Deep Dive on FOCI Impacts: The Next Compliance Bomb for Small Businesses

While much of the defense industrial base is breathing a sigh of relief over the recent CMMC Phase II suspension, another massive compliance hurdle is looming right around the corner.

As we identified in last month’s newsletter, a proposed Defense Federal Acquisition Regulation Supplement (DFARS) rule published by the Department of Defense (DoD) in May 2026 is poised to expand Foreign Ownership, Control, or Influence (FOCI) disclosure requirements far beyond the classified space. Because of the potential for immense impact on small businesses in particular, this topic is worth bringing to your attention once more and with additional detail.

Under this new regime, any DoD contractor or subcontractor at any tier with a contract exceeding $5 million will be required to submit a Standard Form 328 (SF-328) to the Defense Counterintelligence and Security Agency (DCSA). Even more concerning for small businesses, new legislative proposals are already circulating on Capitol Hill to drop this reporting threshold down to just $500,000.

The term "ownership" in FOCI is deceptively narrow, as the SF-328 form demands sweeping disclosures about a company's entire operational ecosystem. The government is deeply focused on the "Control" and "Influence" vectors, meaning you must disclose significant foreign bank debt, overseas customer concentrations, foreign vendor agreements, and even employees working under visa sponsorships.

Furthermore, if your small business is backed by venture capital or private equity, the scrutiny intensifies. The rule requires companies to aggregate foreign ownership across their investors, meaning a VC fund with a minor stake but a few foreign limited partners (LPs) could easily push your firm over the 5% indirect foreign ownership disclosure threshold.

The operational burden of this proposed rule is staggering and heavily front-loaded. For example, if your company's FOCI profile changes—such as taking on a new foreign customer or undergoing an ownership shift—as currently written in the proposed rule, you have just three business days to report the change to DCSA, followed by 10 business days to confirm your mitigation strategies.

While the proposed rule does include an exemption for commercial acquisitions, the language relies on undefined terms like "sensitive data," leaving it up to an unnamed senior DoD official to determine if your commercial contract is actually exempt. Much like the CMMC rollout, the massive upfront costs and potential to severely delay acquisition cycles could force the DoD to eventually adopt a phased implementation, but businesses cannot afford to wait and see.

STRATEGIC ACTION PLAN FOR YOUR BUSINESS

As we saw with CMMC, waiting for the government to finalize the rules before preparing your internal systems is a recipe for disaster. I advise taking the following proactive steps to prepare for the expanding FOCI regime:

• Map Your Foreign Touchpoints Immediately: Do not assume you are exempt just because your founders are U.S. citizens. Audit your entire operational footprint today. Identify any overseas suppliers, international customer revenue, foreign banking relationships, or visa-sponsored employees. Documenting this now will save you from scrambling during a 3-day reporting window.
• Conduct Reverse Diligence on Your Investors: If you are seeking or currently hold VC or private equity funding, you must have transparent conversations with your investors about their LP base. Start inserting covenants into investment agreements that require your backers to provide the necessary organizational and demographic data to satisfy DCSA’s aggregate ownership thresholds.
• Establish Internal Reporting Protocols: The proposed 3-day and 10-day reporting deadlines for FOCI profile changes are incredibly unforgiving. Determine who within your organization—whether it is your Facility Security Officer (FSO), contracting staff, or executive team—will be responsible for monitoring changes in ownership, supply chain, and customer acquisitions, and ensure they are empowered to report these changes immediately.

Credits & Further Reading: This update is based on insights from government contracts attorney Erin Estevez, as featured on the GovCon Intelligence podcast hosted by Sam Le.

• Listen to the full GovCon Intelligence episode here: FOCI: The Next Small Business Compliance Bomb (with Erin Estevez)