5 Takeaways from the 2026 NDIA/AIA Fall Industrial Security Conference

Executive Brief

The Defense Counterintelligence and Security Agency (DCSA) is heading into a defining stretch. Many of its technology roadmaps converge in fiscal year (FY) 2027.

Andrew Lotwin, ISI Senior Vice President, Federal, attended the 2026 Joint National Defense Industrial Association (NDIA) and Aerospace Industries Association (AIA) Fall Industrial Security Conference. Here’s what cleared contractors need to know:

• DCSA leadership is focused on delivering two systems: National Background Investigation Services (NBIS) and the National Industrial Security System Increment II (NI2)
• DCSA’s strategic plan looks out only two years, which signals how much weight sits on near-term delivery
• NI2 replaces the National Industrial Security System (NISS) in March 2027, and Facility Security Officers (FSOs) will feel the change first
• Foreign Ownership, Control, or Influence (FOCI) expansion begins in December 2026 with a gradual ramp-up, and most companies will need an updated Standard Form 328 (SF-328)
• Security reviews are set to rise from around 4,500 to 6,000 per year
• Personnel vetting moves to Trusted Workforce 2.0 (TW 2.0), and the RapBack fingerprint deadline arrives in December 2027

Dig deeper below to learn more.

Why This Year Matters

NBIS and NI2 face a make-or-break year. DCSA leadership is fully committed to delivering the new capabilities and workflows in both systems.

• NI2 is slated to become the single system of record for facility clearances, FOCI reviews, and National Industrial Security Program (NISP) oversight
• In February 2026 testimony to Congress, DCSA’s acting director said the agency plans to deploy core NBIS shared services by the end of 2027 and operationalize the end-to-end Trusted Workforce 2.0 model by the end of 2028
• ISI Insight: Delivering new systems on an ambitious schedule makes testing a point worth watching. Early and ongoing testing with the people who use these systems helps keep quality and functionality strong as capabilities go live. The Government Accountability Office (GAO) has also noted the value of engaging end users throughout NI2 development

What to do: Build extra time into any filing or submission that depends on these systems and keep records outside them.

1. NI2 Replaces NISS in March 2027

The shift: DCSA plans to shut down NISS in March 2027. NI2 reaches initial operating capability (IOC) that month, with full operating capability (FOC) targeted for late 2027 (FY28).

• FSOs know NISS, and many will feel the change
• NI2 will touch all aspects of industrial security activity, performance, and oversight
• DCSA maintains a NI2 resource page with transition guides and registration details

What to do: Confirm every FSO and Assistant FSO has the access they need, and schedule internal training before the cutover.

2. FOCI Expansion Starts in December 2026

FOCI expansion efforts move up to December 2026 (from January 2027) and start with a gradual ramp-up. A select group of companies goes first, and full implementation follows in March 2027:

• Most companies, if not all, will need to submit an updated SF 328
• ISI Insight: this message isn’t well understood across industry yet
• Uncleared companies will be able to obtain NI2 accounts and submit a facility clearance (FCL) package before they hold a classified contract
• That early access gives primes and their subcontractors a head start

What to do: Review your ownership structure and company financial arrangements, foreign relationships, and SF-328 now.

3. Security Reviews Change Drastically

DCSA projects security reviews to grow from around 4,500 to 6,000 per year.

• Safeguarding facilities and higher-risk companies receive annual reviews
• All other companies receive reviews at least every 36 months
• About 8,000 of the 12,000-plus companies in the NISP are non-safeguarding
• More reviews per year means cleared companies can expect Security Reviews more often
• The Industrial Security Directorate is exploring a more automated approach to aligning, scheduling, and assigning Industrial Security Representatives (ISRs) to supported companies
• Major change: All actions will take place in NI2 for transparency, which reshapes how FSOs and DCSA communicate day to day

What to do: Treat your self-inspection program as year-round readiness and set up NI2 accounts and a process for tracking actions and deadlines inside the system. Test your readiness with our Industrial Security Readiness Quiz.

4. The RapBack Fingerprint Deadline Is December 2027

Add the RapBack fingerprint deadline of December 2027 to your must-do list.

• Start by confirming which cleared personnel still need fingerprint enrollment
• Assign an owner and a completion date well ahead of the deadline

5. Personnel Vetting Moves to Trusted Workforce 2.0

The five-tier model becomes three tiers, periodic reinvestigations go away, and continuous vetting moves to TW 2.0.

• ePreliminary, the interim clearance process, is already creating challenges for hiring and workforce management
• DCSA hasn’t announced a fix date

What to do: Plan hiring timelines with interim clearance delays in mind and keep leadership informed of onboarding risk.

Bonus Takeaways

6. NIST SP 800-53 Revision 5 enforcement is coming. Companies with classified networks and information systems should expect enforcement of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5. Authorizations to operate (ATOs) will be shortened or denied for systems that fall short. Strong documentation habits help here, just as they do for Cybersecurity Maturity Model Certification (CMMC).

7. SEAD 4 updates are expected in FY27. Security Executive Agent Directive 4 (SEAD 4) adjudicative guidelines are expected to be revised. Likely topics include drug use, financial risk, social media conduct, and foreign contacts.

How ISI Can Help

Our FSO and Clearance Services team supports contractors through system transitions, FOCI filings, and review preparation.

• Dedicated Assistant FSOs and security specialists who integrate with your team
• Scalable support during growth, turnover, and contract transitions
• Alignment between industrial security duties and who is responsible for protecting CUI in your organization

FAQs

When does NI2 replace NISS?

DCSA plans to shut down NISS in March 2027, when NI2 reaches initial operating capability. Full operating capability is targeted for late 2027.

Does my company need to update its SF 328?

Most, if not all, companies will need an updated SF 328 as FOCI expansion rolls out. A select group begins in December 2026, with full implementation planned for March 2027.

How often will DCSA conduct security reviews?

Safeguarding facilities and higher-risk companies receive annual reviews. All other companies receive reviews at least every 36 months.

What is the RapBack deadline?

The RapBack fingerprint deadline is December 2027. Confirm your enrollment status well before then.

Can uncleared companies use NI2?

Yes. Uncleared companies will be able to obtain NI2 accounts and submit an FCL package before they hold a classified contract.

Helpful ISI Links

• FOCI Expansion Rule: Will the Government and Industry Be Ready by October 1?
• Who Is Responsible for Protecting CUI
• What Should Be in Your System Security Plan (SSP) for CMMC Level 2?
• CMMC Is Not a Cyber Problem. It’s a Business Risk Issue
• Determine Your Industrial Security Check (Quiz)

Reference Resources

• DCSA: NI2 (National Industrial Security System, Increment II)
• GAO-26-107861: Industrial Security Report