Proposed Rule2026-09067
Defense Federal Acquisition Regulation Supplement: Mitigating Risks Related to Foreign Ownership, Control, or Influence (DFARS Case 2021-D011)
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
May 7, 2026
Issuing agencies
Defense DepartmentDefense Acquisition Regulations System
Abstract
DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement sections of the National Defense Authorization Act for Fiscal Years 2020 and 2021 to mitigate risks related to beneficial ownership or foreign ownership, control, or influence. This proposed rule also implements elements of a DoD policy.
Full Text
<html>
<head>
<title>Federal Register, Volume 91 Issue 88 (Thursday, May 7, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 88 (Thursday, May 7, 2026)]
[Proposed Rules]
[Pages 24783-24788]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-09067]
[[Page 24783]]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
Defense Acquisition Regulations System
48 CFR Parts 212, 217, 240, and 252
[Docket DARS-2026-0133]
RIN 0750-AL30
Defense Federal Acquisition Regulation Supplement: Mitigating
Risks Related to Foreign Ownership, Control, or Influence (DFARS Case
2021-D011)
AGENCY: Defense Acquisition Regulations System, Department of Defense
(DoD).
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: DoD is proposing to amend the Defense Federal Acquisition
Regulation Supplement (DFARS) to implement sections of the National
Defense Authorization Act for Fiscal Years 2020 and 2021 to mitigate
risks related to beneficial ownership or foreign ownership, control, or
influence. This proposed rule also implements elements of a DoD policy.
DATES: Comments on the proposed rule should be submitted in writing to
the address shown below on or before July 6, 2026, to be considered in
the formation of a final rule.
ADDRESSES: Submit comments identified by DFARS Case 2021-D011, using
either of the following methods:
<bullet> Federal eRulemaking Portal: <a href="https://www.regulations.gov">https://www.regulations.gov</a>.
Search for DFARS Case 2021-D011. Select ``Comment'' and follow the
instructions to submit a comment. Please include ``DFARS Case 2021-
D011'' on any attached documents.
<bullet> Email: <a href="/cdn-cgi/l/email-protection#c6a9b5a2e8a2a0a7b4b586aba7afaae8abafaa"><span class="__cf_email__" data-cfemail="402f33246e2426213233002d21292c6e2d292c">[email protected]</span></a>. Include DFARS Case 2021-D011 in
the subject line of the message.
Comments received generally will be posted without change to
<a href="https://www.regulations.gov">https://www.regulations.gov</a>, including any personal information
provided. To confirm receipt of your comment(s), please check <a href="https://www.regulations.gov">https://www.regulations.gov</a>, approximately two to three days after submission
to verify posting.
FOR FURTHER INFORMATION CONTACT: Ms. Heather Kitchens, telephone 571-
296-7152.
SUPPLEMENTARY INFORMATION:
I. Background
DoD is proposing to revise the DFARS to implement paragraphs
(b)(2)(A), (b)(2)(C), and (c)(1) of section 847 of the National Defense
Authorization Act (NDAA) for Fiscal Year (FY) 2020 (Pub. L. 116-92) and
paragraph (c)(2) of section 819 of the NDAA for FY 2021 (Pub. L. 116-
283). Paragraph (b)(2)(A) of section 847 requires covered contractors
and subcontractors to disclose to the Defense Counterintelligence and
Security Agency (DCSA) their beneficial ownership and whether they are
under foreign ownership, control, or influence (FOCI) with updates for
any changes. Paragraph (b)(2)(A) also requires covered contractors and
subcontractors, if determined to be under FOCI, to disclose contact
information for each of their foreign owners that is a beneficial
owner.
Paragraph (b)(2)(C) of section 847 requires contract clauses
providing for and enforcing disclosures related to changes in FOCI or
beneficial ownership during performance of the contract or subcontract
and the effective mitigation of risks related to FOCI throughout the
duration of the contract or subcontract.
Paragraph (c)(1) of section 847 establishes that the disclosure and
risk mitigation requirements of the statute may apply to contracts for
commercial products or commercial services when a designated senior DoD
official makes a determination that the contract involves a risk or
potential risk to national security because of sensitive data, systems,
or processes.
Paragraph (c)(2) of section 819 adds a statutory deadline for DoD
to revise relevant directives, guidance, training, and policies,
including amending the DFARS to implement section 847 of the NDAA for
FY 2020.
In addition, DoD is proposing to revise the DFARS to implement
elements of a policy under DoD Instruction 5205.87, Mitigating Risks
Related to Foreign Ownership, Control, or Influence for Covered DoD
Contractors and Subcontractors, as required by section 847 of the NDAA
for FY 2020. DoD Instruction 5205.87 establishes procedures related to
the disclosure of beneficial ownership and FOCI information and
mitigation of FOCI risk.
II. Discussion and Analysis
The rule proposes to amend the DFARS by creating part 240,
Information Security and Supply Chain Security. In part 240, DoD
proposes to create section 240.27X, Mitigation of Risks Related to
Beneficial Ownership or Foreign Ownership, Control, or Influence, to
implement paragraphs (b)(2)(A), (b)(2)(C), and (c)(1) of section 847 of
the NDAA for FY 2020, paragraph (c)(2) of section 819 of the NDAA for
FY 2021, and elements of DoD Instruction 5205.87.
DoD proposes to add section 240.27X-1 to establish the scope of the
section and adds the definition of ``covered contractor or
subcontractor'' at 240.27X-2, to clarify which entities are impacted by
the statutory requirements.
Section 240.27X-3, Policy, is proposed to describe the statutory
requirements for disclosing information and mitigating FOCI risks
throughout the duration of the contract or subcontract. This section
also addresses exemption of the disclosure and risk mitigation
requirements for commercial products and commercial services, unless
the designated senior DoD official determines that the contract
involves a risk or potential risk to national security. The senior DoD
official has not yet been designated. The term ``designated senior DoD
official'' is used in this proposed rule as a placeholder.
The requirements at 240.27X-4, Procedures, are proposed to
establish the procedures necessary for contracting officers to
implement the statutory disclosure and risk mitigation requirements.
The section directs the contracting officer to not award, modify a
contract, or exercise an option unless the offeror or contractor has a
status of eligible in the National Industrial Security System (NISS),
available at <a href="https://niss.dcsa.mil">https://niss.dcsa.mil</a>.
Section 240.27X-5 prescribes use of the provision and clause in
solicitations and contracts with a value in excess of $5 million. The
language at 240.27X-5 clarifies that the provision and clause are only
to be included in solicitations and contracts using FAR part 12
procedures for the acquisition of commercial products and commercial
services if the designated senior DoD official determines that the
contract involves a risk or potential risk to national security or
potential compromise because of sensitive data, systems, or processes.
Updates are proposed in subpart 212.3 to include the provision and
clause in the list of provisions and clauses that are applicable to
commercial products and commercial services. In addition, updates in
subpart 217.2 are proposed to clarify that, prior to exercising an
option, the contracting officer must verify that the contractor has a
status of eligible in NISS.
A new solicitation provision was added at 252.240-70XX, Disclosure
of
[[Page 24784]]
Beneficial Ownership or Foreign Ownership, Control, or Influence-
Representation. The new solicitation provision requires offerors to
disclose their Standard Form (SF) 328, Certificate Pertaining to
Foreign Interests, and supporting documents for DCSA review in NISS.
The solicitation provision also requires offerors to represent by
submission of the offer that the offeror has submitted the SF 328 and
the contact information of each beneficial owner in NISS and that the
information is current, accurate, and complete. In addition, the
solicitation provision puts offerors on notice that if the requiring
activity determines, based on input from DCSA, that FOCI or beneficial
ownership poses a risk or potential risk of compromise to national
security that may be mitigated, the offeror must agree at the time of
award to implement a risk mitigation strategy within 90 days of award.
A new contract clause is proposed at 252.240-70YY, Disclosure of
Beneficial Ownership or Foreign Ownership, Control, or Influence. The
new contract clause requires contractors to--
(1) Disclose to DCSA their beneficial ownership and whether they
are under FOCI by submitting an updated SF 328 in NISS;
(2) Update the SF 328 and supporting documents, to include the
contact information of each beneficial owner in NISS.
III. Applicability to Contracts at or Below the Simplified Acquisition
Threshold (SAT), for Commercial Products (Including Commercially
Available Off-the-Shelf (COTS) Items), and for Commercial Services
This proposed rule includes a new solicitation provision and
contract clause to implement the requirements of paragraphs (b)(2)(A),
(b)(2)(C), and (c)(1) of section 847 of the NDAA for FY 2020 (Pub. L.
116-92) and paragraph (c)(2) of section 819 of the NDAA for FY 2021
(Pub. L. 116-283): (1) The provision at DFARS 252.240-70XX, Disclosure
of Beneficial Ownership or Foreign Ownership, Control, or Influence--
Representation; and (2) the clause at DFARS 252.240-70YY, Disclosure of
Foreign Ownership, Control, or Influence or Beneficial Ownership.
The provision at DFARS 252.240-70XX is prescribed at DFARS 240.27X-
5(a) for use in solicitations that include the clause at 252.240-70YY.
The clause at DFARS 252.240-70YY is prescribed at DFARS 240.27X-5(b)
for use in solicitations and contracts with a value in excess of $5
million. The clause is also required in solicitations and contracts
using FAR part 12 procedures for the acquisition of commercial products
and commercial services, if the designated senior DoD official
determines that the contract involves a risk or potential risk to
national security or potential compromise because of sensitive data,
systems, or processes.
DoD does not intend to apply the proposed rule to contracts at or
below the SAT, because the requirements of the proposed rule only apply
to contracts valued above $5 million. DoD intends to apply the proposed
rule to contracts for the acquisition of commercial products including
commercially available off-the-shelf (COTS) items and for the
acquisition of commercial services, as prescribed.
A. Applicability to Contracts at or Below the Simplified Acquisition
Threshold
The statute at 41 U.S.C. 1905 governs the applicability of laws to
contracts or subcontracts in amounts not greater than the simplified
acquisition threshold. It limits the applicability of laws to such
contracts or subcontracts. The statute at 41 U.S.C. 1905 provides that
if a provision of law contains criminal or civil penalties, or if the
Federal Acquisition Regulatory Council makes a written determination
that it is not in the best interest of the Federal Government to exempt
contracts or subcontracts at or below the SAT, the law will apply to
them. The Principal Director, Defense Pricing, Contracting, and
Acquisition Policy (DPCAP), is the appropriate authority to make
comparable determinations for regulations to be published in the DFARS,
which is part of the Federal Acquisition Regulation system of
regulations. DoD does not intend to make that determination. Therefore,
this proposed rule will not apply at or below the simplified
acquisition threshold.
B. Applicability to Contracts for the Acquisition of Commercial
Products Including COTS Items and for the Acquisition of Commercial
Services
The statute at 10 U.S.C. 3452 exempts contracts and subcontracts
for the acquisition of commercial products including COTS items, and
commercial services from provisions of law enacted after October 13,
1994, unless the Under Secretary of Defense (Acquisition and
Sustainment) (USD(A&S)) makes a written determination that it would not
be in the best interest of DoD to exempt contracts for the procurement
of commercial products and commercial services from the applicability
of the provision or contract requirement, except for a provision of law
that--
<bullet> Provides for criminal or civil penalties;
<bullet> Requires that certain articles be bought from American
sources pursuant to 10 U.S.C. 4862, or that strategic materials
critical to national security be bought from American sources pursuant
to 10 U.S.C. 4863; or
<bullet> Specifically refers to 10 U.S.C. 3452 and states that it
shall apply to contracts and subcontracts for the acquisition of
commercial products (including COTS items) and commercial services.
The statutes implemented in this proposed rule do not impose
criminal or civil penalties, do not require purchase pursuant to 10
U.S.C. 4862 or 4863, and do not refer to 10 U.S.C. 3452. Therefore,
sections 847 and 819 will not apply to the acquisition of commercial
services or commercial products including COTS items unless a written
determination is made. Due to delegations of authority, the Principal
Director, DPCAP is the appropriate authority to make this
determination.
DoD intends to make the determination to apply the statutes to the
acquisition of commercial products including COTS items and to the
acquisition of commercial services. Therefore, this proposed rule will
apply to the acquisition of commercial products including COTS items
and to the acquisition of commercial services, if a designed official
determines that the contract involves a risk or potential risk to
national security because of sensitive data, systems, or processes.
C. Determinations
Given that section 847 of the NDAA for FY 2020 and section 819 of
the NDAA for FY 2021 were enacted to promote the mitigation of FOCI or
beneficial ownership risk in the supply chain, and FOCI or beneficial
ownership risk is related to the ownership of the company and not
necessarily what is being procured, it is in the best interest of DoD
to apply the statute to contracts for the acquisition of commercial
services and commercial products, including COTS items, as defined at
Federal Acquisition Regulation 2.101. An exception for contracts for
the acquisition of commercial services and commercial products,
including COTS items, would exclude the contracts intended to be
covered by the law, thereby undermining the overarching public policy
purpose of the law.
IV. Expected Impact of the Rule
DoD is proposing to amend the DFARS to include the following
solicitation and contractual requirements to implement the statutory
requirements at paragraphs (b)(2)(A), (b)(2)(C), and (c)(1) of section
847 of the NDAA for FY 2020 (Pub. L. 116-92) and
[[Page 24785]]
paragraph (c)(2) of section 819 of the NDAA for FY 2021 (Pub. L. 116-
283):
<bullet> Offeror and contractor requirements to disclose to DCSA
their beneficial ownership and whether they are under FOCI.
<bullet> Contractor requirement to provide updates to their FOCI
and beneficial ownership disclosures to DCSA for the life of the
contract.
<bullet> Contractor requirement to disclose contact information for
each of its foreign owners that is a beneficial owner, if determined to
be under FOCI.
<bullet> Contractor requirement to mitigate risks related to FOCI
within 90 days of contract award, modification, exercise of option, or
identification of risks during contract performance.
As described in section VIII of this preamble, the costs associated
with the technical requirements related to the FOCI risk mitigation are
outside of the scope of this proposed rule. The costs associated with
the requirements for offerors to disclose FOCI and beneficial ownership
information to DCSA are covered by two information collection approvals
completed by the Office of the Under Secretary of Defense for
Intelligence and Security: (1) Certificate Pertaining to Foreign
Interests, SF-328, OMB Control Number 0704-0579; and (2) National
Industrial Security System (NISS), OMB Control Number 0705-0006. The
burden calculated for OMB Control Number 0704-0579 for the SF 328 is
$7,352,560, and the burden calculated for OMB Control Number 0705-0006
for the NISS is $712,281 (source: <a href="http://reginfo.gov">reginfo.gov</a>).
This proposed DFARS rule, if finalized, will apply to contracts
valued above $5 million. The proposed rule may also apply to certain
contracts for commercial products and commercial services if a
designated senior DoD official determines that the contract involves a
risk or potential risk to national security or potential compromise
because of sensitive data, systems, or processes.
According to data from the Federal Procurement Data System (FPDS),
the average number of unique entities for fiscal years 2022 through
2024 with awards above $5 million, excluding awards using exclusively
commercial procedures, is 3,774. Of those entities, 2,148 (57%) are
unique small businesses. DoD has no way to know how many exclusively
commercial awards will have an exception that applies the disclosure
and reporting requirements to those offerors and contractors, so it
assumes exclusively commercial awards will not include reporting and
disclosure requirements.
To calculate the number of potential offerors and subcontractors
impacted by this proposed rule, DoD assumes for every unique entity
with awards above $5 million, there are two offerors on average per
award and that the entities awarded contracts have on average 5
subcontractors, for a total of 37,740 potentially impacted entities. Of
those entities, 21,511 (57%) are estimated to be small businesses.
For updates to disclosures, DoD does not know the number of
contractors who will need to make updates to their FOCI and beneficial
ownership disclosure information, or the number of updates they will
need to make. DoD assumes half of all contractors may have to update
information during the performance of the contract. To estimate the
number of impacted contractors, DoD used the average number of unique
awardees with contracts valued above $5 million, which is 3,774. DoD
multiplied 3,774 by an assumed 5 subcontractors per unique awardee,
which equals 18,870. DoD multiplied this number by 50 percent to arrive
at an estimate of 9,435 contractors would need to update their
disclosures.
In addition, prior to exercising an option or modifying a contract,
contractors will need to disclose FOCI and beneficial ownership
information to DCSA. DoD does not have a way to estimate the number of
potential modifications or options exercised, so DoD assumes 10% of the
assumed total number of impacted contractors (18,870) could be
impacted. Therefore, DoD assumes that 1,887 contractors may be subject
to modifications or the exercise of options that would result in
disclosure update requirements.
The proposed rule includes a requirement for offerors to represent,
by submission of an offer, that (1) they have submitted the SF 328 and
contact information for each beneficial owner in the NISS and (2) the
information is current, accurate, and complete. DoD estimates that,
before submitting their offers, 7,548 offerors will verify submission
of the required information and that the information provided is
current, accurate, and complete. DoD further estimates these offerors
may submit 2 offers per year in response to solicitations containing
the representation requirement. The verification is expected to require
about 10 minutes and to be performed by a journeyman employee
equivalent to a General Schedule grade 12, step 5 ($66.23, including
overhead rate of 36.25%). The annual cost associated with the
verification is $168,534.
An important benefit of this proposed rule is that, if finalized,
it will help reduce the risk of foreign adversaries gaining
unauthorized access to DoD information. The proposed rule provides for
the implementation of statutory FOCI and beneficial ownership
requirements, resulting in more secure DoD acquisitions. The proposed
rule also reduces the risk of the introduction of contract performance
risk and theft of DoD intellectual property by foreign adversaries. As
a result, this proposed rule will support the underlying statutory
requirement to reduce FOCI and beneficial ownership risk to national
security.
V. Executive Orders 12866 and 13563
Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess
all costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). E.O.
13563 emphasizes the importance of quantifying both costs and benefits,
of reducing costs, of harmonizing rules, and of promoting flexibility.
This is a significant regulatory action and, therefore, was subject to
review under section 6(b) of E.O. 12866, Regulatory Planning and
Review, as amended.
VI. Executive Order 14192
This proposed rule, if finalized as proposed, is not expected to be
subject to E.O. 14192, because the proposed rule is being issued with
respect to a national security function of the United States. The
proposed rule implements the contractual requirements of section 847 of
the NDAA for FY 2020 related to FOCI and beneficial ownership. The
proposed rule is critical to the national security of the United States
and directly supports DoD's mission of maintaining a secure and
resilient defense industrial base (DIB). The implementation of the
contractual requirements in this proposed rule is not merely an
administrative action but a vital step in safeguarding the nation's
military and technological advantage from FOCI risk.
The primary benefit of the section 847 requirement is the
unprecedented level of visibility it provides into the ownership
structures of offerors and contractors, particularly for contracts that
do not involve access to classified information. Historically, this has
been a significant vulnerability. Foreign adversaries have exploited
this gap to gain access to sensitive, unclassified information,
intellectual property, and critical technologies through various
[[Page 24786]]
ownership, control, and influence avenues of foreign interest. By
mandating the disclosure of FOCI and beneficial ownership, this rule
proposes to close that gap, directly reducing the risk of unauthorized
access to DoD information and mitigating the potential for theft of
intellectual property that underpins our warfighting capabilities. This
directly enhances the security of DoD acquisitions and minimizes
contract performance risks associated with contractors who may be
subject to foreign adversary leverage.
This initiative is fully aligned with and supports a broader,
Governmentwide strategy to secure the nation's critical supply chains,
as articulated in recent Executive orders. For example, E.O. 14017,
America's Supply Chains, directs a whole-of-Government approach to
assessing and strengthening supply chain resilience, with a specific
focus on the DIB. Section 847 is a direct and necessary implementation
of this directive, providing the foundational data required to
understand and mitigate foreign-based risks with the defense supply
chain.
Furthermore, the proposed rule complements the objectives of E.O.
14028, Improving the Nation's Cybersecurity, which emphasizes the need
to secure the software supply chain and improve the detection of
cybersecurity vulnerabilities. By identifying potentially compromised
or influenced offerors and contractors, section 847 serves as a
critical upstream defense, preventing threats from entering the supply
chain in the first place. This proactive stance is essential for
protecting the integrity of the data and systems on which DoD relies.
In essence, this proposed rule is not an isolated regulatory burden
but a cornerstone of DoD's strategy to counter pervasive threats from
strategic competitors. It provides the necessary tools to ensure our
partners in industry are secure, trustworthy, and free from the
influence of those who seek to harm our national interests. Application
of the requirements of E.O. 14192 to this proposed rule would
unacceptably impede DoD's ability to meet the above objectives and
limit the ability to meet congressionally managed, mission-critical
security functions. For these reasons, DoD finds the implementation of
the contractual requirements in this proposed rule critical to national
security.
VII. Regulatory Flexibility Act
DoD does not expect this proposed rule, when finalized, to have a
significant economic impact on a substantial number of small entities
within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et
seq., because the rule simply requires certain offerors and contractors
to disclose information about FOCI and beneficial ownership and to
conduct risk mitigation efforts, if applicable. However, an initial
regulatory flexibility analysis has been performed and is summarized as
follows:
This proposed rule is necessary to respond to the threat to U.S.
national security posed by beneficial ownership and foreign ownership,
control, or influence (FOCI) risks under contracts and subcontracts.
The purpose of this proposed rule is to implement statutory disclosure
and risk mitigation requirements related to information associated with
FOCI and beneficial ownership. This proposed rule requires covered
contractors and subcontractors to share their FOCI disclosures and
beneficial ownership information with the Defense Counterintelligence
and Security Agency (DCSA). This proposed rule also requires covered
contractors to mitigate risks associated with being under FOCI within
90 days of contract award, modification, option exercise, or
identification of risks during contract performance. Covered
contractors and subcontractors are existing or prospective contractors
or subcontractors, at any tier, of DoD with a contract or subcontract
valued above $5 million.
The proposed rule does not apply to commercial products and
commercial services, unless the designated senior DoD official
determines that the contract involves a risk or potential risk to
national security or potential compromise because of sensitive data,
systems, or processes.
One objective of this proposed rule is to partially implement
section 847 of the National Defense Authorization Act (NDAA) for Fiscal
Year (FY) 2020 (Pub. L. 116-92) and section 819 of the NDAA for FY 2021
(Pub. L. 116-283). This proposed rule also implements elements of DoD
Instruction 5205.87, Mitigating Risks Related to Foreign Ownership,
Control, or Influence for Covered DoD Contractors and Subcontractors.
This proposed rule will impact small businesses that are existing
or prospective contractors or subcontractors of DoD on contracts valued
above $5 million. In addition, this proposed rule will impact
commercial entities. According to data from the Federal Procurement
Data System, the average number of unique entities for FY 2022 through
FY 2024 with awards above $5 million, excluding awards using
exclusively commercial procedures, is 3,774, of which 2,148 (57%) are
unique small entities. DoD has no way to know how many exclusively
commercial awards will have an exception that applies the disclosure
and reporting requirements to those offerors and awardees. Therefore
DoD assumes exclusively commercial awards will not include reporting
and disclosure requirements.
To calculate the number of potential offerors and subcontractors
impacted by this proposed rule, DoD assumes for every unique entity
with awards above $5 million, there are two offerors on average per
award and that awardees have on average 5 subcontractors. The estimated
total number of potentially impacted awardees is 37,740, of which
21,511 (57%) are estimated to be small entities.
This proposed rule does not impose new reporting, recordkeeping, or
other compliance requirements for small entities beyond those approved
in OMB Control Numbers 0704-0579, Certificate Pertaining to Foreign
Interests, SF-328; and 0705-0006, National Industrial Security System
(NISS). The projected reporting and compliance requirements associated
with OMB Control Numbers 0704-0579 and 0705-0006 include the following:
(1) disclosing to DCSA any FOCI and beneficial ownership information by
submitting an updated SF 328, Certificate Pertaining to Foreign
Interest, in NISS along with any supporting information; (2)
maintaining the information in NISS for the duration of the contract;
and (3) if determined to be under FOCI, disclosing to DCSA in NISS the
contact information for all foreign owners that are beneficial owners.
In addition, if there is a requirement for a contractor to complete a
risk mitigation strategy, they will be required to do so within 90 days
of contract award.
These reporting requirements would apply to any small entities that
are existing or prospective contractors or subcontractors of DoD on
contracts valued above $5 million.
This proposed rule does not duplicate, overlap, or conflict with
any other Federal rules.
There are no known alternatives that would accomplish the stated
objectives of the applicable statute.
DoD invites comments from small business concerns and other
interested parties on the expected impact of this proposed rule on
small entities.
DoD will also consider comments from small entities concerning the
existing regulations in subparts affected by this proposed rule in
accordance with 5 U.S.C. 610. Interested parties must submit such
comments separately
[[Page 24787]]
and should cite 5 U.S.C. 610 (DFARS Case 2021-D011), in correspondence.
VIII. Paperwork Reduction Act
This proposed rule contains information collection requirements
that require the approval of the Office of Management and Budget under
the Paperwork Reduction Act (44 U.S.C. chapter 35). However, the Office
of the Under Secretary of Defense for Intelligence and Security
completed two information collection approvals: (1) Certificate
Pertaining to Foreign Interests, SF-328, OMB Control Number 0704-0579;
and (2) National Industrial Security System (NISS), DCSA Form 147, OMB
Control Number 0705-0006.
Accordingly, DoD has not submitted a request for approval of a new
information collection requirement concerning DFARS Case 2020-D011,
Mitigating Risks Related to Foreign Ownership, Control, or Influence,
to the Office of Management and Budget.
List of Subjects in 48 CFR Parts 212, 217, 240, and 252
Government procurement.
Kimberly R. Ziegler,
Editor/Publisher, Defense Acquisition Regulations System.
Therefore, the Defense Acquisition Regulations System proposes to
amend 48 CFR chapter 2 as follows:
PART 212--ACQUISITION OF COMMERCIAL PRODUCTS AND COMMERCIAL
SERVICES
0
1. The authority citation for part 212 continues to read as follows:
Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.
0
2. Amend section 212.301 by--
0
a. Redesignating paragraphs (f)(xvii) through (xxii) as (f)(xviii)
through (xxiii); and
0
b. Adding new paragraph (f)(xvii).
The addition reads as follows:
212.301 Solicitation provisions and contract clauses for the
acquisition of commercial products and commercial services.
* * * * *
(f) * * *
(xvii) Part 240--Information Security and Supply Chain Security.
(A) Insert the provision at 252.240-70XX, Disclosure of Beneficial
Ownership or Foreign Ownership, Control, or Influence--Representation,
as prescribed in 240.27X-5(a), to comply with section 847 of the
National Defense Authorization Act for Fiscal Year 2020 and section 819
of the National Defense Authorization Act for Fiscal Year 2021.
(B) Insert the clause at 252.240-70YY, Disclosure of Beneficial
Ownership or Foreign Ownership, Control, or Influence, as prescribed in
240.27X-5(b)(1) or (2), to comply with section 847 of the National
Defense Authorization Act for Fiscal Year 2020 and section 819 of the
National Defense Authorization Act for Fiscal Year 2021.
* * * * *
PART 217--SPECIAL CONTRACTING METHODS
0
3. The authority citation for part 217 continues to read as follows:
Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.
0
4. Amend section 217.207 by adding paragraph (c)(3) to read as follows:
217.207 Exercise of options.
(c) * * *
(3) Verifying the contractor has an eligible status in the National
Industrial Security System (see 240.27X-4).
0
5. Add part 240 to read as follows:
PART 240--INFORMATION SECURITY AND SUPPLY CHAIN SECURITY
Subpart 240.1 [Reserved]
Subpart 240.2--Security Prohibitions and Exclusions
Sec.
240.27X Mitigation of risks related to beneficial ownership or
foreign ownership, control, or influence.
240.27X-1 Scope.
240.27X-2 Definition.
240.27X-3 Policy.
240.27X-4 Procedures.
240.27X-5 Solicitation provision and contract clause.
Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.
Subpart 240.1 [Reserved]
Subpart 240.2--Security Prohibitions and Exclusions
240.27X Mitigation of risks related to beneficial ownership or
foreign ownership, control, or influence.
240.27X-1 Scope.
This section implements--
(a) Paragraphs (b)(2)(A), (b)(2)(C), and (c)(1) of section 847 of
the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2020
(Pub. L. 116-92);
(b) Paragraph (c)(2) of section 819 of the NDAA for FY 2021 (Pub.
L. 116-283); and
(c) Elements of DoD Instruction 5205.87, Mitigating Risks Related
to Foreign Ownership, Control, or Influence for Covered DoD Contractors
and Subcontractors.
240.27X-2 Definition.
Covered contractor or covered subcontractor, as used in this
section, means a company that is an existing or prospective contractor
or subcontractor, at any tier, of DoD for a contract valued in excess
of $5 million.
240.27X-3 Policy.
(a) Section 847 of the NDAA for FY 2020 requires covered
contractors and covered subcontractors to--
(1) Disclose to the Defense Counterintelligence and Security Agency
(DCSA) their beneficial ownership and whether they are under foreign
ownership, control, or influence (FOCI);
(2) Update such disclosures when changes occur; and
(3) If under FOCI, disclose contact information for each of its
foreign owners that is a beneficial owner.
(b) Section 819 of the NDAA for FY 2021 requires effective
mitigation of FOCI risks throughout the duration of the contract or
subcontract.
(c) The requirements in paragraphs (a) and (b) of this section do
not apply to commercial products and commercial services, unless the
designated senior DoD official determines that the contract involves a
risk or potential risk to national security or potential compromise
because of sensitive data, systems, or processes.
240.27X-4 Procedures.
(a) Contracting officers must not award, modify, or exercise an
option or otherwise extend a contract, task order, or delivery order
with a value in excess of $5 million unless the contractor or
prospective contractor has an eligible status in the National
Industrial Security System or an exception applies (see 240.27X-3(c)).
(b) See PGI 240.27X-4 for additional procedures.
240.27X-5 Solicitation provision and contract clause.
(a) Insert the provision at 252.240-70XX, Disclosure of Beneficial
Ownership or Foreign Ownership, Control, or Influence--Representation,
in solicitations that include the clause at 252.240-70YY.
(b)(1) Insert the clause at 252.240-70YY, Disclosure of Beneficial
Ownership or Foreign Ownership, Control, or Influence, in solicitations
and contracts valued in excess of $5 million.
(2) Insert the clause in solicitations and contracts valued in
excess of $5 million for the acquisition of commercial products and
commercial services, if the designated senior DoD
[[Page 24788]]
official determines that the contract involves a risk or potential risk
to national security or potential compromise because of sensitive data,
systems, or processes.
PART 252--SOLICITATION PROVISIONS AND CONTRACT CLAUSES
0
6. The authority citation for part 252 continues to read as follows:
Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.
0
7. Add sections 252.240-70XX and 252.240-70YY to read as follows:
252.240-70XX Disclosure of Beneficial Ownership or Foreign Ownership,
Control, or Influence--Representation.
As prescribed in 240.27X-5(a), use the following provision:
DISCLOSURE OF BENEFICIAL OWNERSHIP OR FOREIGN OWNERSHIP, CONTROL, OR
INFLUENCE--REPRESENTATION (DATE)
(a) Definitions. As used in this provision, beneficial owner,
company, foreign ownership, control, or influence, and foreign
interest are defined in the Defense Federal Acquisition Regulation
Supplement 252.240-70YY, Disclosure of Beneficial Ownership or
Foreign Ownership, Control, or Influence, clause of this
solicitation.
(b) Disclosure and risk mitigation requirements. In accordance
with section 847 of Public Law 116-92 and section 819 of Public Law
116-283, DoD is prohibited from awarding a contract with a value in
excess of $5 million to an offeror unless the Offeror--
(1) Makes the foreign ownership, control, or influence (FOCI) or
beneficial ownership disclosures described in paragraph (c) of this
provision; and
(2)(i) Is determined to not have risk related to FOCI or
beneficial ownership; or
(ii) Agrees to execute and implement the risk mitigation
strategies identified by the program office or requiring activity
within 90 calendar days of contract award.
(c) Disclosures. (1) The Offeror shall submit for Defense
Counterintelligence and Security Agency (DCSA) review the Standard
Form (SF) 328, Certificate Pertaining to Foreign Interests, and
supporting documents to include the contact information for each of
its foreign owners that is a beneficial owner in the National
Industrial Security System, available at <a href="https://niss.dcsa.mil">https://niss.dcsa.mil</a>.
(2) If the requiring activity determines, based on input from
DCSA, that FOCI or beneficial ownership poses a risk or potential
risk of compromise to national security that may be mitigated, the
Offeror shall--
(i) Agree to the risk mitigation strategies at time of award;
and
(ii) Implement the risk mitigation strategies within 90 calendar
days of contract award.
(d) Representation. By submission of its offer, the Offeror
represents that--
(1) It has submitted the SF 328, Certificate Pertaining to
Foreign Interests, and the contact information of each beneficial
owner in the National Industrial Security System; and
(2) The information is current, accurate, and complete.
(End of provision)
252.240-70YY Disclosure of Beneficial Ownership or Foreign Ownership,
Control, or Influence.
As prescribed in 240.27X-5(b)(1) or (2), use the following clause:
DISCLOSURE OF BENEFICIAL OWNERSHIP OR FOREIGN OWNERSHIP, CONTROL, OR
INFLUENCE (DATE)
(a) Definitions. As used in this clause--
Beneficial owner is defined at 17 CFR 240.13d-3.
Company means any corporation, limited liability company,
limited partnership, business trust, business association, or other
similar entity.
Foreign interest means any foreign government, agency of a
foreign government, or representative of a foreign government; any
form of business enterprise or legal entity organized, chartered, or
incorporated under the laws of any country other than the United
States or its territories; and any person who is not a citizen or
national of the United States.
Foreign ownership, control, or influence is defined at 32 CFR
part 117.11.
(b) Contractor under foreign ownership, control, or influence
(FOCI). The Contractor is under FOCI if it--
(1) Has a current facility clearance and meets the standards at
32 CFR 117.11(a)(1);
(2) Is in the process of obtaining a facility clearance and
meets the standards at 32 CFR 117.11(a)(1); or
(3) Has not been granted a facility clearance and is not in the
process of obtaining a facility clearance; and
(4) A foreign interest has the power, directly or indirectly,
regardless of whether the power is exercised or is exercisable
through the ownership of the U.S. company's securities, to--
(i) Direct or decide matters affecting the management or
operations of that company in a manner that may result in a risk or
potential risk to national security or potential compromise of
sensitive data, systems, or processes; or
(ii) Otherwise control or influence the business or management
of the Contractor in a manner that could adversely affect its
ability to perform the contract or subcontract.
(c) Procedures. In accordance with section 847 of the National
Defense Authorization Act (NDAA) for Fiscal Year (FY) 2020 and
section 819 of the NDAA for FY 2021, the Contractor shall--
(1) Agree to the risk mitigation strategies identified in the
National Industrial Security System at the time of contract award,
option exercise, modification, or identification of postaward
changes;
(2) Implement the risk mitigation strategies within 90 calendar
days of contract award, option exercise, modification, or the
identification of risks during contract performance;
(3) Complete, update, and verify the currency of the Standard
Form (SF) 328, Certificate Pertaining to Foreign Interests, and
supporting documents, to include the contact information of each
beneficial owner in the National Industrial Security System
available at <a href="https://niss.dcsa.mil">https://niss.dcsa.mil</a>, prior to contract modification
or renewal, or when changes occur to information previously
provided; and
(4) Ensure all subcontractors and suppliers that are
subcontractors awarded subcontracts that exceed $5 million have an
eligible status in the National Industrial Security System prior to
subcontract award and maintain the status of eligible in the
National Industrial Security System for the duration of subcontract
performance.
(d) Reporting.
(1) If the Contractor has any changes in FOCI or beneficial
ownership during performance of the contract, or if the Contractor
is notified of such by a subcontractor at any tier or supplier, the
Contractor shall report the changes by submitting an updated SF 328,
Certificate Pertaining to Foreign Interests, in the National
Industrial Security System.
(2) If the Contractor determines that the changes may place it
or the subcontractor at any tier under FOCI--
(i) Within 3 business days from the date of such identification
or notification, if applicable, the Contractor shall report the
foreign owner's name or the beneficial owner's name; relevant
information about the foreign owner or beneficial owner; and any
readily available information about risk mitigation actions
undertaken or recommended; and
(ii) Within 10 business days of being notified by DCSA that FOCI
or beneficial ownership poses a risk or potential risk of compromise
to national security, the Contractor shall initiate a plan of action
to implement DCSA's recommendations; submit additional information;
describe any risk mitigation efforts undertaken to date; and confirm
in the National Industrial Security System that it will comply with
the identified risk mitigation recommendations.
(e) Subcontracts. The Contractor shall insert the substance of
this clause, including this paragraph (e), in subcontracts and other
contractual instruments that exceed $5 million.
(End of clause)
[FR Doc. 2026-09067 Filed 5-6-26; 8:45 am]
BILLING CODE 6001-FR-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on May 7, 2026.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.