DealLawyers.com Blog

Last month, CFIUS issued a new Risk Matrix clarifying the issues it is likely to focus on when reviewing a potential transaction and outlining the types of safeguards that may be required to address its concerns. This excerpt from a recent Simpson Thacher memo summarizes the new Risk Matrix:

On July 29, 2026, the U.S. Department of the Treasury (“Treasury”), as Chair of the Committee on Foreign Investment in the United States (“CFIUS” or the “Committee”), published new guidance for the public in the form of a CFIUS Risk Matrix.

The Matrix identifies eight categories of common national security risks often identified during the CFIUS process (i.e., critical infrastructure, cybersecurity, information security, personal data security, product integrity, proximity concerns, supply assurance and technology transfer), as well as an explanation of the vulnerabilities that can arise with respect to foreign ownership in businesses with such risks. In addition, the Matrix also sets out the purpose of mitigation for each category and provides a list of sample mitigation terms frequently used in mitigation agreements.

The memo says that, in addition to giving companies and their advisors a clearer roadmap of the national security issues that CFIUS is likely to focus on, it also makes the review process more predictable and transparent by outlining what it may require to address those concerns.

– John Jenkins