Podcast - Decoding the Key Management Personnel Requirements

Molly O'Casey: Welcome to the third episode of Are We All Clear, the podcast on facilitating security clearances. I'm your host, Molly O'Casey, an international trade associate with Holland & Knight's Washington, D.C., office. Today's episode will introduce you to the concept of key management personnel, or KMPs in the context of a facility security clearance. We will talk about who is a KMP, do all KMPs need to be cleared and specific issues to keep in mind in appointing KMPs. Today's speaker is Antonia Tzinova. Antonia is a partner with the International Trade Group in our D.C. office. Antonia leads Holland & Knight's CFIUS and Industrial Security Team, and CFIUS stands for Committee on Foreign Investment in the U.S. Welcome to the podcast, Antonia.

Antonia Tzinova: Thank you, Molly. Great to be here with you.

Molly O'Casey: All righty. As our first question, what is a KMP?

Antonia Tzinova: Well, thank you for asking. I mean, this is one of the first terms that anybody who dabbles in this area needs to learn. So what does KMP stand for? It stands for key management personnel. This is a term of art from the word of the NISPOM — another acronym, which itself stands for the National Industrial Security Program Operating Manual, and I know that this is a mouthful. So what does KMP refer to is senior management officials of the company in the context of a corporation. These will be members of the board of directors, the officers that are appointed by the board in accordance with the company's bylaws. However, there are other business forms. Most often we see a limited liability company. And so in that context, we may have members —which stands for owners — we may have managers, we may have a board of managers, we may have the standard set of officers that you hear in everyday context, like a CEO or president. There is also limited partnership. So in that context you may hear the term general partner. They may also have officers, or they may choose not to have officers. So these days most companies will have a president or CEO. And some of the officers that the company would have will include a treasurer, secretary, a chief operating officer, a vice president. So these are some of the clues that an official or a company employee need to keep in mind and use as a starting point in their review.

Molly O'Casey: Got it. So it sounds like we're focusing on the people in charge, the people with responsibility. Why do KMPs matter?

Antonia Tzinova: Right. I mean, for the exact reason that you just said, these are the people who are managing the company. One of the documents that a cleared company must present to DCSA when it applies for a clearance or any times there are changes, is the KMP list. And the KMP list is based on the company's governance documents and then based on the roles of the various KMPs. This will determine which of those KPMs need to be cleared. And so this is why a basic understanding is, is needed.

Molly O'Casey: And can you just remind us what DCSA is?

Antonia Tzinova: Sure. DCSA is the agency that is tasked with reviewing applications for clearances, both for companies and for personnel. Its full name is Defense, Counterintelligence and Security Agency. In the past it was known as DSS, so some people out there may know it as DSS. The new term that's been in circulation for the last few years, DCSA. It's part of the Department of Defense, and for the most part, it's the agency that deals with clearances. However, you know, the Department of Energy has its own set of clearance documents and it has its own procedures. Some of the intel community agencies have their own procedures. So here when we refer to DCSA, we mean the regulator. But people should keep in mind that sometimes that might be DOE, it might be the CIA, for example.

Molly O'Casey: Right DSS to, to DCSA. We love it when the acronyms get longer.

Antonia Tzinova: I know, it took some time to, you know, train my tongue to pronounce.

Molly O'Casey: And how can a company determine who to list as a KMP?

Antonia Tzinova: Right? So, I mean, it's kind of a crash course in corporations really. So first, whoever's performing the analysis needs to evaluate the form of business of the company that's being cleared. Is it a corporation? Is it a limited liability company? Is it the general partnership? These are the ones that we see most often. There are some other forms that are not typically used, like a proprietorship or some association. Some nonprofits can be cleared as well. Once this is determined, then examine the respective governance documents of the company. So for corporations, those would be the bylaws, the articles of incorporation. For an LLC, that would be the operating agreement, also known as the LLC agreement. For a general partnership, we're looking for the partnership agreement typically. And once you kind of identified the right governance document, you need to find within the document who makes the most important decisions about the business, who is charged with managing the company and overseeing day-to-day operations. And most of those documents would have like separate clauses in it, either type of management, board of directors, officers. Those would be the provisions that need to be evaluated to determine the basic set of KMPs. As I mentioned, this is, these are terms from corporate law. So a company might be well served at this stage of the analysis to consult a lawyer for smooth sailing with the DCSA, especially at the time of initial processing for clearance. I want to point out that most officials at a company dealing with clearances are not lawyers, and most people working on this at DCSA are not lawyers. So having a lawyer as the interpreter of legal terms is a good investment long-term. In addition to the officers and directors big picture, there are two additional officers. These are created by the NISPOM. So these are written in law, and this is the facility security officer, or the FSO, and an insider threat program senior official. Right. So I mean, this could be the same person, or it could be two different persons holding the positions. These are typically employees of the company, so they would not be appointed by the board. They're typically appointed by the president or one of the management officials of the company. However, in terms of reporting to DCSA, they are part of the company's KMPs.

Molly O'Casey: So it sounds like companies want to have a robust corporate structure supported by a decent amount documentation in place when thinking about these issues.

Antonia Tzinova: Right? I mean, every company has this, and people just need to know to ask for the, the correct documents so that they can identify the people that need to be listed on the KMP list.

Molly O'Casey: And do all KMPs need to be cleared? How big a burden are we talking about for a company?

Antonia Tzinova: No, definitely not all KMPs need to be cleared. So under the NISPOM that I keep referring to, which is the law, the regulation in this area, the minimum of KMPs that need to be cleared include the senior management official — now that's another term marked SMO, and typically that's the president or the CEO of the company, the chairman of the board. Again, this is in the context of a corporation, but it's kind of stuck. So now we see the chairman of the board or equivalent. In the context of an LLC, you may have a sole manager or you have a board of managers. And then you look to the chairman and the FSO and the ITPSO. So these are the two employee positions that I mentioned earlier. These are non-negotiable. So those individuals must be cleared. And as you probably learned in prior episodes, a person who applies for clearance in the U.S. must also be an eligible U.S. citizen. So when operating, especially in the context of a multinational environment, it's good to keep that in mind. With respect to the rest of the KMPs, it is all at the discretion of DCSA. So DCSA will review the list of KMPs and will determine, based on the corporate governance documents, who else needs to be cleared or not. And here I want to remind our listeners a very key principle in the world of clearances and classified information: This is the need to know, meaning that only companies that need to have access to classified information in order to be able to perform their contracts will be cleared, and only personnel that need to have access to classified information in order to perform their responsibilities under a classified contract will be cleared. And this need to know principle is an integral part of the government policy of minimizing the risk of compromising classified information. And so, just to come full circle, because of this, not all of the KMPs will be cleared, and those that are not will be treated as excluded KMP,s.

Molly O'Casey: Gotcha. So whatever challenges associated with KMPs is at least the need to know and limits the need to be involved.

Antonia Tzinova: That is right.

Molly O'Casey: Are there any specific issues to keep in mind with respect to KMPs?

Antonia Tzinova: Right. So I already mentioned, I mean, a cleared person must be a U.S. citizen. And so you need to keep that in mind when appointing people in senior management officials, especially if you have a company under foreign ownership. You cannot have a foreign person sit in the position of a president, CEO, chairman of the board. Another thing to keep in mind, and that kind of applies across the board, regardless of ownership, typically, and in the domestic context, because of the need to have certain KMPs cleared, companies with a complex group structure, where the company is part of a larger corporate family, need to carefully consider how to structure their business to minimize the need to have a parent company cleared. And I know this is a mouthful, but imagine, you know, a cleared company that has an immediate parent company, and then there are two or three holding companies on top. And then you have like a private equity fund that owns this entire family of companies, and — which I'm pretty sure people see often — and so what do you do? How do you set up the cleared company in terms of do you set up a corporation, do you set up a limited liability company? There are certain, you know, triggers that are not related to the facility clearance issue. These may be tax considerations. I mean, it might be more advantageous to set up a limited liability company as opposed to a corporation. And so if you choose to have a limited liability company, you need to think, OK, who are my KMPs that need to be cleared. I mean, an LLC might be managed by its members, which is legal speak for owners, or it can be managed by designated managers. And that depends on its operating agreement. And so that will be something very basic to examine early on in the process, and maybe change the operating agreement to set up a managed, managed company. Why would we do that? Because if an LLC is run by its members, meaning owners, the DCSA will request that those members — in this case could be a parent company — be cleared as well. And so it's just a matter of evaluating do I want all these entities in my parent, subsidiary corporate structure cleared, or is it better to, you know, limit the clearance to only the company that's going to be performing on the contract? And in that case, maybe set up the manager-managed LLC so that we minimize the need for clearing individuals and also for clearing parent companies. So I know that this is a kind of a complex concept. This is another instance where assistance by counsel is very useful, especially early on in the process, because it minimizes constant back and forth with the DCSA in determining who needs to be cleared in terms of individuals, but also in terms of parent companies.

Molly O'Casey: Thank you so much for your thoughts, Antonia. This area is full of acronyms. Just this week we had KMPs, key management personnel, DSS and DCSA, the Defense Counterintelligence and Security Agency, NISPOM, the National Industrial Security Program Operating Manual, ITPSO, insider threat program senior official, FSO, facilities security officer. And SMO, senior management official. I think I got them.

Antonia Tzinova: Well, I just listen, listening to you and that kind of gives me a headache, so I can relate.

Molly O'Casey: Oh no, I hope I don't give people headaches. OK. But so each episode, we ask our speaker to explain an acronym that featured in the episode with wrong answers only. I will let you pick which of these acronyms you'd like to explain.

Antonia Tzinova: Wrong answers only. OK. Well, given that we were talking about KMPs, we should probably go with the KMP. One that comes to mind immediately: keep me posted. I think it's simple to remember, and I think it also goes with the theme. Anytime there is a change to the KMPs, you need to notify the DCSA. So maybe our audience can remember that to keep me posted, meaning inform DCSA, anytime you have a change to your KMPs.

Molly O'Casey: I like it. Well, I look forward to you keeping me posted on any issues in this area. In the meantime, thank you again to Antonia for taking the time to meet with us today and talk about your experience. On our next episode, we'll be discussing corporate documents in the context of clearances. I hope everyone has a great week.