The Defense Department is proposing a sweeping new rule that would significantly expand the government’s scrutiny of foreign ownership and influence across the defense industrial base, requiring tens of thousands of uncleared contractors to comply with security requirements historically applied only to companies handling classified information.
The proposed Defense Federal Acquisition Regulation Supplement rule released last week would require any contractor and subcontractor seeking to do business with DoD to disclose to the Defense Counterintelligence and Security Agency their beneficial ownership information and report whether they are under foreign ownership, control or influence, known as FOCI.
The rule would also require contractors to update their FOCI and beneficial ownership disclosures to DCSA throughout the life of a contract. In addition, contractors would have to mitigate risks related to FOCI within 90 days. The rule would apply to contracts valued over $5 million.
The proposed rule has been years in the making — the 2020 defense policy bill requires unclassified contractors to comply with FOCI disclosure requirements, not just contractors who need access to classified information.
Congress initially set a July 2021 deadline to issue the rule, but it took several years for the Defense Department to release this proposed rule.
“While this is a requirement that Congress put out in the fiscal 2020 National Defense Authorization Act, I think putting it into practice is a lot more challenging, and it’s a big ask of the Department of Defense to implement a structure like that,” Scott Freling, co-chair of Covington’s Government Contracts practice, told Federal News Network.
“DCSA has historically been focused on companies that perform on classified contracts and with this new mandate, it’s going to sweep in a large swath of companies that serve the national defense but do so without needing access to classified information. Companies are now going to become subject to the disclosure obligations and the review and assessment process, and so I think part of the reason that it’s taken so long is certainly the department has been trying to figure out how best to implement this and operationalize it in a way that works for their interests, but also our community,” he added.
The proposal is part of a broader push to secure the defense supply chains to both prevent foreign adversaries from gaining access to sensitive but unclassified information and to protect the supply chain against hidden vulnerabilities embedded into products that DoD uses.
The Pentagon estimates nearly 40,000 companies could ultimately be affected by the rule, and there is “going to be burden shared on both sides,” Freling said. While uncleared companies would have to submit a broad set of disclosure forms related to beneficial ownership and any other foreign touch points for review as part of the contracting process, DCSA would be responsible for reviewing thousands of these disclosures.
The agency, however, has been preparing for years — Heather Finstuen, partner at Covington & Burling LLP, said DCSA has been expanding its staffing levels and refining its processes in anticipation of what it calls the “FOCI expansion mission.”
“DCSA is used to doing this in the classified space, but the scale is now going to be vastly expanded, and there’s going to be new timing considerations because it’s occurring in the context of a procurement process,” Finstuen said. “It’s going to be operating at a scale that it’s never had to operate at before.”
But contractors will have to provide information to the department in a way that will facilitate the department’s review.
“The main challenge is going to be for a contractor to complete the standard form, the SF-328 and to provide the required supporting documentation called out in the proposed rule. Our sense from having worked with companies of all sizes, it’s not a form to just pick up and fill out without any perspective or training on how to go about completing the form. It’ll be incumbent on companies to reach out to council to get the advice as it relates to their particular ownership structure,” Freling said.
“It really depends on the particulars of each company’s ownership structure and how best to present it to the department in a way that’s going to be both current, accurate and complete and that’s a standard that rings true in the proposed rule and at the same time facilitative of the review, because this review is going to be taking place in the context of a competitive procurement process where there’s not a ton of time to go back and forth with a contractor to get clarification on a prior submittal. So it’s incumbent on all parties to get it right the first time,” he added.
The rule, Freling said, could be especially challenging for companies with complex ownership structures.
“In the public company context, there may be thousands or hundreds of thousands of shareholders in a particular company. It’s often the case that the public company does not have a pristine roster of all of its shareholders, and the proposed rule as it’s constructed right now seems to suggest that there needs to be disclosure of foreign beneficial owners, regardless of the size of of their ownership, which is very different from how the SF-328 is currently constructed,” Freling said.
The proposed rule would also allow DoD to apply these requirements to certain contracts for commercial products and services if a designated senior DoD official determines that the contract “involves a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes.”
“That’s a pretty broad standard,” Finstuen said. “Senior DoD official will have some broad discretion to make those determinations on whether the commercial exemption applies or not.”
Freling said it remains to be seen how broad the exemption will ultimately be applied.
“Our fear is that it could be applied quite broadly to sweep in a host of companies that serve the department and that’s a definite open question from our perspective. The commercial exemption has its roots in the National Defense Authorization Act, so this is something that we expect to be in the final rule. But it would be nice if between the issuance of the proposed rule and the final rule the department can provide some better clarity for industry in terms of how and when they ought to expect the cause and the requirements to appear in contracts for commercial products and services,” Freling said.
If you would like to contact this reporter about recent changes in the federal government, please email anastasia.obis@federalnewsnetwork.com or reach out on Signal at (301) 830-2747.
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
