# Its Extract National Security Factors Cfius > Produces a CFIUS risk assessment memorandum for a foreign acquisition that identifies filing obligations, assesses the adequacy of proposed mitigation instruments, evaluates restricted-party and government-subsidy connections, and incorporates comparable foreign-regulatory precedent as a signal of likely review outcomes. - Skill: `finchipaiorg/its-extract-national-security-factors-cfius` (Agent Skill) - Install (CLI): `npx skillmds@latest add finchipaiorg/its-extract-national-security-factors-cfius` - Raw SKILL.md: https://api.skillmd.com/api/skills/finchipaiorg/its-extract-national-security-factors-cfius/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: FinchipAIOrg (https://skillmd.com/u/finchipaiorg) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/finchipaiorg/its-extract-national-security-factors-cfius --- # Skill: Extract National Security Risk Factors for CFIUS Assessment ## 1. Subject-matter triage - Treat the assignment as a CFIUS-oriented risk assessment, not a generic M&A summary. - First identify the transaction structure, the foreign acquiror path, the target’s U.S. nexus, and any defense, critical technology, sensitive data, or supply-chain exposure. - If the source set contains multiple entities, jurisdictions, filing paths, or mitigation proposals, enumerate them before analyzing so each is assessed on its own facts. - Separate mandatory-filing questions from discretionary mitigation, and separate transaction risk from compliance-history risk. ## 2. Failure modes the skill is correcting - Analyzing a mitigation concept before confirming whether the filing path and security posture make that concept plausible. - Treating target sensitivity alone as dispositive without testing the foreign acquiror’s country-risk profile, ownership chain, and state-linked connections. - Missing restricted-party, subsidy, or state-direction indicators that change the CFIUS posture even where the target business appears ordinary. - Failing to connect comparable foreign review outcomes to likely U.S. review pressure points. - Treating prior disclosures, enforcement matters, or remediation history as background noise instead of evidence bearing on controls maturity. - Summarizing risks without tying each one to the governing legal framework and the downstream transaction consequence. - Issuing conclusions without balanced non-issues analysis or concrete next steps. ## 3. Legal frameworks / domain conventions that apply - CFIUS jurisdiction and filing analysis should be organized around the foreign-investment review framework in the Defense Production Act, as amended by FIRRMA, and the implementing regulations in 31 C.F.R. Part 800 and, where relevant, Part 802. - Mandatory-filing analysis should test whether the deal is within a compulsory notice category based on the target’s business, the sensitivity of the U.S. nexus, and the acquiror’s ownership and control profile. - Sensitive-technology analysis should use the applicable export-control classification framework reflected in the source documents, including any ECCN, ITAR, or other controlled-technology identifier if provided. - Mitigation adequacy should be evaluated against the foreign acquiror’s country profile, access rights, governance rights, information-access design, and any personnel or cybersecurity restrictions commonly used in CFIUS settlements. - Restricted-party nexus analysis should examine ownership, control, advisory, financing, supply, or data pathways linking the acquiror or its affiliates to sanctioned, denied, or otherwise restricted persons. - Government-subsidy or state-support indicators should be treated as potential evidence of strategic technology acquisition objectives where they are tied to controlled technologies or defense-relevant capabilities. - Comparable foreign-regulatory precedent is relevant as a practical review signal, but it is persuasive rather than controlling; identify the underlying screening authority and the feature that makes the comparator useful. - Prior voluntary disclosures, enforcement matters, or remediation history should be treated as compliance-maturity evidence and linked to the credibility of proposed mitigation and internal controls. - Sole-source or mission-critical government contract exposure should be tied to continuity-of-supply and national-security concerns, with attention to any termination, step-in, or substitution risk. ## 4. Analytical scaffolds 1. Identify the transaction and filing posture. - State the acquisition form, ownership path, and the intended filing strategy. - Test whether the intended approach fits the applicable CFIUS filing obligation and whether any mandatory notice risk exists. - If multiple filing paths are possible, analyze each path separately and state which is safer and why. 2. Classify the target’s sensitivity. - Identify the target’s technology, data, facilities, products, and end uses using the classification framework reflected in the documents. - Distinguish ordinary commercial operations from defense, critical-technology, or sensitive-data exposure. - Tie the classification to the filing and mitigation analysis rather than treating it as a standalone label. 3. Assess the acquiror’s risk profile. - Map ownership, control, board rights, financing, governance, and affiliate relationships. - Flag any restricted-party overlap, indirect ownership chain, or state-linked support. - Evaluate whether the acquiror’s profile suggests heightened scrutiny, more restrictive mitigation, or a need for deeper diligence. 4. Evaluate mitigation realism. - Test the proposed mitigation against the parties’ actual access and control rights. - Ask whether the instrument is proportionate to the identified risk, whether it is administrable, and whether it addresses the relevant technology, personnel, physical-security, and data-transfer vectors. - If a more restrictive arrangement appears necessary, identify the gap and the operational consequence. 5. Compare external review signals. - Identify comparable foreign or allied screening outcomes and the specific reason they matter. - Use them as signals for likely concern themes, not as substitutes for U.S. law. - State whether the precedent cuts toward approval, conditioning, delay, or prohibition. 6. Test for compliance-history indicators. - Review any prior disclosures, investigations, remediation plans, or policy failures. - Explain whether they support or weaken confidence in internal controls, auditability, and mitigation compliance. 7. Assess supply-continuity and operational risk. - Where the target performs work under government or mission-critical contracts, assess whether a change in ownership could interrupt performance, create clearance or access problems, or trigger substitution issues. - Connect any continuity concern to the likely review posture and mitigation burden. 8. Close every issue analytically. - For each risk factor, state the scale or significance from the source record, identify the interacting document or fact pattern, and explain the transaction consequence. - Do not leave issues as labels; each must end in a practical CFIUS implication. ## 5. Vertical / structural / temporal relationships - The transaction summary controls the deal architecture and intended filing strategy; the acquiror materials control ownership, control, and restricted-party nexus; the target materials control technology, data, contracts, and operational sensitivity. - Where those sources conflict, give priority to the fact pattern that creates the higher national-security risk and explain the inconsistency. - Temporal sequence matters: pre-signing diligence, signing, filing, waiting period, mitigation negotiation, and closing should be analyzed as distinct stages with distinct risk points. - If the documents show a post-signing remediation plan or conditional closing structure, assess whether it is realistically timed to satisfy the filing and mitigation burden before closing. ## 6. Output structure conventions - Write a memorandum in conventional legal style with a short executive summary, issue-by-issue risk analysis, balanced non-issues, and a practical filing-strategy section. - Use an ordinal severity scale defined once at the top of the memo and apply it uniformly to each risk factor. - For each risk factor, include: - the severity label, - the governing authority or practice principle supporting the analysis, - the key facts from the source set, - the review consequence for CFIUS posture, - and the transaction consequence. - Include a separate section for non-issues or low-risk factors to show a balanced assessment. - End with an explicit Recommended Actions section that gives concrete next steps, uses imperative verbs, identifies the responsible role, and ties each step to a timing anchor from the deal process or regulatory timeline. - If the source documents provide a deadline, filing milestone, or closing condition, use it; otherwise anchor the recommendation to the next transactional step. - Keep the memo self-contained and readable without assuming access to the underlying documents.