Objective
This report on the assessment of DoD processes to support Committee on Foreign Investment in the United States (CFIUS) determinations and foreign ownership, control, or influence (FOCI) mitigation responds to longstanding management concerns and the U.S. Government Accountability Office (GAO) high risk area of ensuring the effective protection of technologies critical to U.S. national security interests.
We assessed the process for determining and relaying relevant threat information and recommendations to the CFIUS, the strength of FOCI mitigation within cleared defense industry, and the effectiveness of existing tools to help FOCI mitigations and CFIUS determinations.
Findings
We found that existing policies clearly define requirements to support National Interest Determinations, but they do not effectively delineate roles and responsibilities to support the Services, agencies, and the acquisition community resulting in a significant backlog of decisions.
We also found that a need exists for a centralized, accessible database to process and store DD Form 254s—a document that specifies security requirements for classified contracts—as part of an enterprise system that manages the flow of contract information to support industrial security within cleared defense industry.
Recommendations
We recommend that the Under Secretary of Defense for Intelligence (USD(I)), in coordination with the Under Secretary of Defense for Acquisition, Technology, and Logistics (USD(AT&L)), issue guidance that defines ownership of information, delineates responsibility for coordination within respective Service and agency organizations, and outlines a consistent process flow for National Interest Determinations to further a synchronized, integrated approach to support CFIUS determinations and foreign ownership, control, or influence mitigation. We further recommend that the USD(I), in coordination with the USD(AT&L), direct the creation of a centralized repository for cleared defense contracts, to maintain DD Form 254s and other contract security requirements for classified contracts, and designate the Defense Security Service as executive agent in its role as the National Industrial Security Program Cognizant Security Office for DoD, 26 non-DoD agencies, and approximately 13,500 cleared contractors.
Management Comments
Management concurred with the two main recommendations and its comments were responsive. Management non-concurred with designating at this time an executive agent for the DD Form 254 central repository. We require no further comment and will continue to monitor DD Form 254 repository developments, along with the corresponding Office of Management and Budget/Federal Register approval process.