This post is based on our recent webinar, When FOCI Stops the Deal: A Guide for FSOs and Executive Teams. Watch the full recording before digging deeper below.
Foreign Ownership, Control, and Influence (FOCI) is one of the most consequential compliance areas for any company holding – or pursuing – a facility clearance. A FOCI determination can shape board structure, slow contract performance, and in some cases stop a deal entirely.
Key things to know:
Dig deeper below to learn more.
FOCI is the standard the U.S. government uses to determine whether a company can be trusted with national security information.
FOCI reviews are central to the facility clearance process. They begin with the SF-328, which is submitted to DCSA for evaluation.
DCSA reviews the form to determine the level of foreign risk, looking at:
As Paul Michaels, CEO of Monoc Securities LLC and a longtime industrial security professional, put it: "Traditionally, DCSA really focused on ownership and control. But lately, over the last couple of years, they have really started to focus in on influence."
Ownership thresholds matter, but they are not the only thing DCSA looks at. Companies tied to adversarial nations sometimes acquire a small stake – below the threshold that triggers a mandatory report – but negotiate board seats, access to intellectual property, or financial review rights that provide meaningful control without crossing the ownership line.
Influence is murkier. It can include:
Under 32 CFR Part 117, the legal responsibility for FOCI compliance sits with the Senior Management Official (SMO) – typically the president, CEO, or executive director of the cleared entity.
In practice, the FSO often manages the FOCI program day-to-day on behalf of the SMO. Legal counsel also frequently plays a significant role, particularly when completing and updating the SF-328.
"When we are talking legal responsibility, it belongs to the company and it belongs to the SMO," says Michaels.
The SF-328 must be kept current. Any significant organizational change – sales, acquisition, board restructuring, the addition of foreign nationals in key roles — triggers a new FOCI review. Companies are responsible for submitting updates proactively. DCSA will not tell you when to update it.
The SF-328 is the primary document DCSA uses to evaluate FOCI. It must be submitted at the start of the facility clearance process and updated whenever material changes occur.
DCSA released an updated SF-328 on May 1, 2025. If your last submission predates that version, plan to review it carefully — the form has changed in ways that matter:
Since the updated form was released, DCSA has reported a 17% drop in the rejection rate for initial and upgrade FCL packages.
Beyond the initial clearance, FOCI reviews are also triggered by:
When DCSA identifies FOCI, it has five risk treatment approaches available:
Most cleared contractors with FOCI end up on the mitigate path. Of the roughly 13,129 cleared facilities under DCSA cognizance today, about 920 (7%) operate under a FOCI Action Plan.
For companies on the mitigate path, DCSA works with the company to determine the appropriate mitigation instrument based on the level of foreign risk. Common instruments include:
DCSA works from standard templates but tailors mitigations to the specific risk. The most consistent guidance from experienced practitioners: accept the DCSA templates as written. Deviating from them triggers additional review layers and adds significant time to the process. Get your facility clearance in place, prove your compliance posture, and pursue changes later.
Whether you currently hold a facility clearance or are planning to pursue one, there are steps worth taking today:
The FOCI process rewards transparency. Companies that are upfront with DCSA, submit accurate documentation, and work within the templates tend to move through mitigation faster and with less friction.
The SMO — typically the company's president or CEO — is legally responsible. The FSO often manages the program in practice, and legal counsel frequently plays a key role in completing the SF-328. DCSA will not notify companies when updates are required. It is the company's obligation to self-report any material changes.
There is no standard timeline. The process depends on the complexity of the FOCI, the level of foreign risk, whether KMP are already cleared, and how closely the company works within DCSA's templates. Deviating from standard templates adds time. Transparency and cooperation with DCSA reduce it.
The form was condensed to nine questions, the Q7b reporting threshold for foreign interest ownership was lowered to 15%, "binding authority" was added to Q4 as a control mechanism, and a Statement of Full Disclosure of Foreign Affiliations is now required for any management-level individual with foreign affiliations. DCSA has reported a 17% drop in rejection rates since the updated form took effect.
Be transparent with DCSA. Companies that try to minimize or obscure their FOCI tend to end up with the most restrictive mitigation instruments. Companies that are upfront have more flexibility and move through the process more efficiently.