New Security Act Broadens Foreign Investment Scrutiny on U.S. Intel and Critical Infrastructure Assets

The newly proposed Critical Infrastructure Security Act is all about tightening the screws on foreign investment, specifically when it touches the most sensitive parts of the U.S. economy and government. This legislation updates the power of the Committee on Foreign Investment in the United States (CFIUS), which is the inter-agency group that vets foreign deals for national security risks. Simply put, if you’re a foreign entity looking to buy a piece of a U.S. company that owns an intelligence facility or a National Laboratory, CFIUS is now explicitly required to look at your deal through a much wider lens, including potential risks to national security or critical infrastructure.

The Security Blanket Gets Bigger

For most people, CFIUS reviews sound like bureaucratic background noise, but they directly affect the flow of capital and who owns what in the U.S. economy. This bill (SEC. 2) expands the scope of what CFIUS must consider. Previously, reviews focused heavily on direct national security impacts. Now, the review explicitly includes transactions that might affect assets owned by the U.S. intelligence community or a National Laboratory. Crucially, the review criteria now also include risks related to “critical infrastructure.” This is a big deal because ‘critical infrastructure’ is a pretty broad term—it covers everything from power grids and water systems to communications networks and financial platforms. If a foreign investor wants to buy a data center company, for example, that deal is now much more likely to trigger a deep-dive review because data centers are considered vital to communications and finance infrastructure.

Annual Check-Ins and Paperwork

The bill also sets up some serious internal housekeeping for the government agencies that make up CFIUS. Every year, by January 31st, each agency on the Committee—think Treasury, Defense, Energy, etc.—must review its own list of facilities and property it considers sensitive due to national security or critical infrastructure concerns. Once they’ve updated this list, an Assistant Secretary (a high-level political appointee) or someone equivalent has to approve it before it gets sent up to the CFIUS chairperson. This means the government is formalizing and standardizing how it decides what assets are sensitive, which could lead to better coordination, but it also adds another layer of high-level sign-off that could slow the process down. For businesses involved in cross-border transactions, this annual review process means the goalposts for what is considered “sensitive” could be moving slightly every year.

What This Means for Business and Oversight

If you’re a foreign investor or a U.S. company seeking foreign investment, expect increased scrutiny and potentially longer review times, especially if your business touches anything that could arguably be called “critical infrastructure.” The benefit here is clear: the U.S. government is trying to protect key assets from foreign adversaries. However, the downside for the business community is the potential for increased regulatory uncertainty and delay in closing deals. Furthermore, the bill includes a provision for Congressional oversight, requiring the CFIUS chairperson to provide classified briefings on these sensitive facility lists if a cleared Member of Congress requests it. This ensures that Congress has a better handle on what the executive branch is deeming critical, adding a layer of accountability to the process. Overall, this legislation signals a significant shift toward prioritizing security over ease of foreign investment in key sectors.