Key Takeaways
- • Mandatory FOCI disclosure for unclassified DoD contracts exceeding $5 million — For the first time, contractors and subcontractors performing unclassified work must disclose beneficial ownership and foreign interest information to DCSA through NISS, with ongoing update obligations throughout contract performance.
- • NISS eligibility becomes a contractual prerequisite — Contracting officers are prohibited from awarding, modifying, or exercising options on covered contracts unless the contractor achieves "eligible" status in NISS, effectively making FOCI clearance a binding condition of award regardless of proposal quality or pricing.
- • 90-day mitigation implementation timeline — Contractors identified as presenting FOCI risk must negotiate and implement approved mitigation strategies within 90 calendar days of contract award or action, mirroring classified contracting frameworks but with undefined scope for unclassified work.
- • Prime contractors assume supply-chain compliance responsibility — Primes must flow down FOCI requirements to all subcontractors exceeding $5 million at any tier, verify and maintain NISS eligibility throughout performance, and report subcontractor ownership changes to DCSA.
- • Regulatory comment period closes July 6, 2026 — The rule affects tens of thousands of contractors currently performing unclassified DoD work; entities with significant concerns have 25 days from publication to shape final rulemaking through formal comments.
Summary
On May 7, 2026, the Department of Defense published a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS) to extend foreign ownership, control, or influence (FOCI) disclosure and mitigation requirements to unclassified DoD contracts and subcontracts valued above $5 million. The initiative implements congressional directives from the National Defense Authorization Acts of 2020 and 2021, translating prior institutional policy—established through DoD Instruction 5205.87 in May 2024—into binding regulatory requirements for defense contractors. The proposed rule represents a material expansion of FOCI oversight, extending requirements historically limited to classified contracting into the unclassified defense supply chain for the first time.
Under the proposed framework, contractors must submit completed SF 328 (Certificate Pertaining to Foreign Interests) forms and supporting beneficial ownership documentation to the Defense Counterintelligence and Security Agency (DCSA) through the National Industrial Security System (NISS) prior to contract award. Critically, contracting officers would be prohibited from awarding, modifying, or exercising contract options unless the offeror achieves "eligible" status in NISS—a designation requiring DCSA review and determination that FOCI either does not exist or has been appropriately mitigated. This mechanism converts FOCI disclosure from an administrative procedure into a hard contractual prerequisite, creating scenarios where technically sound and competitively priced proposals remain ineligible without DCSA clearance. Contractors must also maintain active disclosure compliance throughout contract performance, updating DCSA if beneficial ownership or foreign interest information changes.
When DCSA identifies unmitigated FOCI risk, contractors must agree to and implement approved mitigation strategies within 90 calendar days of the triggering action. The proposed rule does not specify which mitigation measures would apply to unclassified work, introducing operational uncertainty. In classified contracting, DCSA employs established mitigation tools including board resolutions, security control agreements, voting trusts, outside director appointments, and access restrictions—measures that are costly, operationally intrusive, and time-intensive. Whether DCSA will apply comparable measures to unclassified contracts or develop lighter-touch alternatives remains unclear, creating material compliance risk for affected contractors.
Prime contractors assume substantial compliance responsibility under subcontractor flowdown requirements. Primes must insert FOCI clause language into all subcontracts exceeding $5 million at any tier, verify subcontractor NISS eligibility prior to award, and maintain that status throughout performance. Any subcontractor ownership changes must be reported to DCSA by the prime, effectively extending supply-chain auditing obligations across the contractor base. The proposed rule generally exempts acquisitions of commercial products and services from FOCI requirements; however, a designated senior DoD official may override this exemption upon written determination that a contract involves national security risk due to sensitive data, systems, or processes, introducing ongoing uncertainty for commercial suppliers.
The rule carries significant compliance implications. Contractors performing solely unclassified work face new pre-award diligence obligations requiring ownership structure audits, beneficial ownership identification, governance assessment, and foreign investor relationship documentation before proposal submission. Inaccurate or incomplete FOCI disclosures expose contractors to False Claims Act liability, while DCSA eligibility disputes may trigger bid protests at the Government Accountability Office or Court of Federal Claims. Potential DCSA processing bottlenecks—given the rule would affect tens of thousands of contractors—create acquisition timeline risk independent of contractor conduct. The comment deadline of July 6, 2026, provides a narrow window for stakeholder input on the regulatory framework before finalization.
Under the proposed framework, contractors must submit completed SF 328 (Certificate Pertaining to Foreign Interests) forms and supporting beneficial ownership documentation to the Defense Counterintelligence and Security Agency (DCSA) through the National Industrial Security System (NISS) prior to contract award. Critically, contracting officers would be prohibited from awarding, modifying, or exercising contract options unless the offeror achieves "eligible" status in NISS—a designation requiring DCSA review and determination that FOCI either does not exist or has been appropriately mitigated. This mechanism converts FOCI disclosure from an administrative procedure into a hard contractual prerequisite, creating scenarios where technically sound and competitively priced proposals remain ineligible without DCSA clearance. Contractors must also maintain active disclosure compliance throughout contract performance, updating DCSA if beneficial ownership or foreign interest information changes.
When DCSA identifies unmitigated FOCI risk, contractors must agree to and implement approved mitigation strategies within 90 calendar days of the triggering action. The proposed rule does not specify which mitigation measures would apply to unclassified work, introducing operational uncertainty. In classified contracting, DCSA employs established mitigation tools including board resolutions, security control agreements, voting trusts, outside director appointments, and access restrictions—measures that are costly, operationally intrusive, and time-intensive. Whether DCSA will apply comparable measures to unclassified contracts or develop lighter-touch alternatives remains unclear, creating material compliance risk for affected contractors.
Prime contractors assume substantial compliance responsibility under subcontractor flowdown requirements. Primes must insert FOCI clause language into all subcontracts exceeding $5 million at any tier, verify subcontractor NISS eligibility prior to award, and maintain that status throughout performance. Any subcontractor ownership changes must be reported to DCSA by the prime, effectively extending supply-chain auditing obligations across the contractor base. The proposed rule generally exempts acquisitions of commercial products and services from FOCI requirements; however, a designated senior DoD official may override this exemption upon written determination that a contract involves national security risk due to sensitive data, systems, or processes, introducing ongoing uncertainty for commercial suppliers.
The rule carries significant compliance implications. Contractors performing solely unclassified work face new pre-award diligence obligations requiring ownership structure audits, beneficial ownership identification, governance assessment, and foreign investor relationship documentation before proposal submission. Inaccurate or incomplete FOCI disclosures expose contractors to False Claims Act liability, while DCSA eligibility disputes may trigger bid protests at the Government Accountability Office or Court of Federal Claims. Potential DCSA processing bottlenecks—given the rule would affect tens of thousands of contractors—create acquisition timeline risk independent of contractor conduct. The comment deadline of July 6, 2026, provides a narrow window for stakeholder input on the regulatory framework before finalization.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.