Foreign ownership, control or influence (FOCI)

Foreign ownership, control or influence (FOCI) is an assessment of the nature and extent of authority, ownership, control or influence that foreign interests may have over a Canadian organization. It is used to decide whether a third party could exercise dominance or authority over that organization and, through it, gain unauthorized access to government information, assets or sites.

FOCI is a security and industrial-security concept. In Canada it is administered through the Public Services and Procurement Canada Contract Security Program (CSP). It applies to sensitive government work such as contracts involving NATO access, foreign classified information or communications-security material. The CanadaBuys buyer's guide on FOCI sets out how the evaluation works, and the CanadaBuys Supply Manual glossary describes its purpose.

When a FOCI evaluation is mandatory

A FOCI evaluation is required when contracted work involves access to NATO or other international organizations, or to foreign classified information, assets or sites. It is also required when contract performance needs access to communications-security (COMSEC) information or assets, and whenever the CSP directs one. Canada also conducts FOCI evaluations under applicable international security agreements. Where a contract involves NATO information, assets or sites, the evaluation follows the NATO Security Policy.

The Supply Manual glossary adds that FOCI assessments are meant to prevent a third party from gaining unauthorized access to information-security (INFOSEC) information.

How FOCI appears in a solicitation

Buyers must tell offerors in the solicitation that a FOCI evaluation is required. The complete FOCI package is generally requested only from the offeror identified as the prospective awardee, not from every bidder at the initial bid stage. When the package is requested, the offeror has 30 days to submit the required documents, according to the CanadaBuys guidance.

A FOCI evaluation is contract-specific. It must be completed before the organization is authorized to access the sensitive information, assets or sites involved.

FOCI and the Facility Security Clearance

A Facility Security Clearance (FSC) is the clearance an organization needs to perform classified government contracts. Under the Industrial Security Manual, the existence of FOCI does not by itself prevent an organization from holding an FSC. The CSP assesses each case individually and considers whether measures can negate or reduce the risk to an acceptable level.

Examples from Canadian procurements

• A National Defence request for proposal required the winning contractor to submit a completed FOCI package and obtain a contract-specific FOCI determination letter. The contractor could not store NATO classified information or assets until that determination was issued.
• The same solicitation required the contractor to implement any mitigation measures approved by the FOCI Office before accessing NATO or classified information and assets. The contractor had to maintain those measures throughout the contract, including extensions.
• A separate COMSEC-related solicitation required both a FOCI determination and a Communications Security Establishment determination before access to COMSEC information or assets.
• Transport Canada's High-Speed Rail procurement process stated that bidders were subject to a comprehensive security assessment, including a FOCI evaluation.

What FOCI means for a supplier

If a solicitation names a FOCI requirement, plan for it before you bid. Know who owns and controls your organization, and be ready to document foreign ownership, control or influence within the 30-day window once you are identified as the prospective awardee. If a risk is identified, expect mitigation measures that you must put in place before access is granted and keep in place for the life of the contract, including extensions. Foreign ownership alone is not an automatic bar, since the CSP assesses the circumstances of each case.