CFIUS Issues New Risk Matrix And Mitigation Guidance

On July 29, 2026, the U.S. Department of the Treasury (“Treasury”), as Chair of the Committee on Foreign Investment in the United States (“CFIUS” or the “Committee”), published new guidance for the public in the form of a CFIUS Risk Matrix. The Matrix identifies eight categories of common national security risks often identified during the CFIUS process (i.e., critical infrastructure, cybersecurity, information security, personal data security, product integrity, proximity concerns, supply assurance and technology transfer), as well as an explanation of the vulnerabilities that can arise with respect to foreign ownership in businesses with such risks. In addition, the Matrix also sets out the purpose of mitigation for each category and provides a list of sample mitigation terms frequently used in mitigation agreements. The Matrix is replicated in the attached Appendix.