The Department of Defense published a proposed rule in the Federal Register on May 7 that would extend foreign ownership, control, or influence disclosure and mitigation requirements to virtually all defense contractors and subcontractors holding contracts valued above $5 million, regardless of whether the work involves classified information. The proposed rule, issued under DFARS Case 2024-D023, implements Section 847 of the National Defense Authorization Act for Fiscal Year 2020 — a provision Congress passed more than five years ago and whose implementation the Pentagon missed its statutory July 2021 deadline for finalizing. The Defense Department estimates approximately 40,000 companies could ultimately be subject to the new requirements. Public comments on the proposed rule are due July 6, 2026.

What the Proposed Rule Would Require

Under the proposed rule, any contractor or subcontractor at any tier holding a DoD contract exceeding $5 million would be required to disclose its foreign ownership and FOCI status by completing Standard Form 328, the Certificate Pertaining to Foreign Interests. Completed SF-328s would be submitted to the Defense Counterintelligence and Security Agency and maintained in the National Industrial Security System, the same database currently used for FOCI management on classified programs. Contractors would be required to update their FOCI disclosures throughout contract performance rather than only at the initial award stage.

Where FOCI is identified, contractors would have 90 days to propose and implement a mitigation plan acceptable to DCSA. Mitigation structures familiar from the classified contracting world — board resolutions, security control agreements, proxy agreements, and special security agreements — would apply in the unclassified context as well, though the rule as proposed does not appear to require the full panoply of Board of Directors oversight mechanisms reserved for the most sensitive FOCI situations. The rule also preserves a carve-out for commercial products and commercially available off-the-shelf items, but a designated senior DoD official can override that exemption for specific contracts where foreign involvement poses national security risks related to sensitive data, systems, or processes.

Legislative Background and Pentagon Delay

Section 847 of the FY 2020 NDAA directed DoD to issue a DFARS rule extending FOCI requirements beyond classified contracts within 18 months of enactment — a deadline that fell in July 2021. The Pentagon missed that deadline by nearly five years, drawing scrutiny from congressional defense committees concerned about Chinese and Russian ownership or influence in the defense industrial base that operates on unclassified contracts. The Dechert law firm noted in a May 2026 client alert that the proposed rule marks "the Pentagon entering its mitigation era," reflecting a judgment that the classified-only FOCI review architecture is no longer adequate given the breadth of sensitive but unclassified technology developed under ordinary DoD contracts. Federal News Network coverage of the rule highlighted DCSA's central role in processing the new wave of SF-328 filings, raising questions about whether the agency has the workforce to absorb a 40,000-company FOCI review backlog.

What It Means for Contractors

The proposed rule creates substantial new compliance obligations for any defense contractor or subcontractor with a foreign parent, foreign investors, or significant foreign business relationships — a description that covers a large share of the mid-tier and large-business defense contractor population. Completing SF-328 accurately is not a straightforward administrative exercise; it requires tracing beneficial ownership chains, identifying foreign board members and key management personnel, and documenting any agreements with foreign entities that could influence company operations.

  • Submit comments to the Federal Register by July 6, 2026. The rule is a proposed rule, not final — industry comments on scope, thresholds, timelines, and SF-328 certification burden could influence the final version. Counsel familiar with FOCI regulations can help firms craft substantive comments.
  • Begin an internal FOCI self-assessment now, before the rule is finalized. Map your beneficial ownership chain, identify any foreign nationals on your board or in key management roles, and audit existing agreements with foreign affiliates or joint venture partners that could constitute FOCI.
  • Firms with private equity owners should pay particular attention — PE-backed defense contractors with limited partners from foreign pension funds, sovereign wealth funds, or foreign financial institutions may have FOCI exposure that has not previously been documented.
  • Subcontractors at lower tiers are explicitly covered by the proposed rule for subcontracts exceeding $5 million; primes should assess their subcontractor relationships and build FOCI flow-down requirements into subcontract negotiations.
  • Engage DCSA's Industrial Security and Insider Threat directorate proactively; companies that come forward with FOCI disclosures and mitigation plans voluntarily are generally treated more favorably in the review process than those identified reactively through government-initiated inquiries.

DCSA Processing Capacity and Industry Comment Strategy

A significant practical question hanging over the proposed rule's implementation is whether the Defense Counterintelligence and Security Agency has the workforce and system capacity to process SF-328 filings from potentially 40,000 contractors and subcontractors within a reasonable timeframe. Under the current classified-contracts-only FOCI program, DCSA reviews roughly 10,000 to 12,000 active facility clearances, a small fraction of the volume the proposed rule would generate. DCSA has acknowledged in public statements that the agency will need additional resources and updated information system architecture in NISS to handle the expanded filing volume; industry groups including the Professional Services Council and the National Defense Industrial Association are expected to address DCSA capacity concerns directly in their public comments on the proposed rule.

Industry comments filed by July 6, 2026 can substantively influence the final rule's scope, phase-in timeline, and threshold structure. In past DFARS rulemakings, sustained industry comment campaigns have resulted in meaningful changes to proposed rules — the phased implementation of CMMC is one recent example of an industry-informed rulemaking outcome. Contractors with complex ownership structures, private equity backing, or significant international business relationships should ensure their legal and compliance teams are engaged in the comment process, both through direct filings and through industry trade association channels. Firms that have previously navigated FOCI reviews for classified contracts are well-positioned to comment on practical implementation challenges that DoD may not have fully accounted for in its burden estimates for the 40,000-company expansion.

Sources