FOCI is a state that may affect a company’s ability to qualify for or maintain an entity eligibility determination, also known as a Facility Security Clearance (FCL).
A U.S. company is under FOCI when a foreign person or entity has the power to direct or decide matters affecting the business’s management or operations, especially in a manner that could result in unauthorized access to certain information or may adversely affect the performance of certain contracts or the ability to influence the appointment or election of board members.
It is important for companies to be aware of any FOCI risks because being under FOCI can lead to unauthorized access to classified or proprietary information or adversely affect contract performance.
It is imperative for you to identify any areas of your business that might be under FOCI. Doing so will not only protect our national security, but it will help keep your business secure and profitable.
What are the Key Terms of Foreign, Ownership, Control, or Influence?
FOREIGN: When talking about FOCI, foreign generally refers specifically to foreign persons from a country of concern.
When the word foreign is combined with the word person, it means any foreign national, foreign entity, or any entity over which control is exercised or exercisable by a foreign entity. Any entity over which control is exercised or exercisable by a foreign person, is a foreign person.
Per the SIBR/SITTR Extenstion Act of 2022, the term foreign country of concern includes the People’s Republic of China, the Democratic People’s Republic of Korea, the Russian Federation, and the Islamic Republic of Iran. Also, any other countries deemed to be a country of concern by the U.S. Secretary of State.
OWNERSHIP: In FOCI, ownership generally refers to beneficial ownership of the business. A beneficial owner of a security – in this case a business – includes any person who directly or indirectly through any contract arrangement, understanding, relationship, or otherwise has or shares any of the following:
• Voting power, which includes the power to vote or to direct the voting of such security; or
• Investment power, which includes the power to dispose of or to direct the disposition of such security.
In this case, security just means ownership of a portion of the business. Voting power involves any decisions an owner might make about business operations, regardless of whether that power is being actively exercised.
CONTROL: Control over business decisions can come from various sources. In FOCI, covered individuals and key management personnel are the primary focus.
There are several terms that we need to cover when talking about control. First, a covered individual is someone who contributes in a substantive, meaningful way to the scientific development or execution of a research or development project proposed to be carried out with the research and development award from a Federal research agency and is designated as a covered individual by the Federal research agency concerned.
Next, key management personnel are entity officials who either hold majority interest or stock in the entity or have direct or indirect authority to influence or decide issues affecting the management or operations of the entity or classified contract performance.
Adversary and competitor nations also utilize malign foreign talent recruitment programs as a way to access key personnel and intellectual property. As defined in 42 U.S.C. § 19237, A malign foreign talent recruitment program is any program, position, or activity that includes compensation in the form of cash, in-kind compensation, research funding, etc. provided by a foreign country or their designee to the targeted individual and exchange for:
• Unauthorized transfer of intellectual property or other non-public information.
• Recruiting trainees or researchers.
• Establishing a laboratory, company, or undertaking any employment or appointment in or affiliated with the foreign country.
• Other activities that may conflict or interfere with the federal research or development award or contract.
INFLUENCE: Influence is the largest category of potential risk because the sphere of influence on a business can be quite large. Foreign influence can be described as a company’s dependence on a foreign entity for revenue, funding, debt, supply, infrastructure, or other non-ownership-based economic relationships that can create a meaningful impact on the company’s decision making and interests.
There are many types of foreign influence. Some are listed below:
• The ability to direct or decide matters affecting the management or operations of the company
• Contracts, agreements, assistance awards, understandings, or arrangements between the company and a foreign person or entity
• Debt, liabilities, or obligations
• Supply chain, raw materials, and hardware supplied by a foreign government-connected entity or located in a foreign country of concern (FCOC)
• Professional or institutional appointments or positions with a foreign government or foreign government-connected entity to include malign foreign talent recruitment programs
• Foreign government-connected customers or customers based in a foreign country of concern
• Research collaborations with a foreign government-connected entity or with a research entity located in a foreign country of concern
Having a firm understanding of the key terms associated with FOCI will help you to identify FOCI. Some key points to remember include:
• The term foreign person can refer to foreign nationals, governments, or entities. It can also refer to any entity over which a foreign national, government, or entity has the ability to exercise control over.
• The term foreign country of concern generally refers to a country that has been determined to be a country of concern by the U.S. Secretary of State.
• Ownership usually is referring to beneficial ownership of a business. A beneficial owner is anyone who can directly or indirectly exercise voting power or investment power over a company.
• Control over a business usually comes from covered individuals and key management personnel.
• Adversarial and competitor nations recruit people who are willing to provide them access to key personnel or intellectual property.
• Foreign influence is the largest area of potential risk in terms of FOCI. Influence is gained when a company is dependent upon a foreign entity in such a way that creates a meaningful impact on the company’s decision making and interests.
Reducing the Risks of FOCI
While this is not a comprehensive list of ways to mitigate FOCI risks, it is an excellent start to understanding the various ways in which FOCI can affect a business and ways in which that effect can be mitigated.
Reducing the risks of FOCI is vital to a business because it reduces the chances of unwanted technology transfer (i.e., loss or proprietary information and trade secrets), the loss of customers and revenue, the loss of U.S. government assistance awards, and the loss of facility security clearance eligibility. A business within the defense industrial base that is under FOCI may also negatively impact the national security interests of the United States.
Summary: Risk management encompasses identification, analysis, mitigation planning, mitigation plan implementation, and tracking of future root causes and their consequence.
Identifying risks is one of the keys to a successful project, but just identifying risks isn’t enough. You also need to analyze them in order to determine their cause, effects, and relationship to other risks.
RISK: A measure of future uncertainties in achieving project performance goals within defined cost and schedule constraints. It has three components: a future root cause, a likelihood assessed at the present time of that future root cause occurring, and the consequence of that future occurrence.
RISK IDENTIFICATION: This is the activity that examines each element of the project to identify associated future root causes, begin their documentation, and set the stage for their successful management. Risk identification begins as early as possible in successful projects and continues throughout the life of the project.
RISK ANALYSIS: Risk Analysis: Risk analysis is the activity of examining each identified risk and refining the description of the risk, isolating the cause, and determining the effects and aiding in setting risk mitigation priorities. It refines each risk in terms of its likelihood, its consequence, and its relationship to other risk areas or processes.
A FOCI Plan is a method applied to negate or mitigate risk of foreign ownership or control. Also referred to as a mitigation instrument. The following 12 steps should be included within your FOCI Plan to reduce your FOCI risk.
1. Requiring covered individuals to complete insider risk awareness training.
2. Requiring increased frequency of reporting by the covered individuals through progress report forms.
3. Requiring the proposing company to replace individuals listed in the grant or contract proposal as working on the proposed project who are deemed FOCI risks, including covered individuals.
4. Reviewing contracts and clarifying relationships, affiliations, or associations considered particularly risky.
5. Requiring the covered individuals to resign from positions or cease foreign affiliations deemed problematic by the risk-based security review.
6. Removing problematic foreign board members.
7. Transferring voting rights of problematic foreign shareholders to a U.S. citizen residing in the U.S.
8. Reducing the percentage of problematic foreign investment or ownership in the small business.
9. Limiting foreign supply chain dependence.
10. Removing problematic foreign debt and foreign financial obligations.
11. Ceasing all joint ventures or subsidiaries that are based in, funded by, or have an affiliation with a foreign country of concern.
12. And lastly, ceasing technology licensing or IP sales to any foreign country of concern or foreign country of concern-related entity.
Remember, it’s imperative for you to identify any areas of your business that might be under FOCI. Doing so will not only protect our national security, but it will help keep your business secure and profitable.
For additional information, refer to https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117/section-117.11 or speak to your APEX Counselor.
