Not sure where your foci risk stands?
A new FOCI rule could pull up to 40,000 defense contractors into DCSA review. Spend 20 minutes with Cate Pearson, ISI President, Managed Security Services, to find out if you're exposed.
Executive Brief
Every facility security clearance (FCL) application starts with one form. The Standard Form (SF) 328, Certificate Pertaining to Foreign Interests, tells the government who owns, controls, and influences your company.
The Defense Counterintelligence and Security Agency (DCSA), the agency within the Department of Defense (DoD) that grants facility clearances, builds its Foreign Ownership, Control, or Influence (FOCI) review around your answers. Knowing the steps ahead of time keeps surprises to a minimum.
- Who files: first-time FCL applicants, companies seeking an FCL upgrade, and cleared entities reporting a material change, and all companies on an annual cycle under the July 2026 update
- What changed: DCSA deployed a revised nine-question SF-328 on May 12, 2025, with expanded disclosure instructions and there is now a newer version of the form as of July 2026
- What DCSA decides: whether FOCI exists, how much risk it carries, and what mitigation would make it acceptable
- Mitigation options: range from a board resolution to a proxy agreement, depending on the level of foreign involvement
- Best preparation: a complete ownership picture, consistent documents, and a named owner for the filing
Dig deeper below to learn more.
What is SF-328?
The SF-328 is the government’s primary instrument for identifying whether a company is under FOCI.
- Companies file it through DCSA’s National Industrial Security System (NISS) as part of the FCL package
- The Senior Management Official (SMO) completes the form, while the Facility Security Officer (FSO) often manages the program day to day and legal counsel frequently supports the filing. See our guide on what every FSO and executive needs to know about FOCI compliance.
- A completed SF-328 is Controlled Unclassified Information (CUI), so handle drafts and supporting files accordingly. Our post on who is responsible for protecting CUI explains ownership of that duty.
- The rules sit in Title 32 of the Code of Federal Regulations (32 CFR) Part 117, also known as the National Industrial Security Program Operating Manual (NISPOM) rule.
When Do You File?
DCSA requires a new or updated SF-328 in these situations:
- An initial FCL application
- An FCL upgrade request
- A change in FOCI considerations that affects previously submitted answers
- A change in ownership that creates a new excluded parent
- Negotiating or renewing a FOCI mitigation agreement
- Annual FOCI reporting for all cleared companies
- FOCI vetting for certain unclassified contracts under the Defense Federal Acquisition Regulation Supplement (DFARS) rule implementing Section 847 of the FY2020 National Defense Authorization Act (NDAA)
What Changed in the May 2025 and July 2026 Forms?
DCSA expects the revision to reduce follow-up questions by clarifying what it needs on the first submission.
- The form now has nine questions, down from ten. The prior version dated November 2018, according to ClearanceJobs
- All companies on an annual cycle now must file an SF-328 under the July 2026 update
- Expanded instructions call for more detailed disclosures about ownership, governance, and foreign funding
- A new Statement of Full Disclosure of Foreign Affiliations applies to management personnel who hold positions with, or consult for, foreign entities
- Taft also reports a lower threshold for foreign-sourced revenue disclosure, from 30% to 15%
- Existing filings do not need resubmission solely because the form changed
The Process, Step by Step
- Secure sponsorship. A government customer or prime contractor sponsors the FCL. DCSA then opens the process for your entity.
- Map your ownership and control. Build an organizational chart that traces ownership up to the ultimate parent, and list Key Management Personnel (KMP), board members, and officers.
- Gather supporting documents. Corporate governance documents, ownership records, and details on foreign customers, suppliers, lenders, and affiliations all feed the answers.
- Complete and certify SF-328. The SMO signs after counsel and the FSO confirm that every answer matches the supporting documents.
- Submit through NISS. The SF-328 goes in with the rest of the FCL package.
- DCSA reviews the package. This is a multi-stage internal review that includes the Facility Clearance Branch, a DCSA field office, and headquarters analysis units. Expect clarification requests along the way.
- DCSA makes a FOCI determination. Under 32 CFR 117.11, DCSA weighs eight factors to decide whether FOCI exists and what risk it carries.
- Mitigation is negotiated if needed. An entity under FOCI is ineligible for access to classified information until effective security measures are in place.
- You maintain the filing. Material changes trigger an updated SF-328 and, when ownership shifts, a fresh look at mitigation.
Timing Expectations
- A briefing at the 2026 Virtual DCSA Security Conference placed the average facility clearance process at 3 to 9 months, from sponsorship through DCSA granting the FCL
- Mitigation adds negotiation and implementation steps, so timing varies with ownership structure and the instrument DCSA requires
- An existing clearance can continue during good-faith mitigation talks, although DCSA retains the authority to invalidate it
- Our webinar, When FOCI Stops the Deal, covers how transactions trigger FOCI reviews
Mitigation Instruments at a Glance
DCSA decides which instrument applies, and it can alter the standard templates based on the risks it identifies.
- Board Resolution: for lower levels of FOCI, where the foreign owner cannot elect a director or claim board representation
- Special Board Resolution (SBR): for minority foreign interests with no board representation, where DCSA finds the risk too significant for a basic board resolution. It adds SCA-like requirements, including disclosure schedules, annual certification to DCSA, and a Technology Control Plan (TCP) and Quality Management Plan (QMP) built into the resolution itself
- Security Control Agreement (SCA): the foreign interest does not hold effective control and receives board representation
- Special Security Agreement (SSA): a higher level of foreign involvement, with outside directors approved by DCSA on the board
- Voting Trust and Proxy Agreement: the most restrictive options, which transfer voting rights to cleared trustees or proxy holders
- Supplemental plans such as a Technology Control Plan or Visitation Plan often accompany the agreement
Common Pitfalls
- An ownership chart that stops short of the ultimate parent
- Answers that conflict with governance documents or other filings
- Foreign suppliers and customers left off the form. We advise that it’s always best to report foreign involvement up front
- KMP foreign affiliations missing from the new disclosure statement
- Delays in updating the SF-328 after a new investor, board change, or acquisition
- Treating the filing as paperwork for one person, with no review across legal, security, and executive teams
Prepare Before You File
- Name one owner for the SF-328 and a backup
- Build the ownership and control chart first, then confirm every entity on it
- Collect governance documents, cap tables, and investor agreements in one repository
- Inventory foreign customers, suppliers, lenders, and affiliations
- Collect the new affiliation disclosures from KMP early
- Have counsel and your FSO review the final package side by side with the source documents
- Set a trigger list for changes that require an updated SF-328
Terminology Updates on the Horizon
Presenters from the Office of the Under Secretary of War for Intelligence and Security (OUSW(I&S)) outlined reforms at the 2026 Virtual DCSA Security Conference.
- Facility Clearance (FCL) is slated to become Entity Eligibility Determination (EED), and FSO to Entity Security Officer
- Presenters described the changes as administrative language updates that leave underlying requirements in place
- The DoD Manual 5220.32 rewrite remains in coordination with no firm publication date
- Direct implementation questions to your Industrial Security Representative (ISR) until the manual publishes
How ISI Helps
Our FSO & Clearance Services team supports contractors through FCL sponsorship milestones, FOCI advisory and mitigation, and ongoing program coverage.
Facility Control, available as an add-on to an FSO and clearance engagement, guides SF-328 completion and builds DCSA-ready organizational charts that meet NISPOM and FOCI standards.
The platform flags inconsistencies across documents and disclosures before submission, and an experienced ISI security professional can review the package
FAQs
What is the SF-328?
The SF-328, Certificate Pertaining to Foreign Interests, is the form DCSA uses to evaluate whether a company is under FOCI and what mitigation may be needed.
Do I need to resubmit my SF-328 because of the May 2025 update?
No. DCSA does not expect a new submission solely because the form changed. You file the current version for initial FCL applications, upgrades, material changes, a new excluded parent, or mitigation renewals.
Who signs the SF-328?
The Senior Management Official certifies the form. The FSO and legal counsel commonly help prepare it.
What happens if DCSA finds FOCI?
The outcome depends on whether your company already holds an FCL. An uncleared company needs effective mitigation in place before it can access classified information. A company that is already cleared generally continues to operate as usual while mitigation is negotiated in good faith, although DCSA retains the authority to invalidate the clearance. In both cases DCSA determines the instrument, which can range from a board resolution to a proxy agreement.
How long does the process take?
DCSA briefings place the average facility clearance process at 3 to 9 months. Mitigation can extend that range depending on your structure.
