DoD Targets Foreign Ownership Disclosure in Proposed DFARS Rule

The Department of Defense (DoD) issued a proposed rule on May 7, 2026, to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement provisions of the National Defense Authorization Act (NDAA) for fiscal years 2020 and 2021, aimed at mitigating risks related to beneficial ownership and foreign ownership, control or influence (FOCI) of DoD contractors and subcontractors. Contractors and subcontractors with an award of more than $5 million (other than for commercial products and services, absent a specific determination of coverage) must disclose FOCI and beneficial ownership information prior to a covered award, modification or option exercise, implement any required mitigation to address FOCI risks, and update their disclosures throughout contract performance. Comments on the proposed rule are due by July 6, 2026.

Background

The proposed rule implements aspects of Section 847 of the NDAA for FY 2020 (Pub. L. 116-92) and Section 819 of the NDAA for FY 2021 (Pub. L. 116-283). These statutes require covered contractors and subcontractors to disclose information related to their beneficial ownership and whether they are under FOCI, including contact information for foreign beneficial owners. Further, they mandate updates to this information when changes occur during contract performance and, if necessary, that contractors mitigate any FOCI pursuant to an approved FOCI mitigation plan for the duration of the award. The proposed rule also implements elements of DoD Instruction 5205.87, which establishes procedures related to disclosing beneficial ownership and FOCI information and mitigating FOCI risk.

Who is covered

The rule proposes to apply its requirements to “covered contractors” and “covered subcontractors,” which are existing or prospective DoD contractors or subcontractors at any tier with a contract or subcontract valued at more than $5 million. The rule will not apply to the acquisition of commercial products – including commercially available off-the-shelf (COTS) items – or commercial services, unless a designated senior DoD official determines that the contract implicates a national security concern or a risk to sensitive data, systems or processes. 

Key requirements

The proposed rule imposes the following obligations on covered contractors and subcontractors:

1. Pre-award disclosure. Offerers must submit Standard Form (SF) 328, Certificate Pertaining to Foreign Interests, and supporting documents – including contact information for each foreign beneficial owner – to the Defense Counterintelligence and Security Agency (DCSA) for review through the National Industrial Security System (NISS).
2. Representation at the time of offer submission. By submitting an offer, the offerer represents that it has submitted the required information in NISS, and that the information is current, accurate and complete.
3. Continuous disclosure and updates. Contractors must complete, update and verify the currency of the SF 328 and supporting documents, including beneficial owner contact information in NISS, before contract modifications or renewals and whenever changes occur.
4. FOCI risk mitigation. Contractors determined to be under FOCI must implement any required mitigation within 90 calendar days after contract award, modification or option exercise. Practically speaking, this suggests that a contractor under FOCI can nevertheless be eligible for and receive an award, modification or option exercise while under FOCI as long as it has agreed to the proposed mitigation. The contractor will then have 90 days following the award, modification or option exercise to implement the FOCI mitigation plan.
5. Rapid reporting of changes. If changes may result in a contractor or subcontractor under FOCI, the contractor must report the foreign or beneficial owner’s name and relevant information, as well as any “readily available information” regarding actions taken or recommended to mitigate the associated risk, within three business days of identification. If DCSA notifies the contractor that FOCI or beneficial ownership poses a risk, the contractor must undertake a plan of action to implement DCSA’s mitigation recommendations and confirm in NISS that it will comply with those recommendations within 10 business days.
6. Subcontract flow down. Contractors must ensure that all subcontractors with subcontracts exceeding $5 million similarly have an eligible status in NISS before subcontract award and maintain that status throughout performance. Contractors must also insert the substance of the relevant contract clause into subcontracts and other contractual instruments exceeding $5 million. 

Action items for contractors

Contractors and prospective contractors doing business with DoD – particularly those with foreign investors, parent companies or other foreign interests – should take note of the following:

• Review FOCI exposure now. Contractors should assess whether any foreign interest could be deemed to have ownership, control or influence over their operations. The first step in doing so is completing an SF 328 and assembling the information that accompanies the SF 328. Cooley can help answer questions about the disclosures the SF 328 requires and what such disclosures may mean for DCSA’s FOCI analysis and requirements for FOCI mitigation measures.
• Verify NISS status. Contractors should confirm or initiate their NISS registration and ensure SF 328 submissions are current, accurate and complete when made.
• Review subcontract terms. Contractors should anticipate the need to flow down the new clause to subcontractors on awards exceeding $5 million.
• Submit comments on the proposed rule by July 6, 2026. Comments should be submitted via the Federal eRulemaking Portal at regulations.gov (searching for DFARS Case 2021-D011) or by email to osd.dfars@mail.mil with “DFARS Case 2021-D011” in the subject line.