Analyzing DoD’s Proposal to Require Extensive FOCI Disclosures and Mitigation Measures on Prospective Contractors

Earlier this month, the comment period closed for the Department of Defense’s (DoD) proposed rule, Mitigating Risks Related to Foreign Ownership, Control, or Influence (Defense Federal Acquisition Regulation Supplement (DFARS) Case 2021-D011). The proposed rule would amend the DFARS to subject many prospective DoD contractors to the same foreign ownership, control, or influence (FOCI) disclosures and requirements that currently apply to contractors seeking facility security clearances (FCL) for classified work. FOCI exists when a foreign interest can directly or indirectly influence a company’s management or operations, creating national security concerns, such as unauthorized access to sensitive information or impaired contract performance.

Most notably, the proposed rule would add a new DFARS solicitation provision: 252.240-70XX (Disclosure of Beneficial Ownership or Foreign Ownership, Control, or Influence—Representation), which would prohibit DoD from awarding a contract with a value in excess of $5 million, unless the awardee:

(1) Makes the FOCI or beneficial ownership disclosures described in paragraph (c) of this provision; and

(2)(i) Is determined to not have risk related to FOCI or beneficial ownership; or

(ii) Agrees to execute and implement the risk mitigation strategies identified by the program office or requiring activity within 90 calendar days of contract award.

Regarding the specified disclosure, the proposed DFARS clause further provides:

(c) Disclosures. (1) The Offeror shall submit for Defense Counterintelligence and Security Agency (DCSA) review the Standard Form (SF) 328, Certificate Pertaining to Foreign Interests, and supporting documents to include the contact information for each of its foreign owners that is a beneficial owner in the National Industrial Security System (NISS).

(2) If the requiring activity determines, based on input from DCSA, that FOCI or beneficial ownership poses a risk or potential risk of compromise to national security that may be mitigated, the Offeror shall—

(i) Agree to the risk mitigation strategies at time of award; and

(ii) Implement the risk mitigation strategies within 90 calendar days of contract award.

The SF 328 is a form that companies seeking an FCL are required to submit (and update). The SF 328 requires contractors to disclose to the DSCA, the Agency responsible for adjudicating security clearance determinations, the extent of any FOCI in order to ensure that foreign entities do not have the ability to exert undue influence over companies that store and handle classified information in the performance of classified contracts.

One noteworthy aspect of the proposed rule is that it effectively extends DCSA's FOCI review function beyond the traditional national security clearance framework. Historically, DCSA's FOCI reviews have been tied to decisions regarding eligibility to access classified information. Under the proposed rule, DCSA's analysis would become relevant to awarding certain unclassified contracts, signaling a significant expansion of the government's scrutiny of foreign influence throughout the defense industrial base.

Another practical concern is the potential for procurement delays. Because award eligibility may depend upon DCSA review of SF 328 submissions and any resulting mitigation negotiations, offerors could face prolonged pre-award timelines. This may be particularly problematic in procurements involving complex ownership structures, private equity investment, venture capital funding, foreign limited partners, or multinational corporate families. Therefore, contractors may need to begin conducting internal FOCI assessments well before proposal submission.

Additionally, the proposed rule adds DFARS 252.240-70YY (Disclosure of Beneficial Ownership or Foreign Ownership, Control, or Influence), which requires that contractors ensure that any subcontractors awarded subcontracts in excess of $5 million “have an eligible status in the National Industrial Security System prior to subcontract award and maintain the status of eligible in the National Industrial Security System (NISS) for the duration of subcontract performance.” It further requires that prime contractors insert the substance of the clause in all subcontracts and other contractual instruments exceeding $5 million. The clause further requires updated SF 328 disclosures, specifically, if a contractor has any changes in FOCI or beneficial ownership during performance of the contract, or if the contractor is notified of such change by a subcontractor at any tier or supplier.

Practically speaking, the requirements of this proposed rule are significant. While contractors currently holding FCL are accustomed to submitting and updating SF 328 forms, which can be a fairly complex and administratively burdensome process, the proposed rule would impose the requirements discussed above on a large portion of defense contractors performing non-classified contracts. This includes commercial-off-the-shelf acquisitions, where senior DoD officials have the discretion to include the aforementioned solicitation clauses where deemed necessary to guard against national security risks. 

Indeed, as the proposed rule notes regarding its proposed scope: "The estimated total number of potentially impacted awardees is 37,740, of which 21,511 (57%) are estimated to be small entities.” Given the impact, it will be interesting to monitor the rulemaking—particularly in light of the DoD scaling back the implementation of Cybersecurity Maturity Model Certification (CMMC) in response to compliance burdens for small business contractors.

The proposed rule reflects DoD’s heightened focus on supply-chain security, ownership transparency, and foreign influence risks across the defense industrial base. If finalized, it would significantly expand the federal FOCI regime beyond classified contracting, requiring many contractors previously outside DCSA oversight to adopt compliance, ownership-monitoring, and governance practices associated with cleared contractors.

We encourage you to reach out to the authors of this Client Alert or your Butzel attorney for further information.

Derek Mullins
313.983.6944
mullins@butzel.com

Beth S. Gotthelf
248.258.1303
gotthelf@butzel.com

Anthony Scalise
248.258.2612
scalise@butzel.com