While much of the defense industrial base is breathing a sigh of relief over the recent CMMC Phase II suspension, another massive compliance hurdle is looming right around the corner.
As we identified in last month’s newsletter, a proposed Defense Federal Acquisition Regulation Supplement (DFARS) rule published by the Department of Defense (DoD) in May 2026 is poised to expand Foreign Ownership, Control, or Influence (FOCI) disclosure requirements far beyond the classified space. Because of the potential for immense impact on small businesses in particular, this topic is worth bringing to your attention once more and with additional detail.
Under this new regime, any DoD contractor or subcontractor at any tier with a contract exceeding $5 million will be required to submit a Standard Form 328 (SF-328) to the Defense Counterintelligence and Security Agency (DCSA). Even more concerning for small businesses, new legislative proposals are already circulating on Capitol Hill to drop this reporting threshold down to just $500,000.
The term "ownership" in FOCI is deceptively narrow, as the SF-328 form demands sweeping disclosures about a company's entire operational ecosystem. The government is deeply focused on the "Control" and "Influence" vectors, meaning you must disclose significant foreign bank debt, overseas customer concentrations, foreign vendor agreements, and even employees working under visa sponsorships.
Furthermore, if your small business is backed by venture capital or private equity, the scrutiny intensifies. The rule requires companies to aggregate foreign ownership across their investors, meaning a VC fund with a minor stake but a few foreign limited partners (LPs) could easily push your firm over the 5% indirect foreign ownership disclosure threshold.
The operational burden of this proposed rule is staggering and heavily front-loaded. For example, if your company's FOCI profile changes—such as taking on a new foreign customer or undergoing an ownership shift—as currently written in the proposed rule, you have just three business days to report the change to DCSA, followed by 10 business days to confirm your mitigation strategies.
While the proposed rule does include an exemption for commercial acquisitions, the language relies on undefined terms like "sensitive data," leaving it up to an unnamed senior DoD official to determine if your commercial contract is actually exempt. Much like the CMMC rollout, the massive upfront costs and potential to severely delay acquisition cycles could force the DoD to eventually adopt a phased implementation, but businesses cannot afford to wait and see.
As we saw with CMMC, waiting for the government to finalize the rules before preparing your internal systems is a recipe for disaster. I advise taking the following proactive steps to prepare for the expanding FOCI regime:
Credits & Further Reading: This update is based on insights from government contracts attorney Erin Estevez, as featured on the GovCon Intelligence podcast hosted by Sam Le.