Over its 30-year history, the Department of Defense (DoD) National Industrial Security Program Operating Manual (NISPOM), which establishes policies and procedures for mitigating foreign ownership, control or influence (FOCI) in the U.S. defense industrial base, has narrowly focused on parties that require access to classified information (classified contracts) in the performance of a U.S. government contract. By contrast, foreign ownership or influence at companies working on unclassified U.S. government contracts was largely unregulated, other than through the Committee on Foreign Investment in the United States’s (CFIUS’s) authority to mitigate national security risk in the context of a foreign investment.
Section 847 of the National Defense Authorization Act for fiscal year 2020 as amended changed this by directing DoD to mitigate FOCI in many U.S. defense contractors who perform only unclassified contracts. On May 13, 2024, DoD issued an internal instruction memorandum (DoD Instruction) initiating the establishment of policies and procedures by DoD to implement Section 847. This authority is yet another tool in DoD’s toolbox to address increasing concerns over the security of its supply chain. Foreign-owned or -controlled defense contractors performing or seeking contracts with DoD will want to assess how the altered regime may apply to them.
Section 847 requires DoD to establish rules for mitigating FOCI in companies working on unclassified defense contracts, subcontracts or defense research assistance awards valued at over $5 million (covered contractors). Contracts for commercial products and services would be excluded unless DoD determines there is a risk to sensitive data systems or processes, such as access to personally identifiable information, or cybersecurity or national security systems.
Consistent with the NISPOM, a Section 847 covered contractor is under FOCI when a foreign interest has the power, whether or not exercised or exercisable, to direct matters affecting the management or operations of that company in a way that may result in a potential risk to national security, compromise of sensitive data, or any other adverse effect on its ability to perform.
Once Section 847 is implemented, we expect DoD to require covered contractors to disclose foreign ownership interests by completing Standard Form 328 (SF328) or a similar form, and by updating DoD when there are material changes to foreign ownership interests during the life of a covered contract. The DoD Instruction suggests that these rules would apply to both prospective contractors and current contractors upon a change in beneficial ownership.
The DoD Instruction appoints the Defense Counterintelligence and Security Agency (DCSA), which is responsible for NISPOM implementation, to oversee the FOCI assessments under Section 847. It contemplates that companies will provide detailed information to inform FOCI assessments (presumably by submitting the SF328 or similar document) early in the contracting process before source selection decisions are made. The contracting officer would then refer covered contractors to DCSA for review and assessment. DCSA would determine whether to recommend FOCI mitigation measures or determine that FOCI cannot be adequately addressed through mitigation. The contracting official will ultimately decide whether to accept DCSA’s recommendation when awarding a covered contract or excluding a contractor from award, amendment or extension.
As a welcome addition to those familiar with the NISPOM’s often lengthy process, which has no time limits, the DoD Instruction imposes tight deadlines on DCSA. Upon receiving a request from the DoD component, DCSA is expected to provide its FOCI assessment and mitigation recommendation within 25 working days of the request. If FOCI mitigation measures are adopted, covered contractors will be required to implement those measures within 90 days after award or commencement of performance.
The industry-facing Defense Federal Acquisition Regulation Supplement (DFARS) rule implementing Section 847 is currently expected by the end of July 2024, although this deadline has been pushed numerous times. The rule will further clarify covered contractor requirements and DoD’s plan for implementing these new authorities. Critically, these regulations will provide clarity on the types of mitigation that may be required for unclassified contracts. Although DCSA has well-established rules for how different ownership interests must be mitigated in the context of classified contracts, we expect that unclassified mitigation will have to be less rigorous, but how much less is not yet clear.
Foreign-owned or -controlled defense contractors that are considering entering the U.S. defense market, as well as those already performing on relevant unclassified contracts, will need to assess their contracts and business operations to determine FOCI mitigation risk and the feasibility of implementing yet-to-be-defined FOCI mitigation requirements.
Summer associate Viktoryia Bick contributed to this article.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.