FOCI Mitigation Explained: Agreements & Requirements

Foreign ownership does not automatically prevent a company from obtaining or maintaining a Facility Clearance (FCL). However, when foreign investors or affiliated entities have the ability to influence a company's operations, the government may require safeguards to protect classified information and national security interests.

These safeguards are commonly referred to as FOCI mitigation.

FOCI mitigation can range from a relatively straightforward board resolution to comprehensive agreements that establish independent security oversight and restrict foreign shareholder involvement in certain business activities.

For contractors with foreign ownership, understanding these options is important when pursuing an FCL, preparing for an acquisition, or evaluating the impact of new foreign investment.

What Is FOCI Mitigation?

FOCI stands for Foreign Ownership, Control, or Influence. Under the National Industrial Security Program (NISP), FOCI concerns arise when foreign interests have the ability to influence a company's management or operations in ways that could compromise classified information or adversely affect classified contract performance.

FOCI mitigation involves implementing government-approved safeguards to address those risks.

These safeguards are designed to separate foreign ownership interests from security-sensitive decisions, prevent unauthorized access to protected information, and establish appropriate oversight of the cleared company.

The appropriate mitigation measures depend on several factors, including:

• The percentage of foreign ownership
• Voting rights and corporate governance arrangements
• Foreign representation on the board of directors
• Relationships with foreign parent companies and affiliates
• The degree of foreign influence over management decisions
• The sensitivity of the classified information involved

A minority foreign investment may require relatively limited measures, while a company effectively controlled by a foreign parent may need a more comprehensive arrangement.

For a broader introduction, see our article, What Is FOCI? A Practical Guide for Government Contractors.

When Is FOCI Mitigation Required?

FOCI mitigation is generally considered when DCSA determines that foreign ownership, control, or influence must be addressed before a company can obtain or maintain an FCL.

Companies may encounter these requirements when:

• Applying for an FCL
• Being acquired by a foreign company
• Accepting significant foreign investment
• Changing their board or voting structure
• Restructuring foreign parent or affiliate relationships
• Reporting changes to previously disclosed foreign interests

Not every foreign investment results in a formal mitigation agreement. DCSA evaluates the circumstances and determines whether the identified risks require additional safeguards.

For companies already holding an FCL, potential changes in foreign ownership or control should be reported to DCSA as required, including when discussions or agreements may reasonably lead to effective foreign control.

Early coordination is important. A transaction that changes ownership or governance can have consequences for an existing clearance even if the company's classified contracts remain unchanged.

The Four Main Types of FOCI Mitigation Agreements

DCSA uses several mitigation instruments to address different levels of foreign ownership and control.

1. Board Resolution

A Board Resolution may be appropriate when a foreign investor holds an ownership interest but does not have sufficient voting power or other rights to appoint representation to the company's governing board.

For example, a foreign investor may own a minority percentage of a company without possessing board appointment rights or meaningful control over management decisions.

A Board Resolution establishes restrictions intended to prevent the foreign interest from obtaining unauthorized access to classified information or exercising improper influence over classified operations.

This is generally less complex than mitigation agreements requiring independent directors or a Government Security Committee.

2. Security Control Agreement (SCA)

A Security Control Agreement may be appropriate when a foreign investor is entitled to representation on the company's board but does not effectively own or control the business.

An SCA establishes additional security safeguards and oversight mechanisms to address the influence associated with foreign board representation.

Requirements may include:

• A Government Security Committee (GSC)
• Cleared U.S. citizen directors responsible for security oversight
• A Technology Control Plan (TCP)
• An Electronic Communications Plan (ECP)
• Controls governing foreign affiliate interactions
• Periodic compliance reviews and reporting

Under DCSA's framework, an SCA does not impose the same classified-information access limitations associated with an SSA.

3. Special Security Agreement (SSA)

A Special Security Agreement may be used when a company is effectively owned or controlled by a foreign interest.

An SSA allows the foreign owner to retain certain ownership and governance rights while establishing safeguards intended to prevent unauthorized access to classified and export-controlled information.

The agreement typically requires independent U.S. citizen Outside Directors, a GSC, and additional security procedures.

Companies operating under an SSA may also face restrictions involving certain categories of classified information.

For access to proscribed information, including Top Secret, SCI, SAP, COMSEC, or Restricted Data, a favorable National Interest Determination (NID) may be required from the appropriate government authority.

An SSA can therefore preserve foreign ownership while introducing additional governance and compliance obligations.

4. Proxy Agreement or Voting Trust Agreement

Proxy Agreements and Voting Trust Agreements are among the most comprehensive FOCI mitigation arrangements.

These instruments may be used when a foreign entity effectively owns or controls a company and stronger separation between the foreign shareholder and the cleared company's management is necessary.

Under a Proxy Agreement, approved U.S. citizen Proxy Holders exercise the voting rights associated with the foreign-owned shares, subject to limited reserved matters.

A Voting Trust Agreement operates similarly but involves transferring legal title to the shares to approved trustees.

Both arrangements are intended to provide the cleared company with independent management and security oversight.

Unlike an SSA, these arrangements do not impose FOCI-based limitations on the company's eligibility to access proscribed classified information.

The tradeoff is that the foreign owner relinquishes substantial control over ordinary corporate management decisions.

For official descriptions and sample instruments, see DCSA's FOCI Mitigation Agreements guidance.

Comparing FOCI Mitigation Options

The following table summarizes the general differences between the primary mitigation instruments.

These descriptions are general. DCSA determines the appropriate mitigation instrument based on the company's circumstances, and individual agreements may contain additional requirements.

What Is a Government Security Committee?

A Government Security Committee, or GSC, is a board-level committee responsible for overseeing security matters at certain FOCI-mitigated companies.

The GSC generally includes cleared U.S. citizen directors who are responsible for ensuring that the company maintains required safeguards and complies with its mitigation agreement.

Depending on the agreement, the GSC may oversee:

• Protection of classified and export-controlled information
• Interactions with foreign parent companies and affiliates
• Technology and information access controls
• Implementation of security plans and procedures
• Compliance reviews and required certifications
• Reporting and coordination with DCSA

The Facility Security Officer (FSO) and Technology Control Officer (TCO) typically serve as advisors to the GSC.

The GSC is not simply an administrative formality. It plays an active role in overseeing compliance and ensuring that foreign interests do not exercise prohibited influence over security-sensitive operations.

What Ongoing Compliance Requirements Come With FOCI Mitigation?

One of the most important considerations for foreign-owned contractors is that FOCI mitigation is an ongoing compliance responsibility, not a one-time approval.

Companies operating under an SCA, SSA, Proxy Agreement, or Voting Trust Agreement may need to develop and maintain several supporting plans.

Technology Control Plan (TCP)

Establishes procedures to prevent unauthorized access to classified and export-controlled information, including controls involving foreign affiliates and non-U.S. citizens.

Electronic Communications Plan (ECP)

Addresses electronic communications between the cleared company and its foreign affiliates, including oversight of information exchanges and communications systems.

Affiliated Operations Plan (AOP)

Documents proposed business relationships or shared services involving foreign affiliates, such as IT support, administrative functions, personnel, or other operational arrangements requiring government approval.

Visitation Plan

Establishes procedures for visits and interactions involving foreign affiliates and their representatives.

Companies may also be subject to annual compliance reviews, certifications, GSC meetings, and additional DCSA oversight.

The precise obligations depend on the mitigation instrument and the company's approved plans.

DCSA provides further details through its FOCI Action Planning and Implementation guidance.

How Long Does FOCI Mitigation Take?

There is no single timeline for completing FOCI mitigation.

A relatively straightforward ownership review may require substantially less coordination than negotiating and implementing an SSA, Proxy Agreement, or Voting Trust Agreement.

Factors that can affect the process include:

• Complexity of the ownership structure
• Availability and accuracy of corporate documentation
• Required changes to board composition
• Clearance eligibility of proposed directors or trustees
• Negotiation and approval of mitigation instruments
• Preparation of required security plans
• Government review and coordination

Companies contemplating foreign investment or acquisition should consider these requirements during transaction planning rather than waiting until a clearance issue arises.

The same applies to contractors pursuing classified work for the first time. Understanding potential FOCI concerns before or early in the FCL process can help avoid preventable delays.

For additional context, read Can a Foreign-Owned Company Win U.S. Government Contracts?.

Does Section 847 Require FOCI Mitigation?

Section 847 of the FY2020 NDAA addresses foreign ownership risks associated with certain DoD procurements, including covered unclassified contracts.

However, contractors should distinguish Section 847 foreign ownership reviews from the formal FOCI mitigation arrangements used under the NISP.

The May 2026 proposed DFARS rule addresses disclosure and review procedures for covered contracts and subcontracts exceeding $5 million, subject to applicable exceptions.

A foreign ownership disclosure or review under Section 847 does not automatically mean a contractor must enter into an SSA, Proxy Agreement, or another traditional DCSA mitigation instrument.

The applicable requirements depend on the procurement, the government's assessment, and the implementing rules.

Related article: NDAA Section 847 Explained: What Government Contractors Need to Know [Link when published]

How Can Contractors Prepare for FOCI Mitigation?

Companies facing potential FOCI concerns should begin by developing a clear picture of their ownership and governance arrangements.

Practical preparation steps include:

1. Document the ownership structure. Identify direct and indirect owners, parent entities, voting rights, and board appointment rights.
2. Review corporate governance documents. Examine operating agreements, shareholder agreements, bylaws, and related provisions that may establish foreign control.
3. Identify foreign affiliate relationships. Evaluate shared personnel, systems, services, and operational dependencies.
4. Prepare accurate disclosures. Ensure that ownership information and SF-328 responses are complete and consistent.
5. Evaluate operational implications. Consider whether potential mitigation requirements could affect management, IT systems, facilities, or affiliate relationships.
6. Coordinate with appropriate specialists. FOCI consultants can assist with operational assessments and implementation, while legal counsel may be needed for transaction documents or mitigation agreement negotiations.

For companies beginning the disclosure process, the SF-328 is often an important starting point.

Related article: How to Complete the SF-328: A Step-by-Step Guide [Link when published]

Getting Help With FOCI Mitigation

FOCI mitigation can allow foreign-owned companies to participate in classified government contracting while protecting national security interests. However, the requirements can introduce significant operational, governance, and compliance responsibilities.

The most effective approach begins with understanding the company's ownership structure, identifying applicable requirements, and developing a practical plan for addressing them.

Industry FSO provides support with FOCI assessments, SF-328 disclosures, mitigation planning, DCSA coordination, and ongoing compliance. Our team works with contractors and, when appropriate, their legal counsel to help implement and maintain required security measures.

Learn more about our FOCI consulting services or contact Industry FSO to discuss your company's foreign ownership and mitigation requirements.