Threat Assessment & Risk Mitigation Flashcards

Which FOCI mitigation instrument is typically used when a foreign interest effectively owns or controls the company?

Answer: Special Security Agreement (SSA)

An SSA is used when a company is effectively owned or controlled by a foreign interest, usually with an outside-director structure.

Which FOCI instrument is used when a foreign interest does NOT effectively own or control the company but has board representation?

Answer: Security Control Agreement (SCA)

An SCA applies when the company is not effectively owned or controlled but the foreign interest is entitled to board representation.

A Technology Control Plan (TCP) in a FOCI mitigation context is primarily designed to:

Answer: Control access by foreign persons to classified and export-controlled information

A TCP prevents unauthorized access by foreign persons to classified and export-controlled technology.

When must a cleared contractor report a change in its ownership that may affect FOCI status?

Answer: Promptly, as a changed condition report to DCSA

Changed conditions, including ownership or FOCI changes, must be reported to DCSA promptly.

Which is a primary purpose of a risk assessment in a facility security program?

Answer: Identifying assets, threats and vulnerabilities to prioritize countermeasures

Risk assessment identifies assets, threats and vulnerabilities so countermeasures can be prioritized cost-effectively.

In the common risk formula, risk is best described as a function of:

Answer: Threat, vulnerability and consequence (impact)

Risk is commonly modeled as threat × vulnerability × consequence.

Accepting a residual risk after countermeasures are applied is generally decided by:

Answer: Management with appropriate authority, informed by the risk assessment

Residual risk acceptance is a management decision based on the risk assessment.