Erin Estevez has a warning for Defense contractors—if you think you’re in the clear because of the CMMC Phase 2 pause, you may not be ready for what’s next. A new compliance regime is right around the corner. And the soon-to-be-required disclosures on Foreign Ownership, Control, and Influence (FOCI) are much broader than the name suggests. If you have a contract with a foreign company, an overseas investor, or an employee on Visa status, you will probably need to comply. These rules will be especially important for firms seeking VC or private equity investment.
Erin joined me on GovCon Intelligence to explain how far the FOCI disclosures will reach, how to comply with the tight 3-day deadlines, and what DCSA is planning to do with the coming onslaught of cases. This is definitely an area to pay attention to as the military tries to attract nontraditional contractors and small businesses.
Links
Erin Estevez on LinkedIn https://www.linkedin.com/in/erin-estevez-96a09236/
DoD Proposed Rule on Mitigating Risks Related to Foreign Ownership, Control, or Influence https://www.federalregister.gov/documents/2026/05/07/2026-09067/defense-federal-acquisition-regulation-supplement-mitigating-risks-related-to-foreign-ownership
SF 328 https://www.gsa.gov/reference/forms/certificate-pertaining-to-foreign-interests
S.4648 - A bill to improve transparency with respect to foreign influence on Department of Defense contractors https://www.congress.gov/bill/119th-congress/senate-bill/4648/text
Chapters
00:00 - Introduction to GovCon and FOCI Rules
01:16 - Current Tracking of Foreign Ownership, Control, and Influence
04:05 - The Proposed Expansion of the FOCI Regime
06:29 - Deep Dive into Standard Form 328 (SF-328)
11:11 - Impact on Commercial Acquisitions
12:51 - M&A Activity and Investor Disclosure Obligations
17:04 - Pre-Transaction Engagement and Mitigation Strategies
20:33 - Post-Award Monitoring and Compliance
21:55 - The Three-Day Reporting Rule and Tight Timelines
25:40 - Supply Chain and Subcontractor Flow-Down Responsibilities
27:34 - Consequences of Non-Compliance and Enforcement Risks
29:33 - Case Volume Explosions and Acquisition Bottlenecks
32:55 - Legislative Interest and Policy Trajectories
36:15 - Small Business Compliance Burdens and Front-Loaded Costs
41:13 - CMMC Parallels and Future Rule Predictions
43:25 - Guest Outro and Contact Information
Transcript
Introduction to FOCI Rules
Sam: Welcome to GovCon Intelligence. The burdens on the small business defense industrial base have been in the news lately, especially with the Department of War’s recent pause on CMMC Phase 2, but there are still more burdens to come. Today, we’re going to be talking about the upcoming changes to disclosure on Foreign Ownership, Control, and Influence, or FOCI. There are changes to the applicability of the FOCI rules to small business contracts, even as low as $5 million. So, my guest today to get into this FOCI issue is Erin Estevez. Erin is a government contracts attorney who has been practicing for 16 years, particularly with small businesses and the defense industrial base. Erin, welcome to GovCon Intelligence.
Erin: Thanks for having me, Sam. I appreciate it.
Current Tracking of Foreign Ownership, Control, and Influence
Sam: Tell us first, under the current rules, what happens now? Is this just a Department of War issue or is it broader than that? How is foreign ownership, control, and influence tracked among suppliers and companies supplying the federal government?
Erin: Sure. So, focusing specifically on the Department of War, there is really no comprehensive way that they track foreign investment in their contractors. The only sort of comprehensive regime that exists right now for the defense industrial base is in the classified space. Any contractor that has a classified requirement on a DoD contract has to go through a very similar process to what we’re going to talk about today. They fill out a form called the SF-328, which is a Certificate Pertaining to Foreign Interests. As we’ll discuss in detail, it tracks information about ownership and other foreign touchpoints. Then, the contractor goes through a review process with the DCSA, which is the Defense Counterintelligence and Security Agency.
Depending on the outcome of that diligence, DCSA might require the contractor to put some mitigation instruments in place to deal with any potential threat to national security or classified information that the government judges could come from that FOCI identified for a particular contractor. The contractor is then responsible for implementing the FOCI mitigation, and the contract performance can move forward. That is a very familiar process in the classified space.
Otherwise, DoD gets some insight into foreign ownership through things like the CFIUS process, right? If there’s an investment that goes through CFIUS, DoD is part of that review. Oftentimes, there are parallel DCSA and CFIUS reviews if it’s a cleared contractor. There are certain programs where foreign involvement is also part of the initial assessment, like the SBIR program, for example, where there are limitations on other than U.S. ownership and control.
Sam: And those were just made stricter in the recent SBIR reauthorization.
Erin: Exactly, and now we have foreign risk reviews for SBIR contracts as well. Certain contracts themselves will have provisions that either put some limits on foreign involvement in the solicitation materials—either in the supply chain or the ownership structure of the offeror—or have an issued contract that addresses foreign technology access. For example, if there’s going to be a transfer of technology developed under the contract, the contractor has to notify the government and go through a review process.
Again, these are kind of siloed operations that come up in very distinct contexts. There’s not really an overarching regime for tracking, monitoring, and mitigating foreign ownership or control in defense contractors. This proposed rule is really an attempt to come up with a regime that covers that in a more holistic way.
The Proposed Expansion of the FOCI Regime
Sam: So it’s been scattershot up until now. You’ve had classified contracts completely covered, but otherwise, it’s been contract-by-contract or within particular programs. What is the proposal to change this regime?
Erin: This regime would expand essentially what DCSA and DoD do for classified contractors to all DoD contractors with contracts over $5 million. It is a really significant expansion of the current regime, and it’s not something that contractors outside of the classified space have had to really manage in the past.
A lot of the concern coming out of industry focuses on how well this system, which is currently in place for classified contracts, will translate to the broader DoD contracting base. How is DoD going to manage the influx of cases they now have to handle? How is it going to impact the acquisition timeline? There are a lot of concerns about the implementation in particular.
Deep Dive into Standard Form 328 (SF-328)
Sam: Oh, that’s interesting. So it’s not just the impact on individual companies that are over the $5 million threshold, where they now have to fill out this form and face the risk of being found non-responsible or required to implement mitigation measures. It’s also just generally about the timeline and how it can slow down procurement. How long does that process usually take in the classified area?
Erin: It routinely takes six to 12 months to go through the disclosure, mitigation requirement and the negotiation of what those requirements will be. Then, there’s a period of time contractors have to implement the mitigation once contract performance begins. It really depends on how complex the ownership structure is, what the foreign touchpoints are, and what kind of mitigation could be required.
Certainly, some of that is driven by DCSA’s workload and how quickly they can respond. They have actually worked very hard the last few years to keep those timelines on the lower end of the spectrum to the extent they are able to. With that as a backdrop, and given how significantly the caseload is going to increase, the current rule proposes that DCSA will review new FOCI submissions within 25 working days of submission. Then, post-contract award, contractors have a 90-day period to implement the requirements. I think there is some healthy skepticism about how quickly DCSA is really going to be able to work through those, which is understandable given the jump in total cases coming across their desk.
Sam: Let me just be more specific about what we’re talking about. This is a proposed rule published by the Department of Defense under the DFARS—the Defense Acquisition Regulation System—on May 7, 2026. Comments have been filed already; they were due July 6, 2026. This would affect solicitation provisions in Part 240 of the DFARS. Under the rule, disclosure would require filling out the form you mentioned, the Standard Form 328.
The form is straightforward, I suppose—it only has nine questions, so it’s not a long form. But looking at it, the fact that this rule applies to foreign ownership, control, or influence is a bit misleading because the form asks for a lot more than just ownership. One of the questions, Question 5, asks: “Does your organization have any contracts, agreements, understandings, grants, side letters, or arrangements with a foreign person?” It also gets into revenue, agreements, and debt. How broadly is this going to apply, particularly to small businesses? How likely is it that they’re going to have to disclose something once they read through these questions and realize, “Oh, maybe I do have a foreign contract, or I do get revenue from foreign sources”?
Erin: The short answer is: very broadly. The form itself is deceptively simple on its face, but as you start reading the questions, it is much more expansive than just ownership. For a long time in the classified space, there was a heavy emphasis on ownership being the primary concern coming out of these FOCI reviews. In the last number of years, DCSA has really moved to focus more and more on the other vectors of control and influence—the “C” and the “I” in FOCI.
The nature of the questions recognizes that a company can be influenced by ownership in the traditional sense, but also if they have a large debt instrument with a foreign bank, a significant customer relationship overseas, or a large constellation of contracts with foreign vendors. All of that could significantly influence their performance of contracts and the safeguarding of information.
As you read through the form, Question 5 definitely stands out to a lot of folks because it is so expansive. Now, many of the other pages of the form consist of instructions for the questions, and they have worked hard to give more context to what they’re really asking for. For Question 5, it does require disclosure of supplier agreements and overseas customer relationships. The instructions even reference employees under visa sponsorships, because in that context, you’re talking about an agreement with a foreign person. Reading the instructions and really understanding the context for this exercise goes a long way in helping contractors see how expansive it is and why it needs to be that way.
I will caveat that by saying just because you have a disclosure on this form—let’s say you have a vendor in France or a constellation of customers in South Africa—that doesn’t necessarily mean you are going to be prohibited from performing work under this new rule for a contract over $5 million, or even that you would need to be under a mitigation instrument. What DCSA is trying to do is get an overall picture of the various vectors of ownership, control, or influence by foreign individuals or companies over a particular contractor. Given that picture as a whole, DCSA determines what they feel the threat is and how it can be mitigated, if necessary.
There will be circumstances where you have a “yes” response. The second page of the form provides a space for remarks where you explain those “yes” responses, and you can attach additional pages. There are plenty of circumstances where a “yes” response doesn’t result in any mitigation as long as the information is provided. It’s really important that companies, as they’re preparing for this process, read the form carefully, understand how expansive it is, and start collecting that information sooner rather than later, because it can take quite a long time to gather if it’s an exercise a contractor hasn’t done before.
Impact on Commercial Acquisitions
Sam: What about commercial contractors? Are they going to be affected by this?
Erin: Yes. The rule right now exempts commercial acquisitions, but it leaves room for a senior DoD official to decide that a particular commercial acquisition is covered if there are risks to national security based on sensitive data, processes, or systems.
Now, most of those terms are not defined in the rule. They have not named the DoD official who will be in charge or specified the level of seniority that will be required. They have also not disclosed the criteria that will be used to decide if a commercial acquisition should be covered, nor have they defined the “sensitive data, process, or system” aspect of the exemption.
It’s very hard to tell at the proposed rule stage how narrow or broad that exemption will truly be. It’s possible that very few commercial acquisitions are pulled into scope, or it could be that many are. That is one of the primary concerns we’ve heard from industry.
Sam: Was that one of the issues brought up in the comments?
Erin: Yes, the lack of definitions around that in particular.
Sam: Yeah, there’s a good analogy to the SBA’s recent proposed rule about the 8(a) program, where lots of people wrote in and asked, “What does it mean by material harm?” or “What are you planning on doing with current firms?”Some of these same issues come up with shorter policy documents. I noticed the proposed text is only six pages, so they didn’t go into a lot of detail. They probably have a lot of work to do to establish useful definitions in the final rule.
M&A Activity and Investor Disclosure Obligations
Sam: There is a lot of M&A action right now in the defense space. People are getting interested, particularly in high-tech contracts. Venture capital firms and private equity firms are looking closely at small defense firms. How will this rule change affect the disclosures necessary for those investors?
Erin: This is definitely a point of potential tension between what companies have to disclose to the government and what investors are used to providing in terms of the level of detail regarding their ultimate ownership structure. We’ve navigated this issue for quite a long time when it comes to classified contractors with a facility clearance because of the nature of this form, and I think there has been real progress within the investor base that focuses on this industry.
When you have a classified contractor that’s the target of either M&A or financing, everyone understands this is going to be part of the process. We are usually able to reach a level of comfort with investors on how they’re going to provide that information and what level of detail might be necessary. But given that this proposed rule would expand disclosure obligations to so many more contractors in the defense industrial base, it is going to increase the number of difficult conversations that need to be had around this subject.
The very first question on the SF-328 talks about any foreign person or persons, plural, that own 5% or more of the equity of the business under consideration. At first glance, investors sometimes think, “Well, if I don’t individually own more than 5% of this business, then I am not disclosable in this context.” But this is evaluated from the perspective of the contractor, and they have to aggregate their ownership across investors.
Even if you have a VC fund that has a very low percentage stake in a company, but they have a limited partner base with some foreign investors, the company has to add up the total indirect foreign ownership in their business. That total could easily go over 5%, which means even a very small percentage from a particular fund could aggregate to push the company over that threshold. Investors are often surprised that they’re being asked for this type of information given their small relative ownership stake in the company.
We are already seeing companies that are cognizant of this pending rule ask investors at the investment stage for covenants regarding their obligation to provide information. They are conducting reverse diligence about how funds are structured—who the general partner is, where they are organized, and what the LP base looks like. Some of that is already working its way into financings and M&A transactions happening right now because we know this rule is coming.
What we typically suggest for contractors and their investors to understand is that our first response to DCSA is often an aggregate: “We have this fund with X percentage total of foreign investors, and here are the totals by country.”Oftentimes, if there’s not a large FOCI profile, that can be sufficient. But DCSA will sometimes come back and ask for more granular information about a particular fund, an LP base, or a specific country concentration. Investors really do need to be prepared for the potential of having to provide additional information.
Sam: Could that go as far as identifying the specific identities of the limited partners?
Erin: Yes, it could potentially. One workaround may be that we can put investors directly in touch with DCSA rather than providing that sensitive information to the company itself. Having these conversations early on in deal cycles is going to be incredibly important given how expansive we expect this to be.
Pre-Transaction Engagement and Mitigation Strategies
Sam: Is there any opportunity for pre-transaction engagement with DCSA to clear an investment?
Erin: Yes, that’s a great question. In the classified space, we typically interact with DCSA ahead of time if we expect there to be a meaningful change in the FOCI profile of the company. Oftentimes, we will go through that negotiation pre-closing, and the contractor has to agree to mitigation prior to closing to avoid an invalidation of their clearance. If a contractor closes a transaction with meaningful FOCI without engaging DCSA, their clearance can be invalidated, and they may not be able to take on new classified work until it’s mitigated. There is a strong precedent for doing that now.
If the FOCI profile for the transaction seems very low-risk and unlikely to result in meaningful mitigation, we still encourage informal communications with DCSA and the contractor’s points of contact there. Then, a post-closing submission is made, which we call a “change condition package.” This presents the full body of information about the investment or the new owner. Typically, that’s fine, again, as long as there’s not a significant FOCI profile. But there is a lot of judgment involved in understanding what that profile is, which is why that reverse diligence exercise is so important.
Sam: What have you seen in terms of mitigation? How far does DCSA go, and is there some sort of regulatory scheme around that, or is it just at the discretion of the agency?
Erin: There are several common mitigation instruments that DCSA uses. There’s a lot of information on their website that outlines sample policies and resources for contractors. The spectrum we work within starts at the very low end with a board resolution, which just recognizes that an uncleared parent company cannot access classified information.
From there, the level of onerousness moves up the spectrum to a Security Control Agreement, a Special Security Agreement, and a Proxy Agreement. Each of these agreements contains a series of security measures. They require certain elements of board representation by outside directors who are cleared U.S. citizens with no prior relationship to either the company or the investor. They also require a Government Security Committee, which is a subcommittee of the board that oversees the mitigation implementation, along with a series of ancillary agreements like a technology control plan, a visitation policy, and often an electronic communications policy. We also see what we call an Affiliated Operations Plan, which covers things like the co-location of facilities or parental involvement in the business.
That’s the traditional suite of materials DCSA uses. We expect that DCSA will continue to leverage those same mitigation instruments in this new context, but it’s possible they will start to introduce modifications or other measures that are more appropriate for unclassified environments. We don’t have a lot of detail yet regarding how DCSA plans to approach that specific mitigation exercise.
Post-Award Monitoring and Compliance
Sam: If a company enters into a mitigation plan involving these agreements or a committee of the board, is there ongoing monitoring, or are there periodic reports that must go to the government?
Erin: Both. The Facility Security Officer, or FSO, is the person traditionally in charge of the industrial security program for a company. But in a mitigated entity, the Government Security Committee of the board is responsible for the oversight of the FSO and their operations.
There are periodic reports that go to DCSA regarding compliance with the mitigation instrument. DCSA comes in and conducts periodic audits of contractors, and contractors must do self-assessments of their own performance. There is an ongoing monitoring process that contractors are required to implement as part of being a FOCI-mitigated company in the classified world.
Sam: Okay, so that can turn into a serious compliance exercise after the fact.
Erin: Yes, for sure. And that lasts as long as those agreements are in place. If a contractor winds down its operations, then eventually the clearance will be administratively terminated. Otherwise, while they are engaged in that activity, they are under this strict compliance regime involving both internal infrastructure and continuous engagement with DCSA.
The Three-Day Reporting Rule and Tight Timelines
Sam: Porting that over to the finalization of the proposed rule, this could apply to unclassified work as long as it reaches that $5 million threshold. Reading the proposed rule, a provision about a “three business days” deadline jumped out at me. Nothing in the government happens in three business days. Tell me, what is the three-business-day timeline, what does it cover, and how can companies realistically meet that deadline?
Erin: This involves circumstances where a FOCI profile for a company has changed. Something has happened—whether it’s an ownership change or something else—and the contractor has to report that change to DCSA via a revised SF-328. The same is true if a contractor is notified by a subcontractor that the subcontractor’s profile has changed; that report needs to be passed up to DCSA.
The three-business-day requirement dictates that the company must provide information about the beneficial owner or the changed person, and describe what mitigation strategies it has implemented so far to deal with that new FOCI vector. That’s the initial reporting requirement.
Following that submission, there is a 10-day requirement in the rule. Once that package goes in, DCSA will evaluate it and let the contractor know if they deem it to pose a risk. Once that evaluation comes back, the contractor has 10 business days to confirm it will comply with the proposed mitigation strategy, provide any additional information it has about the beneficial owner at issue, and update the description of the mitigation strategies undertaken so far.
These are incredibly tight timelines, especially since the mitigation and implementation process can take a long time. When you think about the suite of mitigation instruments I described, you’re talking about board involvement, subcommittees, industrial security staff, contracting staff, finance, IT, and accounting. A huge swath of a company needs to be involved in identifying and implementing these measures, let alone managing the internal flow of information regarding changes to a FOCI profile.
If an ownership change is in the works, is your FSO or the person with cognizance over the security program always going to be aware of it immediately? How does information flow within the company as a whole? When do you need to read in the right people to make sure these reporting obligations are tracked and complied with? That infrastructure is going to be a big lift for contractors, particularly small businesses that are already relatively resource-constrained. It gives me pause regarding how companies can realistically implement this, especially given the upfront implementation costs, which could be significant.
Sam: You said “any vector.” Does that mean if you brought on a new foreign customer, you would have to report that under the three-day rule?
Erin: Yes, because it constitutes a change to the SF-328. What’s interesting is that the three-day and 10-day requirements specifically mention providing information for beneficial owners that are implicated, which really targets the ownership piece. It will be interesting to see if additional information about other aspects of the FOCI profile will ultimately be required under these quick timelines in the final rule or through subsequent implementation guidance.
Supply Chain and Subcontractor Flow-Down Responsibilities
Sam: You also mentioned subcontractors. What is the flow-down responsibility here for primes, and what do they do if they’re not getting the information they need from their subcontractors?
Erin: It has the potential to be very tricky because there is a mandatory flow-down requirement. The rule requires coverage for contractors and subcontractors with contracts over $5 million, meaning subcontractors at any tier are covered if they meet that threshold. The subcontractor is required to have an eligible status in NISS, which is the DCSA portal that manages FOCI information.
There are some open questions about how a prime contractor is going to validate that. When you log into your NISS account as a prime contractor, you cannot check the status of other companies. You are relying to some extent on a subcontractor’s certification, and there isn’t a well-defined workflow with DCSA for processing subcontractors.
Theoretically, there should be an element where the contractor notifies DCSA to collect the information, do the validation, and come back to the prime with the status, because primes cannot independently verify that status themselves.
Consequences of Non-Compliance and Enforcement Risks
Sam: So this isn’t just about the prime contractor base; you’re looking all the way down the supply chain as well. What is the worst thing that can happen here if mitigation measures are directed at you and you don’t do them, or if you fail to report a change? Does this lead to contract termination, suspension, or potential debarment?
Erin: What we would probably look at in most circumstances is contract termination. For a contract to be awarded in the first place, the contractor has to go through this process—it applies to new awards. If they were in that process and didn’t either agree to mitigation or provide fulsome information, they wouldn’t be eligible for the award. That’s at the front end.
But the rule also covers extensions and modifications of contracts, so existing contractors now or in the future would also be subject to these requirements. If a contractor is not following the ultimate requirements—failing to provide disclosures, refusing to agree to mitigation—then they would either be ineligible for an option exercise, ineligible for a modification, or subject to potential contract termination. From a practical perspective, that’s what we’d see in most cases.
There is also always the specter of False Claims Act liability. Let’s say you submit this form but include false information, and that rises to the level of a False Claims Act case; you could be looking at serious civil penalties and damages.
Case Volume Explosions and Acquisition Bottlenecks
Sam: The proposed rule says that the government expects annual cases to grow from roughly 2,000—which is the current classified contract base, I presume—to over 41,000. What do you think about that number, first of all? And if you’re increasing the workload twentyfold, how is that going to affect the timelines you talked about earlier?
Erin: The numbers themselves are based on some rough calculations in the proposed rule. They’re making assumptions about the number of offerors per contract, the number of subcontractors per award, and the number of modifications and option exercises that come up. It’s a very rough estimate, and it’s highly possible it could be substantially more than what they’ve projected.
The conversations happening right now on the industry side are very much concerned with how this will impact acquisition cycles. Does DCSA really have the staff to handle that level of an increase? Is the NISS platform itself capable of scaling up in that way? Will they need to implement third-party assessors the way we’ve seen in other contexts like CMMC? That resource piece of the equation hasn’t been fully vetted in a public way.
Obviously, we’re not privy to internal conversations, though we understand there has been some effort to start ramping up staff and ensuring they’re trained, but this could potentially slow down acquisition cycles significantly. The rule states there is a 25-day requirement from when a package is submitted to when DCSA is supposed to provide the assessment. But after that, there is a period of time where the contracting officer and the contractor must negotiate the proposed mitigation. Once you get to contract award, you have the post-award implementation timeline.
How long it will take to negotiate the mitigation package is a huge open question, as is whether DCSA can realistically process submissions in 25 days. It’s also an open question how long it will take offerors to prepare these materials in a fulsome way. This can be a massive exercise for a company that is not familiar with these requirements—and most aren’t, because they’ve never had occasion to go through them before. The 25-day clock doesn’t even start until you’ve provided all the required information. The implementation piece has a real potential to drag out acquisition cycles.
One of the suggestions we saw in the comments, which would be interesting to see if DoD adopts, is rolling this out in a phased manner. You focus first on the most sensitive programs and the data they are most concerned about to get some test cases through the system. You try to get your processes down before expanding it all the way down to that $5 million threshold. Providing a phased timeline would give both industry and DCSA more room to get their arms around what’s required and put the necessary resources in place.
Legislative Interest and Policy Trajectories
Sam: Similar to CMMC, where we had multiple phases and now we’ve paused on Phase 2. Just to note, that 41,000 estimate is based on the $5 million threshold. Now there’s a proposal on the Hill to lower that even more, down to $500,000—a tenfold decrease. Why are politicians working on the NDAA interested in this issue? Why has this become a new proposal in the NDAA?
Erin: The focus on trying to better understand the contractors that make up the defense industrial base has been a major policy initiative for a long time. DoD, members of Congress, and others in this space recognize that we have relatively limited information about who contractors are, how they are owned, and what their supply chains look like. This expansion is consistent with the trajectory we’ve seen elsewhere.
CMMC is a great example: we went from a regime where contractors self-certified compliance to requiring a third-party audit. We have certain small business programs that require you to go through an SBA assessment or a third-party certification to ensure you’re actually qualified. Every year we see new rules about supply chain security, validating that software is secure, and providing information about where products are sourced.
If we look at the broader context, this rule fits pretty squarely within that trajectory of trying to get their arms around who is really providing goods and services to the government, particularly the Department of Defense. There has been an interest in this for a long time, and now they’re trying to figure out how to implement it to get the data they want.
Dropping the threshold substantially will further compound the concerns we’ve talked about: compliance costs and DCSA’s ability to handle the workload. Another interesting subset of industry comments questioned why we are picking a monetary threshold at all. It might make more sense to analyze programs based on sensitive data access rather than dollar value. You could have a $10 million contract for something completely benign that involves no sensitive data whatsoever, or you could have a $200,000 requirement where a contractor has access to highly sensitive government systems or provides a key component for them. Don’t we want to understand their ownership, control, and influence by potential adversaries more than a $5 million commercial contractor?
Translating a valid, long-standing policy goal into a rule that is workable for both contractors and the government is the main push-and-pull we’re seeing right now.
Small Business Compliance Burdens and Front-Loaded Costs
Sam: The big tension—which you see with CMMC and a lot of small business regulations—is that on one hand, yes, you want that information and you want to keep classified information or CUI confidential so it doesn’t get into the hands of foreign actors. But on the other hand, you also want to encourage companies to participate in defense contracting, particularly non-traditional contractors that are not already established in the space, like commercial companies, because the government often lags behind the commercial sector in implementing high technologies. This proposed rule notes that it could affect up to 21,000 small businesses at the prime or sub level. What is compliance going to look like for the smaller of these small businesses, or businesses that are new to the defense space and suddenly realize, “Oh, not only do I have CMMC and small business rules, but I also have this FOCI responsibility to deal with”?
Erin: It’s going to require a dedicated person or staff internally to monitor this. Does it have to be a full-time person? Maybe, depending on the nature of their ownership structure. But there really needs to be someone at the helm taking responsibility for understanding the requirements, tracking updates over time, and complying with these tight timelines, much like we see in other regulatory regimes.
One of the big challenges I worry about for small businesses is that this has the potential to heavily front-load costs. Before you even have a contract award, you need to go through this disclosure exercise, gather information, provide documents, and negotiate mitigation. You have to agree to interim measures and plan out implementation before a single dollar comes in, and you might not even end up being the awardee because it’s offerors who are going through this process. That front-loading of obligations is a major concern.
Another concern is that if this delays acquisition cycles, it could become existential for a small business. You might be waiting for that contract award just to literally pay your bills next month. This has the real potential to depress the involvement of small businesses, commercial companies, and non-traditional contractors in this space.
When you’re talking just about the classified environment, contractors can find ways to participate in defense contracting while intentionally staying away from classified work during the early stages of their growth. But once this expands to a $5 million or a $500,000 threshold across the board, you’re going to see a much wider impact. It’s ironic because we’ve seen a lot of initiatives recently pushing toward commercial items and non-traditional companies to capture innovation, speed up acquisition cycles, and reduce bureaucracy. This rule would be a bit in conflict with those broader initiatives.
Sam: And very expensive. Could you put a ballpark figure on how much it would cost a small business from the outside to get into compliance?
Erin: It’s really hard to estimate because so much depends on their FOCI profile. You may have a small business with one or two owners who are both U.S. citizens, doing purely domestic work, where they answer “no” to everything and that’s the end of it. But during later-stage growth, as new investors come in, you have to vet those investors, and the requirements for disclosure ramp up. Ideally, the compliance costs would track the growth of the company.
But if you have an early-stage company that already has a couple of foreign investors on their cap table, an overseas customer concentration, or a significant number of employees on visa status, there is a disconnect between where the company is growth-wise and what the compliance burden is going to be. We see small businesses navigate this in the classified space routinely, and they can do very well with it, but those contractors have self-selected to be in that space. Broadening the rule might result in an outsized impact on small and non-traditional contractors who didn’t sign up for that environment.
CMMC Parallels and Future Rule Predictions
Sam: In the CMMC pause recently, the Department of War stated their main reason for the pause was to alleviate the burden on the small business industrial base, having heard estimates of $50,000 or more just to get a Phase 2 certification. If finalized, how do you think this FOCI rule will affect the industrial base, and small businesses in particular? What is your prediction—do you think they will push it through as currently identified, especially after watching the Phase 2 pause?
Erin: The Phase 2 pause is a really interesting corollary to where this rule stands right now. The concerns you highlighted—impact on small businesses, compliance costs, complex timelines, and a lack of regulatory resources—apply equally to what this rule could land on both contractors and DCSA as the primary regulator.
I wouldn’t be surprised if we see DoD take a step back from this proposal and think more critically about a detailed implementation rollout. They need to provide more definition around commercial items and how they will be treated, and potentially consider a phased approach that focuses on the highest-priority systems first before slowly rolling out to other contractors. They can take lessons from the CMMC issues they’ve experienced.
Across the board in the public comments, we saw support for the overall policy goal. I don’t think anyone disagrees that it’s a worthwhile exercise to ensure we have better insight into and mitigation of potential foreign access and influence in critical DoD programs. It really comes down to execution: how do we implement this in a way that doesn’t grind acquisition to a halt, keeps small and innovative companies in the defense industrial base, and remains manageable on the government side?
Guest Outro and Contact Information
Sam: Erin, how can people find you if they want to learn more about the policy or if they need your help going through the process?
Erin: You can find me on LinkedIn. I would be happy to talk to anyone who is curious about this rule. Luckily, the defense bar and the contracting attorneys who live and breathe in this space form a relatively small community. We talk a lot about how these changes impact our clients and what we expect to see, so it’s nice to have that community aspect whenever a new rollout like this occurs. Thank you so much for having me today, Sam. I really appreciate it and look forward to continuing the conversation.
Sam: Erin Estevez, thanks so much for being on the show.
Erin: Thanks, Sam. Appreciate it.
Sam: Thanks, everybody.
With 20 years of Federal legal experience, Sam Le counsels small businesses through government contracting matters, including bid protests, contract compliance, small business certifications, and procurement disputes. Sam received his law degree from the University of Virginia and formerly served as SBA’s director of procurement policy. His website is www.samlelaw.com.
This video is for informational purposes only and does not constitute legal advice.
