Cybersecurity Policy Report, Defense Contractors Would Have to Disclose Foreign Ties Under DoD Proposal, (May 6, 2026)
Defense contractors would have to disclose their foreign ties under rules proposed by the Department of Defense that are designed to curb foreign adversaries’ access to DoD systems, according to a notice scheduled for publication in tomorrow’s Federal Register.
“DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement sections of the National Defense Authorization Act for Fiscal Years 2020 and 2021 to mitigate risks related to beneficial ownership or foreign ownership, control, or influence,” the notice says.
The laws cited by DoD require “covered contractors and subcontractors to disclose to the Defense Counterintelligence and Security Agency (DCSA) their beneficial ownership and whether they are under foreign ownership, control, or influence (FOCI),” the notice explains.
The laws also require contract clauses providing for “the effective mitigation of risks related to FOCI throughout the duration of the contract or subcontract,” it adds.
The proposed rule would apply to contracts worth more than $5 million and would include commercial “off-the-shelf” products and services.
The new rules would provide an “unprecedented level of visibility ... into the ownership structures of offerors and contractors,” the notice says. “Historically, this has been a significant vulnerability. Foreign adversaries have exploited this gap to gain access to sensitive, unclassified information, intellectual property, and critical technologies through various ownership, control, and influence avenues of foreign interest.”
“By mandating the disclosure of FOCI and beneficial ownership, this rule proposes to close that gap, directly reducing the risk of unauthorized access to DoD information and mitigating the potential for theft of intellectual property that underpins our warfighting capabilities,” it says.
“Furthermore, the proposed rule complements the objectives of E.O. 14028, Improving the Nation’s Cybersecurity, which emphasizes the need to secure the software supply chain and improve the detection of cybersecurity vulnerabilities,” it adds.
“By identifying potentially compromised or influenced offerors and contractors,” the rules will provide “a critical upstream defense, preventing threats from entering the supply chain in the first place,” the notice says.
Comments on the proposed rules will be due 60 days after their Federal Register publication and should be submitted in DFARS case 2021-D011 at regulations.gov.
News: FederalLegislation DataSecurity