The Department of Defense published a long-overdue proposed rule on May 7, 2026, that would extend Foreign Ownership, Control, or Influence mitigation requirements well beyond the classified contract community where they have historically applied. Federal News Network first reported the full scope of the expansion, which traces to Section 847 of the FY2020 National Defense Authorization Act and Section 819 of the FY2021 NDAA — statutory authorities DoD missed its original July 2021 implementation deadline to address. Now codified as Federal Register document 2026-09067 under DARS case DARS-2021-D011, the proposed rule carries a July 6, 2026, comment deadline, giving the broader defense industrial base a tight window to respond before requirements are finalized and begin reshaping how contractors compete and perform on defense work.
What the Proposed Rule Requires
The rule creates a new DFARS Part 240 titled "Information Security and Supply Chain Security" and introduces a new solicitation clause at DFARS 252.240-70XX. These additions establish FOCI mitigation as a standard condition of contract performance on any DoD contract or subcontract valued above $5 million — a threshold that encompasses the vast majority of competitive defense procurements and a substantial share of the broader defense subcontractor base that has never previously engaged with FOCI mitigation requirements.
The rule imposes four distinct compliance obligations on covered contractors. First, before bidding on a covered contract, contractors must file a Standard Form 328 — the Certificate Pertaining to Foreign Interests — with the Defense Counterintelligence and Security Agency via the National Industrial Security System. Second, within 90 calendar days of contract award, contract modification, or option exercise, contractors must implement a DCSA-approved FOCI mitigation plan. Third, reporting timelines are strict: contractors must notify DCSA within three business days of any FOCI-related ownership change and within ten business days of other relevant changes to ownership or control. Fourth, and operationally significant for prime contractors, all of these requirements flow down to subcontractors at every tier — not just the first — creating a compliance chain that primes must actively monitor and enforce.
The commercial products and services exclusion provides targeted relief. Commercial items are presumptively excluded from coverage unless a senior DoD official certifies that a specific national security risk justifies applying FOCI requirements to a particular procurement. For contractors with mixed portfolios of commercial and non-commercial offerings, this exclusion requires careful contract-by-contract analysis, particularly as the definition of "commercial" in defense procurement continues to evolve through case law and policy guidance.
Scale of Impact on the Defense Industrial Base
DoD's own estimates underscore the magnitude of this rulemaking. The department calculates that approximately 37,740 contractors and subcontractors would be subject to the new requirements — a figure that includes roughly 21,511 small businesses, representing approximately 57 percent of the affected population. For small and mid-sized defense suppliers that have never previously engaged with DCSA's facility clearance or FOCI mitigation processes, the compliance curve will be steep and the timeline unforgiving.
The DCSA workload projection tells the operational story most clearly. The agency currently processes approximately 2,000 FOCI mitigation cases per year. Under the proposed rule, that caseload is projected to grow to approximately 41,000 annually — a roughly twenty-fold increase. Whether DCSA can scale its review capacity at that rate is an open and urgent question, and industry stakeholders should raise it directly in public comments. Extended DCSA review timelines would translate into delayed contract awards, missed option exercises, and potential performance problems for contractors awaiting mitigation plan approvals that have not been processed in time to meet contractual milestones.
The flow-down obligation deserves particular attention from prime contractors. A prime that awards a subcontract above $5 million to a company with any degree of foreign ownership, control, or influence must ensure that subcontractor has filed its SF 328 and has an approved mitigation plan in place before performance begins. Primes that fail to enforce this obligation face the prospect of adverse findings during DCSA reviews or contracting officer audits. Many primes will need to revise subcontractor qualification processes and add FOCI status verification as a standard pre-award due diligence step, adding time and administrative overhead to their supply chain management workflows.
What It Means for Contractors
The July 6, 2026, comment deadline is the most immediate action item for any company that expects to be covered by this rule. DoD's rulemaking notice reflects awareness that industry has concerns about implementation timelines, DCSA capacity, and the treatment of commercial products at the margin. Contractors — particularly small businesses encountering FOCI requirements for the first time — should submit comments addressing the realism of the 90-day mitigation timeline, the feasibility of three-business-day reporting windows for ownership changes, and DCSA's ability to process a caseload twenty times larger than its current volume without creating systemic award delays that degrade rather than protect national security.
Beyond comments, covered contractors should begin SF 328 preparation immediately. The NISS filing process requires gathering and certifying detailed ownership information across corporate hierarchies, and companies with complex structures, private equity backing, or foreign parent entities should anticipate that the process will take considerably longer than expected. Primes should also audit their existing subcontract base to identify suppliers above the $5 million threshold and initiate conversations about FOCI status well before the rule takes effect.
For small businesses in particular, the SF 328 filing and DCSA mitigation process may represent their first direct interaction with the national industrial security system. DCSA offers guidance through its Industrial Security Representative program, and small businesses unfamiliar with the FOCI framework should engage those resources early rather than attempting to navigate the process independently at contract award. The rule, if finalized as proposed, will make FOCI literacy a baseline requirement for competitive participation across the defense market above the $5 million threshold — a bar that many current defense suppliers have never previously been required to clear, and one they should not wait until award day to begin meeting.
