Skip to content
Talk to an Advisor
Talk to an Advisor
Written by: Andrew Lotwin | Senior Vice President, Federal

What the FAST Study Means for Small and Non-Traditional Defense Firms

Listen: What the FAST Study Means for Small and Non-Traditional Defense Firms
7:15

Executive Brief

Small and non-traditional firms are central to the push to field defense technology faster. The security process they must pass through was designed decades before they arrived.

A MITRE study sponsored by the Office of the Under Secretary of War for Intelligence and Security (OUSW(I&S)) measured the cost of that mismatch. The Department of Defense (DoD) and the Defense Counterintelligence and Security Agency (DCSA) are now responding, and this blog separates what the study found from what’s changing.

In this blog, you’ll find:

  • The key findings from the MITRE Fast-Tracking Acquisition Security Transformation (FAST) study that affect small and non-traditional firms
  • How DCSA is responding, matched to each finding
  • The timelines to watch as new tools and forms roll out
  • Practical steps to prepare now

Dig deeper below to learn more.

What the FAST Study Found

The FAST study gathered input from 6,734 security industry leaders, practitioners, and innovators across 105 organizations between July and November 2025. Its full report identifies 74 challenges in five areas and 155 recommended government actions. The findings are MITRE's own analysis, independently peer reviewed, and are not official government policy.

Findings most relevant to small firms:

  • FOCI reviews run long. The process for resolving Foreign Ownership, Control, or Influence (FOCI) issues can routinely extend beyond 40 weeks
  • Security direction arrives late. DD Form 254, the form that justifies a company's need for classified access, often appears after solicitation, forcing teaming and design decisions without full security direction
  • Existing rules are applied inconsistently. Many delays trace to uneven application of current requirements within a National Industrial Security Program (NISP) built in 1993
  • Newer entrants carry the burden. Small businesses and non-traditional contractors often lack the resources to navigate long, unpredictable processes
  • More pressure is coming. Section 847 of the National Defense Authorization Act (NDAA) adds FOCI assessments that could further stress the system

The study keeps security standards in place and targets how requirements are applied. Its recommendations include modernizing DCSA's tools and moving security requirements into the pre-award phase.

How DCSA Is Responding

At the 2026 Virtual DCSA Security Conference, DCSA and OUSW(I&S) shared updates that map to those findings. These updates below come from the conference sessions, separate from the study itself.

MITRE's November briefing at the 2026 Joint National Defense Industrial Association (NDIA)/AIA Fall Industrial Security Conference reported that government is beginning to act on the study's recommendations, with visible progress on entity eligibility language, pre-award sponsorship, DCSA consistency, and FOCI expansion preparation. Some recommendations have not yet shown movement.

  • FOCI reviews run long.
    • DCSA update: Monthly case inventory is down by roughly 500 since August 2024, and average facility clearance (FCL) issuance sits at 50 days
    • DCSA update: Revised Certificate Pertaining to Foreign Interests (SF-328) instructions use question-specific guidance and drop required 13D/13G documentation for publicly traded companies
    • DCSA update: A Classified Start-Up Ramp Initiative gives venture-backed small businesses in critical and emerging technology the same security standard with earlier access
  • Security direction arrives late.
    • DCSA update: The DD Form 254 system within the National Industrial Security System Increment Two (NI2) is the NISP Contract Classification System (NCCS), which centralizes creating, routing, and issuing the form. DCSA plans to incorporate NCCS advances alongside other NI2 updates over the next year
    • November 2026 Update: Proposed manual wording clarifies that agencies can sponsor companies in the competitive range before award, and NI2 is expected to let companies submit entity eligibility packages before award
  • Section 847 will add more pressure.
    • DCSA update: NI2 targets a December 2026 FOCI capability build and February 2027 deployment, with an Individual Engagement Platform in FY27 Q1 that lets contractors submit FOCI documentation before a bid without government sponsorship
    • November 2026 Update: The related Defense Federal Acquisition Regulation Supplement (DFARS) rule is still pending, and industry continues to ask for clear implementation guidance

Dates are DCSA targets and may shift. With so many ambitious DCSA plans in motion over the next year, government and industry alike will benefit from staying informed on the latest developments and updates. Terminology and review-cycle changes from the same effort are covered in our recent posts.

Andrew Lotwin, ISI Senior Vice President, Federal, says, "The MITRE FAST study is more than a roadmap for improving industrial security, it's an opportunity to transform DCSA into a more responsive, risk-informed partner that strengthens the defense industrial base rather than simply regulating it.”

What Small Firms Can Do Now

  • Keep organization charts, ownership records, and foreign agreements current and consistent across documents
  • Review the updated SF-328 instructions before your next submission
  • Ask your prime or contracting officer when the DD Form 254 and security requirements will be available
  • Share specific examples of what is working and what is not through the National Industrial Security Program Policy Advisory Committee (NISPPAC), NDIA, or directly with OUSW(I&S), and stay current on DCSA's updates as plans roll out over the next year
  • Report changes promptly and review how to maintain a facility clearance
  • Avoid the package errors covered in The Facility Clearance Bottleneck

FAQs

What is the FAST study?

A MITRE study funded by OUSW(I&S) that analyzed how security requirements affect the Defense Industrial Base's speed and access.

When does pre-award FOCI review begin?

DCSA targets December 2026 for the capability build and February 2027 for deployment. Dates may shift.

Can I submit FOCI documentation without a sponsor?

DCSA plans an Individual Engagement Platform for FY27 Q1 that allows pre-bid submissions without government sponsorship.

Helpful ISI Links

Reference Resources

 

Related Posts