DoD Proposed Rule Would Extend FOCI Requirements to Unclassified Contracts Over $5 Million

As part of the Department of Defense’s long-running effort to implement Section 847 of the FY 2020 National Defense Authorization Act and Section 819 of the FY 2021 NDAA, DoD released a proposed rule on May 7, 2026 (DFARS Case 2021-D011) that would extend foreign ownership, control, or influence (FOCI) requirements to unclassified contracts. This overview covers the proposed FOCI framework: what FOCI means, who would be covered, and what contractors must disclose and mitigate. Although the rule builds on requirements that have long applied to cleared contractors, this article will review the critical proposed changes that contractors should take note of for future reference. If you think you may be affected by these proposed changes, GovSpring is available to help contractors and companies understand how the new FOCI requirements may impact their current and future contracts. Click here to schedule a consultation or fill out our online contact form to be contacted by our Managing Attorney.

If your company holds a DoD contract worth more than $5 million (even a completely unclassified one) this rule may soon require you to open your ownership books to the government. Comments were due July 6, 2026, and a final rule could follow before year’s end.

First Things First: What Is FOCI?

FOCI is shorthand for foreign ownership, control, or influence. Under the proposed rule, a company is under FOCI when a “foreign interest” — a foreign government or its agents, a business organized under the laws of another country, or any person who is not a U.S. citizen or national — has the power, directly or indirectly, to shape the company in one of two ways:

• Directing or deciding matters affecting the company’s management or operations in a way that could create a risk to national security or compromise sensitive data, systems, or processes; or
• Otherwise controlling or influencing the business in a way that could hurt the company’s ability to perform its DoD contract.

Two points deserve emphasis. First, the power does not need to be exercised — it only needs to exist. A dormant foreign shareholder with the ability to influence board decisions can put a company under FOCI even if that shareholder has never lifted a finger. Second, the concept sweeps in “beneficial owners” as defined in federal securities regulations (17 CFR 240.13d-3), which reaches anyone who holds voting or investment power over company securities through any contract, arrangement, or relationship — not just people whose names appear on the capitalization table.

What Would the Rule Actually Require?

The proposed rule works through a simple but powerful restriction: contracting officers could not award, modify, or exercise an option on any contract, task order, or delivery order valued above $5 million unless the contractor holds an “eligible” status in the National Industrial Security System (NISS), the web portal run by the Defense Counterintelligence and Security Agency (DCSA).

To get and keep that eligible status, covered contractors and subcontractors — at any tier — would need to:

• Disclose. Submit a Standard Form 328 (Certificate Pertaining to Foreign Interests) in NISS, along with supporting documents and contact information for every foreign beneficial owner.
• Represent. Certify, simply by submitting an offer, that the SF-328 is on file and that the information is current, accurate, and complete.
• Mitigate. If DCSA and the requiring activity conclude that FOCI presents a risk that can be mitigated, agree to a risk mitigation strategy at award and implement it within 90 calendar days. That 90-day clock restarts with each triggering event — award, option exercise, modification, or discovery of a new risk mid-performance.
• Report changes fast. If a change may place the company (or one of its subcontractors) under FOCI, report the foreign owner’s identity and related details within 3 business days, and begin implementing DCSA’s recommendations within 10 business days of being notified that the change poses a risk.
• Flow it down. Primes would need to insert the clause in subcontracts above $5 million and confirm that those subcontractors hold eligible NISS status before award and throughout performance.

Commercial products and services (including COTS items) would be exempt — unless a designated senior DoD official determines a particular contract involves a risk to national security because of sensitive data, systems, or processes. Notably, DoD has not yet named that official or explained how those determinations would be made, so commercial suppliers should not assume they are permanently in the clear.

Who Gets Swept In? A Quick Example

Consider a hypothetical: DuPont Analytics, a 200-person software company in Maryland that performs a $12 million unclassified data analytics subcontract for a major defense prime. DuPont holds no facility clearance and has never dealt with DCSA. Three years ago, a Singapore-based venture fund took a 20% stake and a board seat.

Today, DuPont has no FOCI obligations. Under the proposed rule, everything changes. Because its subcontract exceeds $5 million, DuPont would need a NISS account, a completed SF-328 disclosing the foreign fund’s stake and board seat, and contact information for the fund as a beneficial owner. If DCSA flags the arrangement as a risk, DuPont could be required to implement mitigation — potentially restructuring board voting rights or access controls — within 90 days, or risk losing the subcontract. And its prime cannot even accept an option exercise on the underlying contract until Ridgeline’s status is squared away.

DoD estimates nearly 37,740 entities would be affected — including more than 21,000 small businesses — compared with roughly 2,500 cleared contractors subject to FOCI review today.

Key Dates to Track

How to Prepare Now

Waiting for the final rule is a mistake — FOCI mitigation is not something a company can stand up in 90 days from a cold start. Practical steps to take today:

1. Map your ownership. Complete an internal draft SF-328. Identify every foreign shareholder, lender, board member, revenue relationship, and contractual arrangement that could constitute foreign influence.
2. Look beyond the cap table. Beneficial ownership includes indirect voting and investment power. Trace ownership up through funds and holding companies.
3. Assess your risk profile honestly. If your draft SF-328 raises flags — foreign board seats, significant foreign debt, concentrated foreign revenue — start evaluating mitigation options (board resolutions, security control agreements, governance changes) with counsel now.
4. Check your supply chain. Primes should inventory subcontracts above $5 million and start conversations with subcontractors about their FOCI posture, since your contract actions will depend on their NISS eligibility.
5. Get familiar with NISS. Most affected companies have never touched the system. Establishing an account and understanding DCSA processes takes time.
6. Comment by July 6. The rule leaves major questions open — who the “designated senior DoD official” will be, what counts as “sensitive” data, and how DCSA will staff tens of thousands of new reviews. Companies with concerns should put them on the record.

GovSpring Legal can advise you on FOCI, industrial security, and supply chain compliance. To discuss how the proposed rule may affect your business, click here to schedule a consultation or fill out our online contact form to be contacted by our Managing Attorney.