Building Defense Tech as a Foreign-Born Founder: A Transparency Playbook

Foreign Ownership, Control, or Influence (FOCI) compliance is the mandatory assessment required by US defense contractors when foreign founders, shareholders, or board members are involved. Mitigation requires documenting the company's governance via Standard Form 328, appointing independent US-citizen directors, and implementing documented information-access controls to ensure that sensitive unclassified and classified work can proceed without foreign interference or access to controlled technical data.

The transparency bet

When building a US defense-tech venture as a foreign national, the strategic question is not "How do we hide our foreign origin?" It's "How do we own it cleanly and transparently?"

I'm a Ukrainian national and a US lawful permanent resident (EB-1A "extraordinary ability," admitted in 2024), but that green card doesn't erase my origins or my founding work in Europe. Dronehub, which I founded in 2015 as Cervi Robotics in Poland, represents a decade of deep-tech R&D in autonomous systems—funded by the European Space Agency (ESA), the European Defence Agency (EDA), and EU research programs. That track record is a genuine credential. But it also means foreign ownership, control, and influence are real questions that program officers and prime contractors will ask. The only honest answer is to address them first.

This is the story of why transparency—structured through the standard FOCI mitigation toolkit—is not a liability in US defense work. It's a competitive advantage.

Why FOCI matters (and why hiding it backfires)

Foreign Ownership, Control, or Influence (FOCI) is a foundational screen in US federal contracting. The National Industrial Security Program Operating Manual (NISPOM) — codified at 32 CFR Part 117 and administered by the Defense Counterintelligence and Security Agency (DCSA) — together with the National Defense Authorization Act (NDAA) and related legislation establishes the legal framework. The baseline rule is simple: classified work, and sensitive unclassified work touching areas like export control, requires the government to verify that no foreign person or entity has the ability to access controlled information, influence decisions, or steer R&D toward adversary benefit.

That's not paranoia. That's law.

If you're a foreign-born founder and you don't disclose FOCI proactively, your company becomes radioactive the moment a compliance officer pulls your LinkedIn, finds evidence of foreign ownership, or discovers foreign bank transfers. I've watched startups implode because founders thought that silence would solve it. Investigators find the truth. When they do, "lack of candor" findings sink not just one contract—they kill your ability to ever do classified work again.

Transparency, by contrast, is a solved problem. The mitigation toolkit is published, battle-tested, and available to any foreign founder willing to implement it.

The corporate-structure play

The standard approach: Keep the US entity separate from international ventures.

If you're building a US defense company, the US entity should be incorporated in the United States and serve as the sole contracting vehicle for all US federal work. It should have its own bank account, its own IP, its own team. International ventures—like Dronehub in Europe—become reference material: they demonstrate engineering pedigree, funded R&D, and track record of working with government partners. But they are not intermingled with US corporate control or US contracting activity.

This structure signals three things to compliance auditors:

1. Legal cleanliness. When an auditor asks "Is the US company subject to control by a foreign entity?" the answer is documented: no. There is no cross-board, no entangling loans, no shared corporate veil.
2. Information isolation. Controlled unclassified information (CUI) and export-control-restricted technical data stay in the US entity. International R&D, talent, and investors do not access US contract work in detail.
3. Regulatory clarity. Program offices prefer companies where the org chart is simple and auditable.

The mitigation toolkit: SF-328, directors, and control measures

Once you've separated the entities, you deploy the standard FOCI toolkit. It's not exotic. Every foreign-founded US defense company uses it.

Standard Form 328

Form SF-328 (Certificate Pertaining to Foreign Interests) is the foundational document. It asks: Who owns you? Who sits on your board? Who has veto rights? What foreign nationals are employees or advisors? The form isn't a trap; it's an interview. You disclose completely and honestly.

The honesty is the point. DCSA and program offices understand foreign-born founders. They don't expect you to disappear your origin. They expect you to document it, compartmentalize sensitive work, and prove that classified or CUI contracts can proceed without foreign access.

Filing SF-328 early—before you bid—telegraphs to the government that you're serious about compliance. Filing also creates a record that satisfies auditor questions down the line.

Independent US-citizen directors

Bring one or more independent US citizens onto your board. They should have no financial interest beyond equity and no consulting contracts. They are there to approve policies on information handling, hiring, and access control. They review and attest to the implementation of FOCI mitigation.

In practice, these are accomplished defense-adjacent professionals: lawyers, former program managers, retired contractors. They cost equity or modest board fees, and they are well worth it. Their role is to provide a US-controlled oversight layer that answers the auditor's question: "Who is minding the shop?"

Information-access controls and nondisclosure agreements

Here is where the rubber meets the road: Controlled information is physically and logically separated from foreign-national access. If you have non-US employees or advisors, they don't sit in the room when you review CUI. They don't have access to export-controlled technical data. They don't attend certain meetings.

This is the legal requirement. You implement it through:

• Role-based access control (RBAC). Employees working on US federal contracts have explicit job codes. Only those assigned to CUI-handling roles access CUI systems.
• Facility access. If you have a classified facility, foreign nationals are badged out of certain areas.
• Vendor and subcontractor screening. You audit your supply chain for FOCI risk and document it.
• Nondisclosure agreements (NDAs) and employment agreements. International advisors and non-essential staff sign agreements that acknowledge US information-handling policies and export-control law. They understand that certain topics and data are off-limits.

The regulatory basis: Why this works

The NISPOM (administered by DCSA), the NDAA's supply-chain provisions — notably Section 889 on covered telecommunications equipment — and the Export Administration Regulations (EAR) together establish the regime.

Here's the logic: If you disclose FOCI fully, implement compartmentalization, and pass a security review, you are not considered a national-security risk. The program proceeds.

If you hide FOCI, obfuscate ownership, or fail to document controls, you become a risk. Contracts are terminated. Debarment follows.

The government doesn't penalize you for being foreign-born. It penalizes you for being dishonest about it.

A practical sequence

If you're a foreign founder building a US defense venture, here's the workflow:

1. Separate entities early. US venture is a separate legal entity, controlled by US persons.
2. File SF-328 early. During proposal phase or before, not after award.
3. Appoint independent US directors. Before you sign a contract.
4. Document information controls. Write policies, train staff, audit quarterly.
5. Screen supply chain and subcontractors. Pull FOCI questionnaires from any vendor who touches CUI.
6. Engage your contracting officer and facility security officer (FSO) proactively. They will tell you what they need to see. Answer directly.

Why foreign-born founders can have an edge

Here's a counterintuitive point: Foreign-born founders often have better operational security and compliance cultures than founders without international experience. Why? Because we've had to think about it. We know the law is the baseline. We build compliance into the operating model from day one, not as an afterthought.

Deep-tech R&D in autonomous systems, defense electronics, and space tech conducted in Europe under ESA, EDA, and EU research programs is a proving ground for rigorous IP and technical governance. That discipline is a genuine credential, not a liability.

Moreover, foreign-born founders bring technical expertise that matters. A background in European drone systems, Galileo satellite integration, and research-phase counter-UAS work funded by ESA or EDA is credible to US program officers. If you can show that your European ventures succeeded under rigorous European funding scrutiny, that actually builds confidence in your ability to handle US federal work responsibly.

The trick is keeping the systems clean so you can point to your international pedigree and prove your US compartmentalization.

The bottom line

You could found a US defense company and try to obscure your international origin and network. Startups do it every day. It would save legal fees in the short term and feel less awkward.

It would also be a catastrophic mistake.

Instead, the playbook is to build your US entity from day one as a cleanly separated, US-controlled operation with transparent foreign-founder disclosure, independent board oversight, and documented information controls. It costs real legal and governance overhead. But it is defensible. When a program officer runs due diligence, they don't find surprises. They find a company that is serious about national-security compliance and willing to prove it.

That signal—cleanly communicated up front—transforms what could be a disqualifier into a proof point: here is a foreign-born founder with credentials from EU and ESA research programs, who has the maturity and governance discipline to handle US federal work responsibly.

Transparency isn't weakness in defense contracting. It's the only strategy that scales.

Related reading

For regulatory sources:

• DCSA: National Industrial Security Program Operating Manual (NISPOM)
• Standard Form 328: Certificate Pertaining to Foreign Interests (SF-328)
• NDAA FY2019 Section 889: Prohibition on Certain Telecommunications and Video Surveillance Services
• Export Administration Regulations (EAR) — US Department of Commerce Bureau of Industry and Security