The Section 847 FOCI Rule Is Here: What 37,000 Uncleared Contractors Need to Know

On May 7, 2026, the Department of Defense published a proposed rule that defense contractors have been anticipating — and in some cases dreading — since 2020. The rule implements Section 847 of the FY 2020 National Defense Authorization Act, which directed DoD to extend Foreign Ownership, Control, or Influence (FOCI) review requirements to unclassified defense contracts. Comments are due July 6, 2026. If the rule is finalized as proposed, the FOCI disclosure and mitigation framework that previously applied almost exclusively to cleared contractors will reach tens of thousands of companies that have never interacted with DCSA in any compliance capacity.

This is not a technical adjustment. It is a structural expansion of the FOCI program — and the operational burden it creates for contractors with no FOCI history is significant.

Six Years to Get Here

Section 847 of the FY 2020 NDAA was enacted in December 2019. It directed the Secretary of Defense to establish FOCI disclosure requirements for contractors on certain unclassified contracts. Six years later, DoD has finally issued the proposed implementing rule. The delay was not unusual — NDAA provisions frequently take years to work through the rulemaking process — but it means that a statutory requirement that has been on the books since the beginning of 2020 is only now becoming a regulatory reality that contractors need to operationalize.

The proposed rule comes in a regulatory environment where FOCI has been a growing area of government concern. Foreign investment in defense contractors, foreign nationals in positions of influence over corporate governance, and foreign revenue dependencies have all attracted increasing scrutiny from DCSA, the Committee on Foreign Investment in the United States (CFIUS), and Congress. The Section 847 rule is the regulatory mechanism that brings that scrutiny to bear systematically at the contract award stage — rather than only in connection with facility clearances.

What the Proposed Rule Requires

The rule creates a new category of "covered contracts" defined as defense contracts and subcontracts valued in excess of $5 million that are not for commercial products and services. Contractors and subcontractors on covered contracts would be required to submit a FOCI disclosure to DCSA — using Standard Form 328, Certificate Pertaining to Foreign Interests — as part of the contract award process. DCSA would conduct a FOCI risk assessment and, where the assessment identifies concerns, require mitigation as a condition of award.

The scope of this change is substantial. The proposed rule estimates 37,740 potentially impacted entities. Approximately 57% — roughly 21,500 companies — are small businesses. The majority of these companies have never prepared an SF-328, have no relationship with DCSA, and have no internal capability to navigate the FOCI review process. For them, the rule is not an incremental compliance requirement — it is an entirely new regulatory framework arriving as a contract award prerequisite.

The SF-328: Harder Than It Looks

Contractors who are new to FOCI should understand what the SF-328 actually requires before they assume it is a straightforward disclosure form. The SF-328 asks about foreign ownership, control, and influence across a range of categories: beneficial ownership structure, foreign nationals serving as officers or directors, foreign contracts and revenue, foreign subsidiaries, foreign bank accounts, and agreements with foreign entities. A recently updated version of the form is now in effect.

Completing the SF-328 accurately requires a thorough understanding of the company's ownership structure — including indirect and beneficial ownership — and its relationships with foreign entities across all business lines, not just the line doing the defense work. Companies with private equity ownership, foreign parent companies, foreign minority investors, or foreign-national board members will find the form more complex than it appears. Companies with no obvious foreign connections should still conduct a careful review before certifying, because the definition of FOCI-triggering relationships is broader than common intuition suggests.

Critically, DCSA's follow-up on SF-328 submissions routinely goes well beyond what the four corners of the form require. DCSA may request additional documentation, corporate records, board minutes, beneficial ownership charts, copies of foreign agreements, and interviews with corporate officers. Companies that complete the form accurately but are unprepared for the follow-up process will find themselves in a protracted back-and-forth with DCSA at exactly the moment they are trying to close a contract award.

Mitigation: The Part Nobody Anticipates

If DCSA's assessment identifies a FOCI concern, the proposed rule provides for mitigation as a condition of award. This is where the process becomes genuinely complex. FOCI mitigation comes in several forms: a Special Security Agreement (SSA), a Proxy Agreement, or a Voting Trust, depending on the nature and degree of foreign influence and the classification level involved. For unclassified contracts under the new framework, an SSA is the most likely instrument for cases where mitigation is required but the ownership structure does not rise to the level requiring a Proxy or Voting Trust.

An SSA is not a form — it is a negotiated agreement with DCSA that imposes ongoing governance obligations: board composition requirements, senior officer eligibility restrictions, government director or special security officer requirements, annual reporting, and restrictions on access to certain categories of information. Negotiating and executing an SSA takes time — measured in months, not weeks — and requires both legal counsel experienced in FOCI and a FOCI advisor who understands the operational requirements DCSA will impose.

One point from the proposed rule deserves particular attention: DCSA has increasingly required mitigation around foreign influence even where there is not effective foreign ownership and control. This trend — which DCSA has been applying in the cleared contractor context for several years — is expected to extend to the Section 847 reviews. Contractors whose ownership structure does not include a foreign majority shareholder or foreign parent should not assume they are outside DCSA's scrutiny. Significant foreign revenue, foreign-national influence over corporate decisions, or contractual relationships with foreign entities can all trigger FOCI concerns that lead to a mitigation requirement.

What Cleared Contractors Should Not Assume

Cleared contractors — companies that already hold facility clearances and have existing FOCI mitigation agreements — should not assume they are fully prepared for the Section 847 process. Several issues are worth attention.

First, the SF-328 form has been updated. Cleared contractors who have not prepared a fresh SF-328 using the current version of the form should familiarize themselves with what has changed before they are required to submit one in connection with a covered unclassified contract. A submission on an outdated form creates a process delay that nobody needs at contract award time.

Second, the organizational facts underlying your current FOCI determination may have changed since your last full review. Ownership changes, new investors, additions to the board, new foreign contracts, or changes in foreign revenue — any of these can affect your FOCI posture. If your last comprehensive FOCI review was more than two years ago and your corporate structure has evolved, treat the Section 847 framework as an occasion to update your assessment before DCSA does it for you.

The Comment Period and What It Means Practically

Comments on the proposed rule are due July 6, 2026. The comment period is an opportunity to influence how the final rule is written — particularly on questions like the definition of "covered contracts," the timeline for FOCI reviews at contract award, and the treatment of small businesses who have no prior FOCI history. Industry associations, large primes, and law firms are active in the comment process. Individual contractors who want to shape the final rule should engage through their industry associations or submit comments directly.

However, the comment period should not be treated as a reason to defer preparation. DCSA has stated it is ready for the influx of new SF-328 submissions the rule will generate, which signals an intent to move the final rule forward without extended delay. Contractors who wait for the final rule to begin their ownership structure review will be in a worse position than those who start now.

What to Do Before July 6

For contractors on unclassified defense contracts above $5 million who have no current FOCI mitigation agreement, the steps are concrete:

• Map your ownership structure completely. Direct ownership is the starting point, not the endpoint. Trace beneficial ownership through all holding companies, private equity structures, and investment vehicles. Identify every foreign national in an officer or director position. Document foreign revenue as a percentage of total revenue. Identify all agreements, contracts, or ongoing relationships with foreign entities.
• Identify your FOCI exposure honestly. If your ownership structure includes foreign investors, a foreign parent, foreign-national officers or directors, or significant foreign revenue, you likely have a FOCI determination to make — not a form to fill out. Engage a FOCI advisor before you submit anything to DCSA.
• Review the updated SF-328. Understand what the current form asks before you need to complete it under contract award pressure.
• Engage FOCI-experienced legal counsel. The FOCI mitigation process — particularly if it leads to an SSA — involves legal agreements with substantive governance implications. The FOCI advisor handles the operational and compliance side; legal counsel handles the corporate structure and agreement side. You need both.
• Consider filing comments. If the rule as proposed creates operational problems for your contracting workflow — particularly around timing at contract award — document them specifically and submit or channel them through your industry association before July 6.

The Section 847 rule has been coming since 2020. The comment period gives contractors a short window to influence its final form. The ownership structure review should begin now regardless of what the final rule says — because the underlying facts DCSA will scrutinize do not change based on the regulatory timeline.