Authors: Rachel Small, Counsel, and Jon P. Yormick, Managing Member
The Department of Defense (DoD) has proposed a major expansion of Foreign Ownership, Control, or Influence (FOCI) requirements that could significantly affect small and mid-sized defense contractors performing on unclassified DoD contracts.
Historically, FOCI reviews primarily applied to contractors with facility security clearances performing classified work. Under the proposed rule, however, certain uncleared contractors and subcontractors could become subject to new disclosure, reporting, and mitigation obligations tied to foreign ownership, investment, financing, governance, and business relationships.
1. The Rule Could Apply to Many Uncleared Contractors
- If finalized, the proposed DFARS rule would generally apply to DoD contracts, subcontracts, and defense research assistance awards exceeding $5 million, including lower-tier subcontractors.
- Although commercial products and services would generally be excluded, DoD could still apply the requirements where sensitive systems, cybersecurity concerns, or controlled data are involved.
2. FOCI Review Goes Beyond Ownership Percentages
- The proposal does not focus solely on foreign ownership percentages. Instead, DoD and the Defense Counterintelligence and Security Agency (DCSA) would assess whether foreign persons could directly or indirectly influence management, operations, cybersecurity, or access to sensitive information.
- Relevant factors may include foreign investors, board members, executives, financing arrangements, affiliates, and foreign revenue sources.
3. Contractors Could Face Significant Disclosure Obligations
- Covered contractors would generally need to submit an SF-328 (Certificate Pertaining to Foreign Interests) and supporting documentation through the National Industrial Security System (NISS) before award.
- Supporting materials may include ownership charts, governance documents, foreign affiliation disclosures, and financial information.
- The proposed rule also includes ongoing reporting obligations during contract performance.
4. The Proposed Timelines Could Create Contracting Risks
- The proposal includes compressed timelines that may affect procurement planning and corporate transactions.
- For example, contractors may need to notify the government within three business days of certain FOCI-related changes and implement mitigation measures within 90 days if risk is identified.
- Importantly, contracting officers may be unable to award contracts or exercise options unless the contractor maintains an “eligible” status in NISS.
5. Contractors Should Begin Assessing Potential Exposure Now
- Although the rule has not been finalized, contractors should consider proactively reviewing ownership structures, governance arrangements, foreign affiliations, financing relationships, and overlap with CMMC, CUI, and export control obligations.
Comments on the proposed rule are currently due by July 6, 2026, and can be submitted at https://www.regulations.gov, under DFARS Case 2021-D011. The proposed rule was published in the Federal Register on May 7 and can be found here.
