Mitigation

As discussed above, CFIUS also has the authority to negotiate mitigation agreements to resolve identified national security threats presented by a transaction. Elements of such mitigation agreements range from prohibitions on transfers of sensitive technologies to protections for US customer data and restrictions on physical and logical access to sensitive US facilities, networks and systems. Recently imposed mitigation measures include the following:

  • Prohibiting or limiting the transfer or sharing of certain intellectual property, trade secrets or technical information;

  • Establishing guidelines and terms for handling existing or future contracts with the US government or its contractors, customer details and other sensitive information;

  • Requiring that only authorized persons have access to certain technology, systems, facilities or sensitive information;

  • Requiring that certain facilities, equipment and operations are located only in the United States; 

  • Requiring prior notification to and non-objection by the US Government regarding changes to data storage locations; 

  • Restricting recruitment and hiring of certain personnel;

  • Establishing a corporate security committee, voting trust and other mechanisms to limit foreign influence and ensure compliance, including the appointment of a US government-approved security officer and/or member of the board of directors and requirements for security policies, annual reports and independent audits; 

  • Requiring notification and approval of security officers, third-party monitors, or relevant US government parties in advance of visits to the U.S. business by foreign nationals;

  • Requiring security protocols to ensure the integrity of products or software sold to the US government;

  • Notifying customers or relevant US government parties when there is a change of ownership in the US business;

  • Requiring assurances of continuity of supply to the U.S. Government for defined periods, notification and consultation prior to taking certain business decisions, and reservation of certain rights for the US government in the event that the company decides to exit a business line;

  • Establishing meetings to discuss business plans that might affect US government supply or raise national security considerations;

  • Exclusion of certain sensitive US assets from the transaction;

  • Requiring that only authorized vendors supply certain products or services;

  • Requiring prior notification to and approval by relevant US government parties in connection with any increase in ownership or rights by the foreign acquirer; and, 

  • Divestiture by the foreign acquirer of all or part of the US business.