The National Industrial Security Program
The US National Industrial Security Program (NISP), largely administered by the Defense Counterintelligence and Security Agency (DCSA) at the US Department of Defense (DOD), mandates requirements, restrictions and other safeguards to prevent unauthorized disclosure of classified US information, which include clearances, special security agreements and secured facilities. Any foreign acquisition of a US entity that performs on classified contracts or has access to classified US information will likely be subject to a CFIUS review, as well as a separate review by DCSA to assess the impact of the “foreign ownership, control or influence” (FOCI) on the US entity. The goal of the FOCI review is to ensure foreign buyers do not undermine US security or export controls to gain access to US critical technology or classified information.
If FOCI is found to be present, DCSA will require some kind of agreement or arrangement to mitigate foreign influence and potential access by foreign persons to classified information. Similar to CFIUS, such mitigation can range from putting in place security measures to ensure there will be no foreign access to classified information to, under a proxy agreement, requiring a fully independent board to oversee the US entity, depending on the extent of FOCI.
How the National Security Regimes Interact
DCSA FOCI review and adjudication is separate and distinct from a CFIUS review, and often conducted in parallel. NISP provides that if the contracting agency “becomes aware of a proposed transaction that should be reviewed by CFIUS, and the parties thereto do not file a joint voluntary notice with CFIUS to initiate review within a reasonable time, the [contracting agency] shall initiate action to have CFIUS notified.”