The FOCI Requirements Are Coming to Unclassified Defense Contracts: What Contractors Need to Know

The U.S. government continues to intensify its focus on protecting the defense industrial base from foreign influence and supply chain vulnerabilities. Against the backdrop of heightened national security screening, increased scrutiny of foreign investment in defense-adjacent sectors, and growing bipartisan concern about adversarial nations’ access to sensitive technologies and information, the Department of War (formerly Department of Defense) has now proposed a significant expansion of Foreign Ownership, Control, or Influence (FOCI) requirements to reach contractors and subcontractors performing unclassified work. This proposed rule represents one of the most consequential regulatory developments for the defense contracting community in recent years, and contractors should take immediate steps to understand and prepare for its impact.

I. The Issue

On May 7, 2026, the Department of War issued a Proposed Rule (Federal Register Document No. 2026-09067) to implement Section 847 of the Fiscal Year 2020 National Defense Authorization Act (NDAA). The proposed rule would amend the Defense Federal Acquisition Regulation Supplement (DFARS) to require contractors and subcontractors on certain unclassified “covered contracts” to submit FOCI disclosures to the Defense Counterintelligence and Security Agency (DCSA) for risk assessment and, where applicable, agree to implement mitigation measures as a condition of award.

Scope of Covered Contracts. The rule applies to defense contracts and subcontracts valued in excess of $5 million. Contracts for commercial products and services would generally be excluded, unless a designated senior DoD official determines that the contract involves a risk or potential risk to national security due to sensitive data, systems, or processes. This means that a wide range of unclassified defense work (previously outside the ambit of FOCI scrutiny) may now be subject to DCSA assessment and adjudication of FOCI considerations prior to award.

Disclosure Mechanism. Disclosures will be made via DCSA’s Standard Form 328 (SF-328), “Certificate Pertaining to Foreign Interests.” DCSA approved a revised and expanded SF-328 on May 7, 2025. The SF-328 requires substantial disclosures related to ownership and control, foreign contracts and revenue, foreign officers and directors, foreign subsidiaries, and other indicia of foreign influence. DCSA follow-up inquiries can go significantly beyond what is required within the four corners of the SF-328 itself.

Award Eligibility and Mitigation. For covered procurements, offerors would need to submit the required SF-328 and supporting information through the National Industrial Security System (NISS) before award. If FOCI or beneficial ownership concerns are identified but may be mitigated, the offeror must agree at award to implement the identified mitigation strategy within 90 calendar days.

Applicability to Cleared and Uncleared Contractors. Critically, both cleared and uncleared defense contractors would be subject to these rigorous DCSA disclosure requirements. This is a transformative change for the many uncleared contractors and subcontractors who have never previously been required to make FOCI disclosures or submit an SF-328.

Scale of Impact. The proposed rule estimates that approximately 37,740 entities could be impacted, with roughly 21,511 (57%) estimated to be small businesses. 

II. Why Clients Should Care

The proposed rule carries significant practical and legal implications for government contractors across the defense industrial base:

• New Compliance Burden for Uncleared Contractors. Contractors and subcontractors on qualifying unclassified contracts who have never previously engaged with DCSA or completed an SF-328 will be required to develop entirely new compliance processes, internal data-gathering procedures, and organizational expertise to meet the disclosure requirements.
  
  
• Subcontractor Flow-Down. Prime contractors would need to ensure that subcontractors and suppliers awarded covered subcontracts exceeding $5 million have and maintain eligible status in NISS. The proposed clause also requires contractors to flow these requirements down to covered subcontracts and other contractual instruments exceeding $5 million, creating additional compliance and oversight obligations throughout the supply chain.
  
  
• Contract Award Delays. Because DCSA assessment and adjudication of FOCI considerations will effectively be required prior to contract award, contractors that are unprepared for the disclosure process risk significant delays in contract award timelines. Although DCSA has stated it is prepared for the anticipated influx of new submissions and has a plan for timely analysis, the sheer scale of newly covered entities may create bottlenecks.
  
  
• NISS Eligibility Becomes a Contracting Gatekeeper. The proposed rule would prohibit contracting officers from awarding, modifying, exercising an option, or otherwise extending a covered contract, task order, or delivery order valued in excess of $5 million unless the contractor or prospective contractor has an eligible status in NISS, subject to the commercial products and commercial services exception. As a result, maintaining NISS eligibility would become an ongoing business imperative, not merely a pre-award compliance requirement.
  
  
• Risk of Contract Ineligibility. Contractors with unresolved or unmitigated FOCI concerns may face barriers to contract eligibility or performance. Failure to disclose required information or implement mitigation measures could result in loss of eligibility for covered procurements.
  
  
• Expanded Mitigation Requirements. DCSA has increasingly required mitigation around foreign influence even where there is no effective foreign ownership or control, and this trend is expected to continue in Section 847 reviews. Contractors should anticipate that mere disclosure may not suffice; active mitigation measures (such as proxy agreements, voting trusts, board resignations, or special security agreements) may be required.
  
  
• Disproportionate Impact on Small Businesses. With an estimated 57% of affected entities being small businesses, many contractors with limited compliance infrastructure will need to develop new capabilities quickly to remain eligible for covered contracts.

III. Likely Timing

Current Status. The proposed rule was published in the Federal Register on May 7, 2026. Comments on the proposed rule were due on or before July 6, 2026, and will be reviewed before a final rule is issued.

Regulatory Background. This proposed rule has been long anticipated. DoD Instruction 5205.87, “Mitigating Risks Related to Foreign Ownership, Control, or Influence for Covered DoD Contractors and Subcontractors,” was issued on May 13, 2024, implementing Section 847 policies and establishing procedures for identifying and mitigating FOCI risks for certain DoD contractors and subcontractors. The contractor-facing DFARS rule had been pending since it was originally scheduled for completion in 2021. This proposed rule represents the long-awaited regulatory implementation.

Anticipated Timeline. Following the close of the comment period, the Department of War will review comments and issue a final rule. While the precise timeline for finalization is uncertain, the lengthy delay between the statutory mandate (FY 2020 NDAA) and this proposed rule suggests the Department intends to move expeditiously toward implementation. Contractors should plan for a final rule within the coming months and prepare accordingly.

IV. Additional Analysis

Interaction with Existing FOCI Frameworks. The traditional FOCI framework for classified contracts is governed by the National Industrial Security Program Operating Manual (NISPOM) and the facility clearance process. Under the existing regime, FOCI review and mitigation was triggered primarily by the need for a facility security clearance. The proposed rule extends FOCI-style scrutiny into the unclassified space for the first time on a broad scale, effectively creating a parallel track of DCSA oversight for contractors who may have no prior experience with the national industrial security apparatus.

Implications for M&A and Foreign Investment. The expansion of FOCI mitigation requirements has significant implications for mergers and acquisitions, private equity transactions, and foreign investment in the defense sector. Because FOCI mitigation instruments (such as proxy agreements, voting trusts, board resignations, and special security agreements) can be triggered by foreign ownership stakes, this expansion is directly relevant to:

• Private equity and strategic buyers with foreign investors or limited partners;
• Joint ventures involving foreign parties;
• Cross-border defense-sector M&A transactions; and
• Any transaction that could result in foreign ownership, control, or influence over an entity performing covered contracts.

Acquirers and investors will need to conduct earlier and broader FOCI diligence and mitigation planning pre-closing and pre-award for a much larger population of defense contractors and subcontractors, including many small businesses, than previously subject to DCSA scrutiny.

The Revised SF-328. Contractors who are already cleared but have not recently prepared an updated SF-328 using the newly revised form (approved May 7, 2025) should also familiarize themselves with its expanded requirements. The revised SF-328 requires more detailed disclosures than prior versions, and DCSA follow-up inquiries may probe significantly beyond the form’s four corners.

V. Why Clients Should Act Now

Given the scope and significance of this proposed rule, government contractors and defense industry participants should take proactive steps immediately:

• Assess FOCI Exposure. Contractors should conduct a thorough internal assessment of their foreign ownership, control, and influence profile. This includes reviewing corporate governance structures, investor relationships, board composition, foreign revenue streams, and any other factors that could give rise to a FOCI finding under the SF-328 framework.
  
  
• Prepare for SF-328 Submissions. Uncleared contractors and subcontractors on covered contracts without prior DCSA or SF-328 experience should begin preparing now to make the required disclosures. Early preparation will reduce the risk of award delays and adverse findings.
  
  
• Engage in the Comment Process. Although the comment period closed on July 6, 2026, contractors should monitor developments and engage with counsel to assess how the final rule may affect their operations, particularly if the rule’s scope, thresholds, or mitigation expectations evolve during the rulemaking process.
  
  
• Develop Internal Compliance Infrastructure. Contractors should begin building the internal processes, data-gathering mechanisms, and organizational knowledge needed to respond to DCSA inquiries efficiently and accurately once the rule is finalized.
  
  
• Evaluate M&A and Investment Implications. Companies considering transactions involving foreign investors or parties should assess how the expanded FOCI requirements may affect deal structure, timeline, and mitigation obligations.

The time to act is before the final rule takes effect. Contractors who wait until implementation will face compressed timelines, potential award delays, and heightened compliance risk.

How We Can Help

King & Spalding’s Government Contracts and National Security team has deep experience advising defense contractors, private equity sponsors, and strategic investors on FOCI-related matters, including DCSA engagement, SF-328 preparation and submission, FOCI mitigation instrument negotiation, and regulatory compliance strategy. Our team regularly counsels clients on the intersection of government contracts requirements, foreign investment review, and national security regulation.

We are prepared to assist clients in assessing their FOCI exposure, developing tailored compliance strategies, preparing SF-328 submissions, evaluating mitigation options, and navigating the evolving regulatory landscape as this proposed rule moves toward finalization. We also advise on the M&A and transactional implications of the expanded FOCI framework for buyers, sellers, and investors in the defense industrial base.

For more information about this client alert or to discuss how these developments may affect your organization, please contact a member of our Government Contracts and National Security team.