SF-328

(a) General. Foreign investment can play an important role in maintaining the vitality of the U.S. industrial base. Therefore, it is the intent of the USG to allow foreign investment consistent with the national security interests of the United States. The following FOCI procedures for cleared U.S. entities are intended to mitigate the risks associated with FOCI by ensuring that foreign firms cannot undermine U.S. security to gain unauthorized access to classified information.
(1) The CSA will consider a U.S. entity to be under FOCI when:
(i) A foreign interest has the power to direct or decide issues affecting the entity's management or operations in a manner that could either:
(A) Result in unauthorized access to classified information; or
(B) Adversely affect performance of a classified contract or agreement.
(ii) The foreign government is currently exercising, or could prospectively exercise, that power, whether directly or indirectly, such as:
(A) Through ownership of the U.S. entity's securities, by contractual arrangements, or other means, or;
(B) By the ability to control or influence the election or appointment of one or more members to the entity's governing board.
(2) When the CSA has determined that an entity is under FOCI, the primary consideration will be the protection of classified information. The CSA will take whatever action is necessary to protect classified information, in coordination with other affected agencies as appropriate.
(3) A U.S. entity that is in process for an entity eligibility determination for access to classified information and subsequently determined to be under FOCI is ineligible for access to classified information unless and until effective security measures have been put in place to negate or mitigate FOCI to the satisfaction of the CSA.
(4) When a contractor determined to be under FOCI is negotiating an acceptable FOCI mitigation or negation measure in good faith, an existing entity eligibility determination may continue in effect so long as there is no indication that classified information is at risk of compromise in consultation with the applicable GCA. The applicable CSA may decide that circumstances involving the FOCI are such that the entity eligibility determination will be invalidated until implementation of an acceptable FOCI mitigation plan.
(5) An existing entity eligibility determination will be invalidated if the contractor is unable or unwilling to negotiate and implement an acceptable FOCI mitigation or negation measure. An existing entity eligibility determination will be revoked if security measures cannot be taken to remove the possibility of unauthorized access to classified information or adverse effect on performance of classified contracts.
(6) Changed conditions, such as a change in ownership, indebtedness, or a foreign intelligence threat, may justify certain adjustments to the security terms under which an entity is operating or, alternatively, that a different FOCI mitigation or negation method be employed. If a changed condition is of sufficient significance, it might also result in a determination that a contractor is no longer considered to be under FOCI, or, conversely, that a contractor is no longer eligible for access to classified information.
(7) The USG reserves the right, and has the obligation, to impose any security method, safeguard, or restriction (including denial, termination or revocation of an entity eligibility determination) it believes necessary to ensure that unauthorized access to classified information is effectively precluded and performance of classified contracts is not adversely affected.
(8) Nothing contained in this section affects the authority of a Federal agency head to limit, deny, or revoke access to classified information under its statutory, regulatory, or contract jurisdiction.
(b) Factors. Factors relating to the entity, relevant foreign interests, and the government of such foreign interests, as appropriate, will be considered in the aggregate to determine whether an applicant entity is under FOCI, its eligibility for access to classified information, and the protective measures required. These factors include:
(1) Record of espionage against U.S. targets, either economic or government.
(2) Record of enforcement actions against the entity for transferring technology without authorization.
(3) Record of compliance with pertinent U.S. laws, regulations, and contracts or agreements.
(4) Type and sensitivity of the information the entity would access.
(5) Source, nature, and extent of FOCI, including whether foreign interests hold a majority or minority position in the entity, taking into consideration the immediate, intermediate, and ultimate parent entities.
(6) Nature of any relevant bilateral and multilateral security and information exchange agreements.
(7) Ownership or control, directly or indirectly, in whole or in part, by a foreign government.
(8) Any other factor that indicates or demonstrates capability of foreign interests to control or influence the entity's operations or management.
(c) Procedures. An entity is required to complete an SF 328 during the process for an entity eligibility determination or when significant changes occur to information previously submitted. In the case of a corporate family, the form may be a consolidated response rather than separate submissions from individual members of the corporate family based on CSA guidance.
(1) If an entity provides any affirmative answers on the SF 328, or the CSA receives other information which indicates that the applicant entity may be under FOCI, the CSA will make a risk-based determination regarding the relative significance of the information in regard to:
(i) Whether the applicant is under FOCI.
(ii) The extent and manner to which the FOCI represents a risk to the national security or may adversely impact classified contract performance.
(iii) The type of actions, if any, that would be necessary to mitigate
[…] full text at the eCFR link

Amended: 2021-02-24 · SHA-256 of the XML as served: 13a387a2abd5389d7dd6b676bb6e9687a1b724d2b30fb77a7047626c616a47d3 · eCFR

The eCFR is an editorial compilation maintained by the Office of the Federal Register and GPO; it is updated daily and is not the official legal edition (the annual Code of Federal Regulations is). Text printed here is as the eCFR served it on the read date.