Compliance with foreign ownership guidance now mandatory for fed gov tech procurement

Compliance with the Foreign Ownership, Control or Influence (FOCI) Risk Assessment Guidance (RAG) is now mandatory for those procuring technology products or as-a-service offerings that handle official or classified Australian Government information.  

The RAG, issued by the Department of Home Affairs, provides a repeatable methodology for organisations to identify, assess, recommend and implement mitigations relating to the risk posed by foreign technology vendors operating in their supply chains.

All entities must implement a process when undertaking procurement of technology assets to identify and manage potential FOCI risks, calibrated to the entity’s risk environment; conduct a risk assessment of potential FOCI risks identified during the procurement of technology assets process; and regularly monitor the entity’s contracts relating to technology assets to ensure that FOCI risks do not materialise.

"Foreign technology vendors offer significant value, capabilities and opportunities for Australian organisations and businesses. However, in some cases, the application, market prevalence or nature of certain technologies, coupled with foreign influence, could present risks to Australian organisations and the broader national interest," the RAG said.

"Managing FOCI risk extends beyond national security; it encompasses protecting your organisation’s reputation, your organisation’s systems and intellectual property, your business interests, and the privacy of your staff and customers."

To support this, the Digital Transformation Agency has developed questions for technology buyers that can be included in their request for quote documentation to respond to FOCI requirements.

The questions are designed to help sellers provide relevant information up front, enabling buyers to assess potential risks early and with greater confidence, as well as making it easier for buyers to understand ownership structures and legal obligations without needing to conduct extensive independent research.

"This is an initial step to assist buyers in the new requirements, we are also investigating additional tools that will assist identify FOCI risks for you, we are hoping to implement these in all future panel approaches to market," said the Digital Transformation Agency on the post announcing the news.