FOCI EXPANSION RULE: WILL THE GOVERNMENT AND INDUSTRY BE READY BY OCTOBER 1?

Executive Brief

The Department of Defense (DoD), also known as the Department of War, is expected to expand foreign ownership reviews to tens of thousands of unclassified contracts by Q4 of this year. But the system built to process those reviews isn't quite there yet.

• According to the Defense Counterintelligence Security Agency (DCSA), they’re expecting the final Foreign Ownership Control and Influence (FOCI) expansion rule by October 1, 2026
• This would expand FOCI reviews to ~35,000 nonclassified contracts
• The system designated to show a company’s compliance and eligibility, the National Industrial Security System Increment II (NI2) has deployed some capability, but it has not been shared how the classified and unclassified defense industry entities will operate on this platform in support of the 847 program

Why it matters: If you've never dealt with FOCI mitigation because you don't hold a classified contract, that's about to change, and the platform you'll depend on is still in an undetermined state of deployment. But don’t let technology hold you back from preparing for what’s inevitably coming.

Dig deeper and continue reading below!

The rule, in brief

DoD's proposed DFARS rule (Case 2021-D011) implements Section 847 of the FY2020 NDAA and Section 819 of the FY2021 National Defense Authorization Act (NDAA).

• What it requires: Covered contractors disclose beneficial ownership and FOCI status to the DCSA, with updates any time that status changes.
• Who's covered: Any DoD contract or subcontract over $5 million, at any tier, unclassified included.
• Why that's new: FOCI review has historically applied only to cleared contractors handling classified work.
• The scale: ~37,740 potentially impacted entities. 57% are small businesses. DCSA annual FOCI caseload is projected to jump from ~2,000 to 40,000+.
  
  

Where it stands

• Comment period closed on July 6, 2026.
• As of this week: 36 comments filed on regulations.gov.
• DCSA expects a final rule by October 1, 2026.
  
  

The October 1 timeline: where uncertainty remains for nonclassified contractors

The big one: this rule doesn't just add a form. It puts NISS eligibility in the award path itself.

• No eligible status, no award. A new procedural requirement (DFARS 240.27X-4, plus a conforming change to 217.207) blocks contracting officers from awarding, modifying, or exercising an option on a covered contract without an eligible NISS status.
• It's not a one-time check. That gate applies at award and every subsequent contract action.
• The clock resets. The proposed clause's 90-day mitigation deadline restarts after each triggering action, including risk identified mid-performance. Clearing review at award doesn't mean you're clear for good.
• Disclosure is continuous. SF-328 has to be updated in NISS before any mod or renewal.

The process, for a company doing this for the first time:

• Submit beneficial ownership and FOCI data via SF-328 into DCSA's system of record.
• DCSA has 25 working days to issue a Risk Indicator Report or full FOCI Assessment.
• Mitigation is discretionary, not pass/fail — DCSA can accept the risk, require a mitigation agreement, or recommend against award.

None of that 25-day clock includes the time it takes a company with no FSO and no NISS account to get registered in the first place.  

The NI2 challenge  

 Zoom out, and the timing leads to complexities and concerns:  

• NI2 launched Jan. 30, 2026, but that first release was contract classification (NCCS migration), not FOCI.
• DCSA's June 2026 Voice of Industry newsletter confirms the NI2 FOCI Risk Mitigation team just held its "kickoff and registration walkthrough" in DCSA's words, to prepare for "the upcoming DFARS updates expected by October 1, 2026."
• Separately, DCSA's Strategic Execution Plan plans on having NI2 fully operationally and universally adopted by the end of FY 2027.

Bottom line: DCSA is still working out NI2's kinks, and that's the opportunity, not just the risk. A system still in its onboarding phase is a system without a backlog yet. Contractors who familiarize themselves with NISS, file a clean SF-328, and get their ownership story straight now will be first in line when the queue starts moving — instead of learning the process for the first time under a live award deadline.  

What to do now

• Map your ownership structure. Any foreign investor, minority stakeholder, or foreign board member is now a disclosure item.
• Draft your SF-328 now — before it's tied to a live award deadline.
• Familiarize your company with the NISS registration process, to ensure you can hit the ground running when this clause hits your contract.
• Expect flowdown pressure early. Primes are already expected to ask subs for NISS eligibility and SF-328 status ahead of the final rule.
  
  

About ISI

 ISI helps DIB contractors navigate CMMC, personnel security, and now FOCI mitigation readiness. New to NISS or unsure where you stand under Section 847? Reach out before the rule — and the clock — go live.