Defense Federal Acquisition Regulation Supplement: Mitigating Risks Related to Foreign Ownership, Control, or Influence
FOCI Status
Published
Who this applies to
Any DoD contractor or subcontractor bidding on contracts or subcontracts valued over $5 million.
What we know
The proposed rule is set to expand FOCI determinations from ~2,000 to ~40,000 defense contractors. Even if a company is 100%, U.S. owned, the company will still be required to submit an SF-328 and receive an eligibility status in NISS. Additionally, the rule will not only apply to primes as the current FOCI rule is designed. Both primes and subcontractors will be impacted by the expansion rule, and primes will be responsible for ensuring their suppliers are eligible in NISS before awarding a subcontract.
That said, the public comment period raised a few concerns about the proposed rule, main themes focused on the quick mitigation timelines and the ability for primes to receive and verify relevant FOCI information from suppliers. We expect the Final Rule to address these concerns by amending the current language.
What we don't know yet
DCSA indicated they were expecting a Final Rule by October 1, 2026. However, this timeline seems unlikely, even with the limited number of public comments.
What to do now
- Familiarize yourself with Standard Form 328.
- Discuss your potential exposure to a FOCI mitigation agreement by talking with an expert.
- If owned by a foreign-parent, begin mapping what systems they have access to and how creating a separate IT environment could impact operations.
ISI's read
The FOCI expansion rule is expected to largely impact companies handling CUI, since it is focusing on companies with access to sensitive data, systems, or processes. Companies will need to account for satisfying both FOCI and CUI safeguarding requirements when remediating or building a new technical environment to ensure their day-to-day business operations are not impacted, or need to be rebuilt once the Final Rule is in effect.
Our expert read is opinion, not fact.
Learn more about the proposed FOCI expansion rule.
Read moreStatus history
Every change ISI has logged for FOCI, newest first. Dates are when the event happened, not when it was recorded.
-
Public comment period closes on the proposed FOCI rule.
What changed
The proposed rule received 37 comments, largely from industry organizations. The themes largely focused on support for an expanded program but concerns around mitigation timelines and prime supply chain requirements were brought to the surface.
Why it matters
While the concerns raised were valid, the number of total comments received may be indicative of the lack of awareness of the rule and its impact. It’ll be vital to continue educating the defense industrial base on what will be expected of them when the rule is in effect to minimize disruption to the national defense supply chain.
Source: Regulations.gov, DARS-2026-0133 Federal Register
-
Proposed FOCI expansion rule published into the Federal Register.
Status set to Proposed
What changed
The proposed rule is set to expand FOCI requirements to ~40,000 prime and subcontractors. Unlike the current FOCI rule, this will apply to all defense companies bidding on contracts valued over $5 million.
Why it matters
All companies bidding on defense contracts worth more than $5 million will have to submit the SF 328 form. Even if your company is 100% US-owned, your company will need to be listed as eligible in NISS. For uncleared contractors with a FOCI determination, they will need successfully mitigate their FOCI to an acceptable level (as determined by DCSA), which may impact their current operations.
Source: Federal Register, DFARS Case 2021-D011 Federal Register
Questions contractors are asking
Who will be impacted by this rule?
All defense contractors bidding on prime or subcontracts worth more than $5 million. Even if your company is 100% US-owned, your company will need to go through the determination process by filling out the SF 328 and create an account in NISS. While the focus will be on companies with foreign investment or ownership, the scope of the rule’s impact goes well beyond those needing a mitigation agreement.
Is the $5 million threshold related to income or contract value?
The rule will be applied on individual contracts worth more than $5 million. So if your company has $5 million revenue from unclassified contracts, and work on multiple contracts, the expansion rule should not apply to your business.
Does this rule impact contract eligibility?
Yes, contractors will need to be listed as eligible in NISS before accepting award of a defense contract valued at $5 million or more. If your company is not listed as eligible in NISS, you will not be eligible to work on the contract.
In terms of supply chain, you do not need to validate your supply chain ahead of determining your eligibility. However, as the rule is written now, primes will need to verify their subcontractors are also eligible in NISS ahead of awarding them a $5 million subcontract.
What is the SF 328?
The Standard Form 328 is a nine question document designed to determine whether FOCI exists and at what level of ownership, control, or influence that company is subject to. It is the basis for DCSA determining which mitigation instrument will best apply to the business to ensure American interests and intellectual property is protected from foreign interests.