatically approved?
- Should the Outside Director, Proxy Holder and Trustee be appointed to serve as a member of the company's Board of Directors?
- How many Outside Directors, Proxy Holders or Trustees need to be nominated?
- Does DSS maintain a listing of candidates who are eligible to serve as Outside Directors, Proxy Holders or Trustees at companies operating under a SCA, SSA, PA or VTA?
- Under the SSA, who can be selected to serve as an Inside Director?
- What is the role of the Government Security Committee (GSC)?
- Who comprises the GSC?
- Who should serve as Chairman of the GSC?
- The draft SSA, PA or VTA states that the GSC members will exercise their "best efforts" to ensure that the company maintains policies and procedures to safeguard classified and export controlled information in the possession of the company. What is meant by the term "best efforts?"
- Must a Technology Control Officer (TCO) be appointed?
- What is the role of the FSO?
- Is the company required to prepare a Technology Control Plan (TCP)?
- Is the company required to prepare and submit to DSS an electronic communication plan once the Agreement has been executed?
- Once the SSA, PA or VTA is executed is the company required to prepare procedures for implementing the agreement?
- What is the Committee on Foreign Investment in the United States (CFIUS)?
- What action should a cleared company take when entering into discussions, consultations, or agreements that may reasonably lead to effective ownership or control of the company by a foreign interest?
- Where can I obtain electronic copies of the draft SCA, SSA, PA or VTA?
- Who should I contact if I have questions regarding FOCI?
- Who should I contact if I have questions regarding e-FCL?
- What does the Directive-type Memorandum 09-019, "Policy Guidance for Foreign Ownership, Control or Influence (FOCI)" mean for Industry?
- When is a company determined to be under foreign ownership, control or influence (FOCI)?
A US company is considered to be under FOCI when a foreign interest has the power, direct or indirect, whether or not exercised, to direct or decide matters affecting the management or operations of the company in a manner which may result in unauthorized access to classified information or may affect adversely the performance of classified contracts. (NISPOM, paragraph 2-300a)
Back to top - Can a company obtain a facility security clearance (FCL) if found to be under FOCI?
No. A company determined to be under FOCI is not eligible for an FCL until the FOCI factors have been favorably resolved. (NISPOM, paragraph 2-300c)
Back to top - How do you determine if a company is under FOCI?
A company's FOCI factors are reviewed as part of the facility clearance process and throughout the life of the facility security clearance. The company's FOCI factors should be documented on the Certificate Pertaining to Foreign Interests (Standard Form 328). In a corporate family, the SF 328 should be a consolidated response rather than separate submissions from individual members of the corporate family (NISPOM, paragraph 2-302). In the case of an organization with multiple tiers of parent-subsidiary relationships, the SF 328 should be certified by the highest tier cleared entity. (Note: this would not preclude a subordinate entity from preparing the form as long as the top tier cleared entity certified the form). This principle applies equally to changed condition reports. (The SF 328 and instructions can be found here).
Back to top - How often should a company submit the SF 328?
The NISPOM requires that a SF 328 be submitted during the initial facility clearance process and when significant changes occur to information previously forwarded. (NISPOM paragraph 2-302)
Back to top - What criterion is used in determining if a company is under FOCI?
The following factors are considered in the aggregate in determining whether a company is under FOCI: (NISPOM, paragraph 2-301)- Record of economic and government espionage against US targets,
- Record of enforcement and/or engagement in unauthorized technology transfer,
- Type and sensitivity of information requiring protection,
- The source, nature and extent of FOCI,
- Record of compliance with pertinent US laws, regulations and contracts,
- Nature of bilateral and multilateral security and information exchange agreements, and
- Ownership or control, in whole or in part, by a foreign government.
Back to top
- Can non-US citizens serve as key management personnel at the company?
No. Key Management Personnel are required to be processed for a personnel security clearance in conjunction with the FCL. non-US citizens are not eligible for a personnel security clearance. (NISPOM, paragraph 2-104)
Back to top - Can officers and/or directors of the foreign parent organization or one of its affiliates also serve as an officer and/or director of the cleared company?
No. There can be no interlocking relationships under the Proxy Agreement (PA) and Voting Trust Agreement (VTA). However, under the Special Security Agreement (SSA), the foreign shareholder can appoint a representative(s) (referred to in the SSA as the "Inside Director") to the company's board of directors consistent with the requirements of the board composition identified in Article 1.01 of the DSS draft SSA. Other than the Inside Director position(s), there can be no other interlocking relationships. Back to top - What are the methods in which a company can mitigate its FOCI factors, if considered to be under foreign ownership, control or influence?
The SSA, PA or VTA is used to mitigate FOCI in cases where companies are effectively owned or controlled by a foreign entity.
Back to top - When is the Security Control Agreement used?
The SCA is used when a company is not effectively owned or controlled by a foreign interest and the foreign interest is entitled to representation on the company's board of directors. There are no access limitations under the SCA. (NISPOM, paragraph 2-303c(1))
Back to top - What are a PA and a VTA?
The PA and the VTA are substantially identical arrangements whereby the voting rights of the foreign shareholder are transferred to cleared US citizens approved by DSS. Both Agreements provide for the exercise of all prerogatives of ownership by the Trustees or Proxy Holders with complete freedom to act independently from the foreign stockholder, with the exception of the areas identified in NISPOM, paragraph 2-305. Neither Agreement imposes restrictions on access to classified information or restricts the company's ability to compete for classified contracts. (NISPOM, paragraph 2-303b)
Back to top - Does the PA or VTA require that the company be an economically viable business entity?
Yes. The company must demonstrate that it is organized, structured and financed so as to be capable of operating as a viable business entity independent from the foreign shareholder. (NISPOM, paragraph 2-303b(2))
Back to top - What is the role of the Proxy Holder and Trustee?
Individuals who serve as Voting Trustees or Proxy Holders must be US citizens, residing within the US and eligible for a personnel security clearance. They must be capable of assuming full responsibility for voting the stock and exercising management prerogatives relating to the company in a way that ensures that the foreign shareholder can be effectively insulated from the cleared company. The Proxy Holders or Trustees are required to be appointed to the company's Board of Directors and they have the same fiduciary responsibilities as any other Board member.
Back to top - Does the SSA have access limitations?
Yes. Classified contracts requiring access to proscribed information (Top Secret, Communications Security, Sensitive Compartmented Information, Special Access Program information and Restricted Data) may require the government contracting activity to render a favorable National Interest Determination (NID) consistent with NISPOM, paragraph 2-303c(2).
Back to top - Who should initiate the NID process?
Defense Security Service (DSS) will advise the government contacting activity (GCA) of the requirement for a NID. The NID can be program, project or contract specific. The NID decision shall be made by the GCA's Program Executive Office. The GCA will forward the completed NID to DSS. DSS does not need to delay implementation of a FOCI action plan pending completion of a GCA's NID as long as there is no indication the NID will be denied.
Back to top - When can a Board Resolution be used to mitigate FOCI?
A board resolution is used when a foreign entity does not own voting stock sufficient to elect directors, or is not otherwise entitled to representation to the company's board of directors. (NISPOM, paragraph 2-303a)
Back to top - Can a company be collocated with its foreign parent organization or one of its affiliates and still be cleared through the auspices of a PA, VTA, or SSA?
No, FOCI collocation is not authorized, and DSS will determine when a company is collocated in its sole discretion. When a company is located within close proximity to its foreign parent or an affiliate a Facilities Location Plan (FLP) must be approved by DSS in advance. Download the Facilities Location Plan Template.
Back to top - Can a company receive any administrative support services from its foreign parent or one of its affiliates?
As a general rule, no, and not without prior approval from DSS. However, if the company determines that there is a specific service(s) that the company needs the parent or one of its affiliates to provide, the company should identify the service and forward a rationale/justification to DSS for consideration.
Back to top - What should I consider when selecting a nominee for Outside Director, Proxy Holder or Trustee?
The nominee must be a US citizen, residing in the US, who can exercise management prerogatives relating to their position in a way that ensures that the foreign owner can be effectively insulated from the company and be eligible for a personnel security clearance consistent with the level of the FCL, (NISPOM, paragraph 2-305)
Back to top - How is the term "disinterested" defined?
The term "disinterested" is defined as having no prior contractual, financial, or employment relationship with the applicant company, the parent corporation, the foreign shareholder(s), or any entities and affiliates that the applicant company controls. The application of the term "disinterested" extends to members of the nominee's immediate family. (NISPOM, paragraph 2-305b)
Back to top - When a company submits an Outside Director, Proxy Holder or Trustee nomination, is the nominee automatically approved?
No. DSS must approve the nomination, and approval is granted only after DSS has reviewed and considered the nominee's resume and the answers to a questionnaire that the nominee will be asked to complete. A copy of each nominee's resume should be provided to DSS Headquarters along with his/her address, telephone, fax number, and email address when requesting approval.
Back to top - Should the Outside Director, Proxy Holder and Trustee be appointed to serve as a member of the company's Board of Directors?
Yes, once DSS approves the nomination. In addition to ensuring that the company has appropriate policies and procedures in place to ensure the company's compliance with the Agreement, the Outside Director, Proxy Holder and Trustee are required to be appointed to the Board of Directors and to be granted the same fiduciary responsibilities as any other Board member.
Back to top - How many Outside Directors, Proxy Holders or Trustees need to be nominated?
The SSA, PA and VTA require the appointment of three Outside Directors, Proxy Holders or Trustees. However, if a company finds that less than three Outside Directors, Proxy Holders or Trustees may be sufficient, full justification should be submitted to DSS HQs for consideration.
Back to top - Does DSS maintain a listing of candidates who are eligible to serve as Outside Directors, Proxy Holders or Trustees at companies operating under a SCA, SSA, PA or VTA?
No. DSS does not maintain a listing of candidates. Companies are responsible for determining who they wish to nominate to serve in this capacity. It may be helpful to contact industry associations such as the National Classification Management Society (NCMS), Aerospace Industries Association (AIA), the American Society for Industrial Security (ASIS) or your local or state chamber of commerce in determining eligible candidates.
Back to top - Under the SSA, who can be selected to serve as an Inside Director?
The nomination of an Inside Director is left to the discretion of the foreign shareholder. However, keep in mind that the Inside Director will not possess a personnel security clearance at the cleared company in which he/she serves as the Inside Director.
Back to top - What is the role of the Government Security Committee (GSC)?
The role of the GSC is to ensure that the Company maintains policies and procedures to safeguard classified information and controlled unclassified information in the possession of the Company and that violations of those policies and procedures are promptly investigated and reported to the appropriate authority when it has been determined that a violation has occurred. The GSC should also ensure that the company complies with US export control laws and regulations and does not take action deemed adverse to performance on classified contracts. (NISPOM paragraph 2-306)
Back to top - 26. Who comprises the GSC?
Under the SSA, the GSC is comprised of cleared officers/directors and the Outside Directors. Under a PA and VTA, the GSC is comprised of the Proxy Holder or Trustee Directors and those officers of the company, who are also directors, who hold personnel security clearances at the level of the company's FCL.
Back to top - Who should serve as Chairman of the GSC?
One of the Outside Directors, Proxy Holders or Trustees should serve as the Chairman of the GSC.
Back to top - The draft SSA, PA or VTA states that the GSC members will exercise their "best efforts" to ensure that the company maintains policies and procedures to safeguard classified and export controlled information in the possession of the company. What is meant by the term "best efforts?"
The term "best efforts" signifies performance of duties reasonably and in good faith, in the manner believed to be in the best interests of the company, but consistent with the national security concerns of the US, and with such care, including reasonable inquiry, as an ordinarily prudent person in a like position would use under similar circumstances.
Back to top - Must a Technology Control Officer (TCO) be appointed?
Yes. The company must appoint a TCO. The TCO serves as the principal advisor to the GSC concerning the protection of controlled unclassified information and other proprietary technology and data subject to regulatory or contractual control by the US Government. The TCO can be the same individual serving as Facility Security Officer (FSO).
Back to top - What is the role of the FSO?
Every cleared company must appoint a FSO. The FSO serves as the principal advisor to the GSC concerning the safeguarding of classified information. The FSO's responsibility includes the operational oversight of the company's compliance with the requirements of the NISP.
Back to top - Is the company required to prepare and submit to DSS a technology control plan once the Agreement has been executed?
Yes. The draft TCP should be provided to your servicing DSS, Industrial Security Representative within 45 days of the effective date of the SSA, PA or VTA for approval. (NISPOM, paragraph 2-307)
Back to top - Is the company required to prepare and submit to DSS an electronic communication plan once the Agreement has been executed?
Yes. The draft electronic communication plan should be submitted to your servicing DSS Industrial Security Representative for review within 45 days of the effective date of the agreement. The plan should provide procedures that will ensure the GSC and the Government that no classified or export controlled information is being lost through communications such as, email, telephone, video-teleconferencing, facsimile, etc.
Back to top - Once the SSA, PA or VTA is executed is the company required to prepare procedures for implementing the agreement?
Once the Agreement has been executed; the company should submit a written plan for implementation of the Agreement to your servicing DSS, Industrial Security Representative within 45 days for review. The plan should explain the administrative and physical security controls the company intends to implement in order to comply with the terms of the Agreement. The Industrial Security will review the plan and provide comments as necessary.
Back to top - What is the Committee on Foreign Investment in the United States (CFIUS)?
CFIUS is an interagency committee chaired by the Secretary of the Treasury to conduct reviews of proposed mergers, acquisitions or takeovers of US persons by foreign interests under section 721 of the Defense Production Act. CFIUS is a voluntary process that affords an opportunity to foreign persons and US persons entering into a covered transaction to submit the transaction for review by CFIUS to assess the impact of the transaction on US national security.
The CFIUS and the DSS industrial security FOCI review are carried out in two parallel but separate processes with different time constraints and considerations.
Back to top - What action should a cleared company take when entering into discussions, consultations, or agreements that may reasonably lead to effective ownership or control of the company by a foreign interest?
The company should notify DSS of the details in writing. (NISPOM, paragraph 2-302(b). The failure to report this information to DSS could result in an adverse impact on the company's facility security clearance. The company should advise DSS, initially by telephone and then follow-up in writing.
Back to top - Where can I obtain electronic copies of the draft SCA, SSA, PA or VTA?
An electronic draft copy of the Agreements can be obtained on the DSS FOCI Web page.
Back to top - Who should I contact if I have questions regarding FOCI?
If you need further assistance, please contact the DSS Headquarters FOCI Specialist assigned to your region. For contacts click here.
Back to top - Who should I contact if I have questions regarding e-FCL?
For technical questions, please contact the e-FCL Help Desk at 630-252-6566 or fclserver@anl.gov. For non-technical questions please contact your Industrial Security Representative or efcl@dss.mil.
Back to top - What does the Directive-type Memorandum 09-019, "Policy Guidance for Foreign Ownership, Control or Influence (FOCI)"
mean for Industry?
September 02, 2009, The Office of the Under Secretary of Defense (Intelligence) released the Directive-type Memorandum (DTM) 09-019, "Policy Guidance for Foreign Ownership, Control or Influence (FOCI)" for DoD Components; June 8, 2010, Change 1 was incorporated.
The DTM applies to DoD Components but does not levy requirements on contractors. Cleared contractors and companies in process for a facility security clearance are required to comply with the requirements stipulated in the National Industrial Security Operating Manual.
Back to top
February 2009