Search the archive.

On July 29, 2026, Treasury, as CFIUS chair, released a Risk Matrix cataloguing eight transaction profiles that pose elevated national security risk: critical infrastructure, cybersecurity, information security, personal data, product integrity, proximity to sensitive government sites, supply assurance, and technology transfer. For each profile, the matrix sets out the threat-vulnerability-consequence calculus under 31 C.F.R. § 800.102 and lists illustrative mitigation measures—governance restrictions, source-code reviews, third-party monitorships, segregation of protected technology, supply-continuation commitments, and CFIUS access and audit rights. The release aligns with the America First Investment Policy and a stated push to 'demystify' the process, but it also signals broader enforcement reach, including non-notified outreach. Counsel advising foreign investors, sponsors, and U.S. targets should map deal profiles against the matrix, weigh voluntary filings where risk indicators are present, and prepare for more standardized mitigation expectations rather than bespoke negotiatio

…

The BakerHostetler alert outlines rising CFIUS scrutiny of foreign venture capital investments in U.S. defense technology firms, as the committee now classifies investor nationality and foreign government ties as core national security risks. Recent enforcement actions have blocked or conditioned deals involving non-U.S. backing for dual-use and military-focused tech startups. In-house counsel for defense tech companies should update investor due diligence protocols to include mandatory CFIUS pre-screening for all non-U.S. capital sources, document national security risk mitigation plans for pending investments, and align fundraising timelines with CFIUS review windows to avoid deal delays or cancellations.