SaaS Procurement under FOCI: Navigating DCSA Guidelines

Address the complex challenges faced by U.S. companies under foreign ownership, control, or influence (FOCI) when procuring commercial Software-as-a-Service (SaaS) solutions, particularly those handling sensitive employee Personally Identifiable Information (PII). They explain how the Defense Counterintelligence and Security Agency (DCSA) regulates FOCI and its increasing scrutiny on unclassified contracts with sensitive data due to Section 847 of the FY20 NDAA. The text emphasizes the need for rigorous due diligence of SaaS providers, the adaptation of existing FOCI mitigation plans like Technology Control Plans (TCPs) and Electronic Communications Plans (ECPs) for cloud environments, and the crucial role of internal governance bodies like the Government Security Committee (GSC) in ensuring compliance to protect against foreign access and influence risks. Effective contractual safeguards with SaaS vendors are highlighted as vital tools in this complex regulatory landscape.