On May 7, 2026, the Department of Defense/War (DoD) published a proposed DFARS rule that quietly redrew the line on foreign ownership disclosure. Until now, the foreign ownership, control, or influence (FOCI) review process lived inside the world of classified contracts. If you didn't hold a facility clearance, you didn't have to think about it.
That changes if this rule is finalized. DoD projects 37,740 entities will be affected, and about 57 percent of them, roughly 21,000 companies, are small businesses. Most have never filed an SF 328. The comment period closes July 6, 2026, which gives small defense contractors about six weeks to understand what's coming and decide whether to weigh in.
What FOCI Actually Means
FOCI stands for foreign ownership, control, or influence. The term is broader than most contractors expect, and that breadth is the part that catches small businesses off guard.
Ownership is the easy piece, any foreign person or entity holding equity in your company. Control covers board seats, voting rights, debt held by foreign lenders, and the power to direct business decisions. Influence is the catch-all: foreign suppliers your business depends on, foreign-national key personnel, contractual relationships that give a foreign party leverage over how you operate, even close family ties between owners and foreign nationals can land you in a FOCI review.
The disclosure vehicle is Standard Form 328, the Certificate Pertaining to Foreign Interests, filed with the Defense Counterintelligence and Security Agency (DCSA) through the National Industrial Security System (NISS). For decades, that form was a National Industrial Security Program (NISP) problem, something cleared contractors dealt with as part of holding a facility clearance.
The proposed rule pulls FOCI out of that classified-only context. It implements Section 847 of the FY2020 National Defense Authorization Act (NDAA) and Section 819 of the FY2021 NDAA, both of which directed DoD to extend beneficial ownership and FOCI scrutiny across its broader supply chain.
What's Changing on May 7
The old rule was narrow. If you held a facility clearance and worked on classified contracts, DCSA vetted your ownership through the SF 328 process. If you didn't, FOCI was someone else's problem.
The proposed rule throws that line out. It applies to any DoD contract or subcontract valued over $5 million, classified or unclassified. It creates a new DFARS Part 240 (Information Security and Supply Chain Security) and a new solicitation provision and contract clause that DoD contracting officers will start dropping into awards once the final rule takes effect. The rule also gives a "designated senior DoD official" authority to pull commercial-item contracts into the framework if national security risks justify it, an unusual move because commercial items have historically been shielded from this kind of scrutiny.
The scale is the part that should make every small defense contractor pay attention. DCSA's current FOCI caseload runs around 2,000 reviews per year, and DoD projects that number jumps to roughly 41,000 under the proposed rule, a more than twentyfold increase. The agency has not announced staffing or system changes to match that volume, so the practical question for any small business with a contract in the pipeline becomes how long a FOCI review will actually take once the rule is final and contracting officers start enforcing the clause.
The proposed rule also closes a gap that defense policy hawks have been pointing to for years: roughly $200 billion in annual DoD acquisitions currently move through contractors who have never been FOCI-vetted because their work isn't classified.
Who This Rule Actually Hits
Small defense contractors fall into three buckets, and the third is where most companies underestimate their exposure.
Prime contractors on DoD awards over $5 million. If you hold a prime contract with any DoD component and the contract value crosses the $5 million threshold, you're in scope at award. Options exercises and modifications also count as contract actions that trigger review, so a $3 million base contract with a $4 million option year would land you under the clause when the option fires.
Subcontractors at any tier. This is the flow-down piece, and it's the one being underestimated across the small business community. The proposed clause requires prime contractors to push the substance of the FOCI clause down to covered subcontractors, and those subs have to push it down to their subs. There is no tier cutoff in the proposed rule. A second- or third-tier sub on a large DoD program can land under the clause even if their own piece of the work is well under $5 million.
Contractors facing a modification or renewal. The proposed rule treats contract modifications and option exercises as contract actions, which means companies with active DoD contracts can be pulled into the FOCI process during normal contract administration without ever competing for a new award.
A quick gut-check list. If any of these describe your business, the proposed rule deserves your attention now:
- You're pursuing DoD work over $5 million as a prime
- You subcontract under a prime that holds DoD work
- You have foreign investors, foreign-national board members or key personnel, or significant foreign supplier dependence
- You have an active DoD contract with a modification or option year coming up
What You'd Have to Do Under the Rule
A covered contractor would carry four ongoing obligations. None of them are one-and-done filings, which is the part small businesses tend to miss.
Submit an SF 328 in NISS with beneficial ownership detail. The Certificate Pertaining to Foreign Interests has to be on file before contract action, and the proposed rule adds beneficial ownership reporting on top of the existing form, contact information for each beneficial owner, not just a yes/no on foreign interests.
Implement DCSA mitigation within 90 days. If DCSA identifies risk in the SF 328 review, the contractor has 90 calendar days from the contract action to agree to and implement a mitigation strategy. For higher-risk cases, the same instruments used in classified-side mitigation apply: voting trusts, proxy agreements, special security agreements, and similar governance overlays. Ninety days is not a long runway to negotiate any of these with DCSA.
Flow the clause down to subcontractors at any tier. Prime contractors have to push the substance of the FOCI clause into covered subcontracts, and those subs have to do the same. The proposed rule does not give a tier cutoff, which is what makes the flow-down a sleeper issue for the small business community.
Report changes during contract performance. Two reporting clocks would apply. If a change in FOCI or beneficial ownership places the contractor or a sub under FOCI, the contractor has three business days to report it. For other changes, the deadline is ten business days. Both clocks are tight, and missing them is the kind of compliance failure that surfaces in audits long after the underlying change happened.
What FEDCON Recommends Doing Before July 6
At FEDCON, we've been tracking this rulemaking since the underlying NDAA sections passed, and we're advising clients to do three things in the six weeks before the comment period closes.
Map your FOCI exposure now. Before any contract action forces the question, build a clean inventory of beneficial owners, foreign investors, foreign-national directors and key personnel, foreign lenders, and foreign supplier dependencies. The SF 328 is easier to file when the underlying facts are already documented.
Check your subcontract pipeline. If you sub under primes on DoD work, ask now how each prime plans to handle flow-down once the final rule lands. Many primes have not modeled this yet, and the answer changes how a small sub should plan around modifications, options, and new task orders.
Submit a comment if the rule would hurt your business. DoD reviews comments before issuing the final rule, and small business voices have shifted DFARS rulemaking before. The $5 million threshold, the 90-day mitigation window, the absence of a flow-down tier cutoff, and the commercial-item carve-back are all defensible targets for comment. Submissions go to Regulations.gov under DFARS Case 2021-D011, and the deadline is July 6, 2026.
The Bottom Line
FOCI used to be a clearance issue. Under this rule, it becomes a registration and disclosure issue for the broader defense industrial base, and the small business share of that base is the part DoD's own analysis says will feel it most. The companies that map their exposure in May and June will be the ones who can respond to a contract action in 90 days. The companies who find out at award are the ones who will lose the work.
FEDCON helps small defense contractors prepare for FOCI disclosure and mitigation before contract action forces the question. If your business is in any of the three buckets above, reach out to FEDCON or call the FEDCON Help Desk at 1-855-233-3266, and we'll walk through what a FOCI readiness review looks like for your specific situation.