Key Notes:
- Under new proposed rule, FOCI disclosure and mitigation requirements would expand beyond classified contracts for the first time.
- The rule would cover DOD contracts and subcontracts over $5 million, affecting an estimated 37,740 entities.
On May 7, 2026, the Department of Defense (“DOD”) published a proposed rule that would dramatically expand the scope of Foreign Ownership, Control, or Influence (“FOCI”) requirements across the defense industrial base. The rule would amend the Defense Federal Acquisition Regulation Supplement (“DFARS”) to implement Section 847 of the FY 2020 National Defense Authorization Act (“NDAA”) and Section 819 of the FY 2021 NDAA. In this client alert, we discuss what is changing, who is affected, and how contractors should respond.
What Is FOCI and How Does It Work?
The U.S. government uses the FOCI framework to assess whether a foreign person, company, or government is positioned to affect how a U.S. defense contractor operates or makes decisions. Each element of the FOCI framework addresses a different type of foreign connection. “Ownership” refers to foreign persons or entities that hold equity in a company. “Control” focuses on the ability to direct a company’s actions, whether through governance rights such as board representation and shareholder voting power, or through financial leverage such as foreign-held debt. “Influence” is the broadest category and can include relationships that do not involve direct ownership or formal governance authority, such as dependence on foreign suppliers, the presence of foreign-national personnel in key roles, or contractual arrangements that give a foreign party leverage over a company’s operations.
Currently, FOCI reviews apply only to contractors that hold facility security clearances and perform classified work under the National Industrial Security Program (“NISP”). These contractors file Standard Form 328 (“SF 328”), the Certificate Pertaining to Foreign Interests, with the Defense Counterintelligence and Security Agency (“DCSA”) through the National Industrial Security System (“NISS”). DCSA currently handles about 2,000 FOCI cases per year. If a contractor does not hold a clearance, FOCI requirements do not apply, regardless of how sensitive the work might be. This gap leaves roughly $200 billion in annual DOD acquisitions without any FOCI vetting.
The Proposed Change
The proposed rule would close this gap by extending FOCI requirements to unclassified DOD contracts and subcontracts at any tier with a value over $5 million. The rule would create a new DFARS Part 240, “Information Security and Supply Chain Security,” along with a new solicitation provision (DFARS 252.240-70XX) and a new contract clause (DFARS 252.240-70YY).
Contracts for commercial products and services are generally exempt. However, a “designated senior DOD official” may bring a commercial contract into the framework if it involves a risk to national security because of sensitive data, systems, or processes. That official has not yet been named, and the criteria for such determinations have not been defined.
DOD estimates the rule would affect approximately 37,740 entities, roughly 57% of which are small businesses. DCSA’s annual caseload would increase from approximately 2,000 to an estimated 41,000.
Practical Impact on Contractors
The proposed rule would operate through three mechanisms.
Pre-Award Disclosure. Before submitting an offer, contractors would need to file their SF 328 and beneficial ownership information in NISS. Contracting officers would be prohibited from awarding, modifying, or exercising an option on any covered contract unless the contractor has an “eligible” NISS status.
Ongoing Performance Obligations. During contract performance, contractors would be required to do the following:
- Implement any DCSA-identified risk mitigation strategies within 90 calendar days of the triggering contract action;
- Update their SF 328 in NISS before any modification or renewal and whenever FOCI information changes; and
- Report changes in FOCI or beneficial ownership to DCSA within three business days of the change if it brings the contractor within the scope of FOCI, with a 10-business-day deadline to initiate a mitigation plan after DCSA notification.
Subcontractor Flowdown. Prime contractors must flow the clause down to covered subcontractors at any tier and confirm each subcontractor’s NISS eligibility before subcontract award and throughout performance. This is a mandatory flowdown for all non-commercial subcontractors at any tier.
Key Considerations for Contractors
Contractors should begin mapping their FOCI exposure now, even though the rule is not yet final. This means building a complete inventory of beneficial owners, foreign investors, foreign-national directors and key personnel, foreign lenders, and foreign vendor or supplier dependencies. The SF 328 requires detailed information about ownership structures, parent companies, and foreign financial interests, and completing it can take significant time and resources. Companies that document these facts now will be in a much stronger position to move quickly when a contract action triggers these requirements.
Given that NISS eligibility is a prerequisite for contract award under the proposed rule, waiting until a solicitation drops to begin the registration process could delay or disqualify an offer. Contractors should therefore prioritize registering with NISS in advance.
If a contractor is currently or may be within the scope of FOCI, it should begin evaluating what governance or operational mitigation measures it could implement within the 90-day window. Common mitigation instruments in the classified space include Special Security Agreements, Proxy Agreements, and Board Resolutions. The rule does not yet specify what mitigation will look like for unclassified work, but contractors should not wait for that guidance before assessing their readiness. Instead, they should begin mapping out mitigation strategies so they can obtain DCSA approval and implement those strategies without delaying contract performance.
Prime contractors should plan now for how they will verify subcontractor NISS eligibility at award and throughout performance. Companies involved in mergers, acquisitions, or financing transactions should account for the new requirements as well, because mid-performance ownership changes may trigger new FOCI evaluations and mitigation obligations on affected contracts.
Finally, contractors should consider submitting comments before the July 6, 2026, deadline. Key areas for comment include raising the $5 million threshold, extending the 90-day mitigation window, narrowing the subcontractor flowdown scope, and broadening the commercial item exception.
The proposed rule signals a fundamental shift in how DOD monitors foreign influence across its supply chain. Because the underlying statutory requirements are already law, the core framework is unlikely to change significantly in the final rule. Contractors who begin preparing now will be best positioned to maintain their eligibility for DOD work. Our Government Contracts group will continue to provide updates as this rulemaking progresses.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2026 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
