| Go-To Guide: |
|
On May 7, 2026, DoD published a proposed rule for Mitigating Risks Related to Foreign Ownership, Control, or Influence (FOCI Rule) under Title 48 of the Code of Federal Regulations. The FOCI Rule seeks to implement the directive for expanded FOCI and beneficial ownership disclosures under Section 847 of the FY2020 National Defense Authorization Act (see December 2025 GT Alert) and DoD Instruction 5205.87. The FOCI Rule would also amend DFARS by creating part 240 – Information Security and Supply Chain Security – and would add a new solicitation provision and contract clause.
The proposed FOCI Rule would apply broadly to unclassified contracts or subcontracts exceeding $5 million. Contracts at or below the simplified acquisition threshold would be exempt. Additionally, contracts using Federal Acquisition Regulation (FAR) Part 12 for commercial products and services, including commercially available off-the-shelf items, would be exempt unless a “designated senior DoD official” determined otherwise. DoD estimates that 37,740 contractors (and 21,511 small businesses, which make up 57%) would be impacted by the FOCI Rule, which is now subject to a 60-day public comment period.
New Provisions and Key Requirements
The proposed rule would introduce new DFARS provisions establishing a procedural framework for FOCI and beneficial ownership disclosures, risk assessment, and mitigation strategies. The key requirements, which span both pre-award and post-award stages, would be as follows.
Pre-Award Disclosure Requirements
The proposed FOCI Rule would create a new solicitation clause at DFARS 252.240-70XX, under which offerors would be required to submit their Standard Form 328, Certificate Pertaining to Foreign Interests (SF-328), to the National Industrial Security System (NISS). The latest SF-328 was released and went into effect on May 12, 2025. DFARS 252.240-70XX would require offerors to represent, at offer submission, that they have already submitted SF-328 to NISS, provided contact information of each beneficial owner, and confirmed that the information is current, accurate, and complete. Additionally, DFARS 252.240-70XX would put offerors on notice of any determination by the requiring activity that an offeror’s FOCI or beneficial ownership poses a national risk based on feedback from the Defense Counterintelligence and Security Agency (DCSA). In such event, the offeror must agree at time of award to implement a risk mitigation strategy within 90 days.
Contract Performance Obligations
The new proposed contract clause at DFARS 252.240-70YY would create several procedural and reporting requirements. Offerors would be required to agree to the NISS-identified risk mitigation strategies at the time of award, option exercise, modification, or identification of post-award changes, and to implement those mitigation strategies within 90 days of the relevant contract activity. Contractors would also be required to complete, update, and verify their SF-328 and supporting documents with NISS before contract modification or renewal, or when there were changes to information previously provided. Contractors also would need to report changes in their FOCI or beneficial ownership during contract performance and might be subject to additional risk mitigation strategies as recommended by NISS. Additionally, these requirements would be flowed down to subcontractors and suppliers that are also awarded subcontracts, at any tier, exceeding $5 million.
Contracting Officer Procedures
Under the newly proposed section 240.27X procedures, contracting officers would also have procedural compliance requirements to implement the disclosures and risk mitigation requirements. Contracting officers would be directed to withhold contract award, modification, or exercise of an option unless the offeror or performing contractor has an eligible status in NISS (https://niss.dcsa.mil). Subcontractors and suppliers working on subcontracts exceeding $5 million would also need to maintain an eligible status in NISS.
Takeaways
The FOCI Rule would significantly expand DCSA’s scope of review, which has historically focused on contractors performing on classified contracts. The proposed rule would extend upfront documentation and disclosure requirements at the pre-award stage to non-cleared offerors (and their subcontractors) and implement continuing obligations throughout contract performance. Contractors would have limited time to negotiate and implement risk mitigation strategies, which could influence how contractors approach offer submissions and phase-in efforts. While industry stakeholders may call into question DCSA’s capacity to absorb this increased workload, contracts for commercial products and services would generally be exempt from DCSA’s review.
The FOCI review expansion is grounded in statute (Pub. L. No. 116-92 (Dec. 20, 2019), § 847). Accordingly, the FOCI Rule could be implemented absent a change in law, potentially bringing thousands of new DoD procurements under pre-award vetting requirements. Interested parties may wish to consider submitting comments by July 6, 2026.