FOCI governance, plans and limited clearances

← All Insights

1. Limited clearances for entities under FOCI

The National Industrial Security Program Operating Manual (NISPOM), 32 CFR part 117, allows a narrow alternative where foreign ownership, control or influence (FOCI) is not mitigated or negated. A limited entity eligibility determination may be an option for a single, narrowly defined contract, agreement or circumstance (32 CFR 117.11(e)). The access limits apply to all the entity’s employees regardless of citizenship.

In exceptional circumstances, the cognizant security agency (CSA) may decide a limited determination is appropriate when the entity is unable or unwilling to implement mitigation (32 CFR 117.11(e)(1)). It must be consistent with national security interests, and a government contracting activity (GCA) must have told the CSA that access is essential to performance (32 CFR 117.11(e)(1)(i)). There must be an industrial security agreement with the government of the country from which the FOCI derives (32 CFR 117.11(e)(1)(ii)).

The contractor must meet all other eligibility requirements, except that key management personnel other than the facility security officer (FSO) may be citizens of that country (32 CFR 117.11(e)(1)(iii)). The United States must have obtained security assurances at the appropriate level from that country.

2. Limits on the limited clearance

A foreign government may sponsor a U.S. subsidiary of a foreign entity for a limited determination when it wants to award a contract involving only classified information for which it is the original classification authority (32 CFR 117.11(e)(2)). Each limited determination is specific to the requesting GCA or foreign government and the single contract, agreement or circumstance behind it (32 CFR 117.11(e)(3)). It is verified only to that requester, with its authorized level and limits.

A limited determination is not an option where a foreign government owns or controls the entity and proscribed information is needed (32 CFR 117.11(e)(4)). Release of classified information must conform to the U.S. National Disclosure Policy (32 CFR 117.11(e)(5)). A limited determination is administratively terminated when the need ends, without affecting the contractor’s other limited determinations (32 CFR 117.11(e)(6)). Without an industrial security agreement, one may still be granted in extraordinary circumstances. There must be a compelling need consistent with national security interests, the GCA must have said access is essential to performance, and the entity then follows all provisions of the rule (32 CFR 117.11(e)(7)).

3. Who may serve as trustee, proxy holder or outside director

Trustees and proxy holders must be resident U.S. citizens who can exercise their governance and management prerogatives so that the foreign owner is effectively insulated from the entity (32 CFR 117.11(f)(1)). Outside directors must be resident U.S. citizens who can ensure the foreign owner is effectively separated from the entity’s classified work (32 CFR 117.11(f)(2)).

New appointees must be completely disinterested, with no prior involvement with the entity, its affiliates or the foreign owner (32 CFR 117.11(f)(3)). Serving in the role as part of a mitigation measure does not count as prior involvement (32 CFR 117.11(f)(5)). The CSA may consider other circumstances, such as how many boards a person sits on and for how long (32 CFR 117.11(f)(4)). All must be eligible for access at the level of the entity’s determination (32 CFR 117.11(f)(5)).

4. The government security committee

Under a voting trust, proxy agreement, special security agreement or security control agreement, the contractor establishes a permanent board committee called the government security committee (GSC) (32 CFR 117.11(g)). Unless the CSA approves otherwise, it consists of the trustees, proxy holders or outside directors and the cleared officer directors (32 CFR 117.11(g)(1)). Its members ensure the contractor follows laws and regulations and keeps internal policies to safeguard classified information, and that violations are promptly investigated and reported (32 CFR 117.11(g)(2)).

The FSO is the principal advisor to the GSC and attends its meetings (32 CFR 117.11(g)(3)). The GSC chairman must concur in the appointment and replacement of FSOs selected by management. FSO functions are carried out under the GSC’s authority.

5. Supplementary plans

The entity may have to document additional procedures in supplements to the mitigation agreement, so they can change without renegotiating the whole agreement (32 CFR 117.11(h)). The CSA does not treat the measure as final until it approves the required supplements. A technology control plan prescribes the measures needed to prevent access by non-U.S. citizen employees and visitors to information they are not authorized to see (32 CFR 117.11(h)(1)). It limits their access to information covered by government disclosure authorization, such as an export license or technical assistance agreement, using badging, escorts, segregated work areas and indoctrination.

An electronic communications plan verifies clear technical and logical separation of communications and networks between the contractor, the foreign interest and its affiliates (32 CFR 117.11(h)(2)). It includes a network description and diagram covering firewalls, remote administration, monitoring, maintenance and separate email servers. An affiliated operations plan sets the policies for services and arrangements between the contractor and the foreign interest (32 CFR 117.11(h)(3)). A facilities location plan helps the CSA judge collocation, since a U.S. entity generally cannot be at the same address or location as its foreign parent or affiliate (32 CFR 117.11(h)(4)).

6. Annual review and certification

The CSA meets the GSC at least annually to review the purpose and effectiveness of the arrangement (32 CFR 117.11(i)(1)). The review examines compliance and noncompliance, problems in applying the arrangement, and whether controls need adjustment. One year after the agreement takes effect, and annually after that, the GSC chairman submits an implementation and compliance report (32 CFR 117.11(i)(2)).

The report describes how the contractor carries out the agreement, changes to security procedures and their reasons, and any noncompliance with the remedial steps taken. It covers changes in key management or board members, and changes in structure or ownership such as reorganizations, acquisitions, mergers or divestitures. It also covers any other issue bearing on effectiveness. The agreements themselves are covered in FOCI mitigation agreements.

Key terms

Limited determination due to FOCI	Eligibility for one contract where FOCI is not mitigated.
Outside director	A cleared, disinterested resident U.S. citizen on the board.
GSC	The government security committee of the board.
Technology control plan	The plan that keeps non-U.S. citizens from unauthorized information.
Electronic communications plan	The plan that separates networks from the foreign interest.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Governance commitments carry into daily operations. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.