FOCI for manufacturers: ownership, review and mitigation
Review supplier ownership and control, distinguish current security rules from proposed DFARS requirements, and keep a dated evidence record.
FOCI review starts with who can influence the supplier, what work or information is exposed, and which contract requirements apply. A domestic address does not answer those questions. Keep an ownership and control record, give changes an escalation route, and distinguish a buyer's risk assessment from a government security determination.
What is foreign ownership, control or influence?
FOCI means a foreign interest can affect a company's management or operations in ways that create security or contract-performance risk. Ownership is one route; contractual rights and governance can matter too. For a manufacturer, the practical question is who can influence the supplier making the part, handling the data, or controlling the process.
For cleared US entities, the National Industrial Security Program rule addresses foreign influence that could expose classified information or affect classified performance. The government considers the whole situation, including ownership through parent companies, information sensitivity, and foreign-government involvement. Foreign investment does not automatically bar a clearance. 32 CFR 117.11(a)–(b).
Separate three decisions in your review: the supplier's security eligibility, compliance with your actual contract, and the operational risk to your build. A purchasing team can collect facts and decide how to protect production. It cannot declare a government mitigation arrangement adequate or issue a facility clearance.
How does FOCI affect an uncleared manufacturer?
An uncleared supplier may still be important to national security through its product, software, process knowledge, or ability to interrupt delivery. Ask what it receives and controls, and check the applicable contract requirements, before assuming the review ends because no classified work is involved.
EO 14415's definition covers foreign power over management or operations that may expose information or affect national-security contracts or programs. Section 3 directs regulatory action on supplier vetting. This gives uncleared suppliers a reason to prepare ownership evidence; it does not make every NISPOM clearance procedure their present contractual duty. EO 14415, Sections 3 and 7(d).
Use the NISPOM factors as prompts for fact gathering, while recording why each question matters to your work. A supplier machining an ordinary bracket presents different access and continuity questions from one maintaining software on production equipment. Avoid a universal score that treats all foreign investment as the same exposure.
For the broader vetting sequence, start with supplier risk assessment. Keep financial distress, capacity, and concentration as separate findings even when an ownership transaction connects them.
What would the proposed DFARS rule change?
The May 7, 2026 proposal, DFARS Case 2021-D011, would require beneficial-ownership and FOCI disclosures for covered contracts over $5 million. Commercial acquisitions would be covered only after a designated official's risk determination. The proposed clause would flow down to subcontracts and other contractual instruments over $5 million; it would not cover every small purchase.
The proposed flowdown includes its own flowdown paragraph, allowing the requirement to continue through covered tiers. Keep the value threshold and commercial-acquisition exception beside any preparation request. Federal Register, proposed rule and proposed 252.240-70YY(e).
The reviewed notice remains a proposal as of September 26, 2026; this research did not identify a final rule. Do not present its draft clause numbers, submission process, or proposed deadlines as enacted contract requirements. Check the solicitation, current clauses, applicable deviations, and subsequent publications before using them in a supplier instruction.
Preparation can proceed without inventing a legal deadline. Identify the right respondent, assemble the ownership chain, and establish a change-notification process. Put the applicable requirement beside each requested item so the supplier can distinguish contract evidence from an internal risk-review request.
What ownership evidence should you request?
Request an understandable picture of the entity you buy from, rather than a folder of corporate documents with no explanation. Start with its legal name, manufacturing site, immediate parent, intermediate parents, ultimate owner, and the date the picture was confirmed. Ask the supplier to identify gaps rather than certify knowledge it does not have.
Use this working record for each important supplier. It supports your review; it does not replace an SF 328 or other required submission.
| Field | Evidence to request | Decision supported |
|---|---|---|
| Contracting entity and production site | Legal names and addresses matched to your order | Whether the declaration covers the supplier doing your work |
| Ownership chain | Dated organization chart and explanation of control | Whether a parent creates an indirect dependency |
| Governance rights | Description of board appointments, vetoes, or other decision rights | Who can direct relevant operations |
| Relevant access | Work scope and information-access description | What could be exposed or interrupted |
| Existing mitigation, if applicable | Confirmation of status and permitted scope from the responsible security contact | Whether further security review is needed |
| Change notification | Named contact, reporting route, and contractual basis | How new information reaches your team |
| Review result | Finding, owner, action, evidence reference, next check | What the company decided and why |
Handle sensitive ownership information through your approved channel and restrict access to the people doing the review. A buyer's shared tracking sheet can hold the evidence reference and status without copying confidential attachments into every order record.
Supplier FOCI review path
Five steps: identify the supplier and its ownership chain, define information and performance exposure, identify applicable requirements, route the finding to security and contracts, and monitor changes and action evidence.
- 1
Identify
- Evidence
- Legal entity, site and dated ownership chain
- Owner
- Buyer and supplier
- 2
Define exposure
- Evidence
- Work scope and relevant access
- Owner
- Engineering and security
- 3
Check requirements
- Evidence
- Actual contract and applicable security program
- Owner
- Contracts and security
- 4
Resolve finding
- Evidence
- Decision, actions and evidence references
- Owner
- Named review owner
- 5
Refresh
- Evidence
- Changed facts, follow-up and closure evidence
- Owner
- Buyer and security
A buyer gathers the evidence; the responsible security and contracts owners resolve the requirements.
Which mitigation arrangements might apply?
DCSA describes tailored arrangements for cleared companies, chosen through the government process. Board resolutions address some foreign interests without board representation; security control agreements address some US-controlled companies with foreign board representation. Special security agreements, proxy agreements, and voting trusts address other ownership or control circumstances. The appropriate instrument depends on the facts and access requirements.
Proxy and voting-trust arrangements place voting rights with approved cleared US citizens; a voting trust also transfers legal title. These arrangements differ in governance and access, so purchasing should route the choice to the responsible security officials. 32 CFR 117.11(d)., DCSA, Mitigation Agreements.
Treat that list as a menu of different governance mechanisms, not an automatic five-step ladder or a percentage-only test. The instrument appropriate for one company may be unsuitable for another with different access needs or control rights. A supplier's statement that it has an agreement should lead to a scope check with the responsible security team.
Implementation is ongoing work. DCSA identifies additional plans concerning affiliated operations, technology protection, communications, visits, and facilities. The relevant agreement and security officials determine what applies. DCSA, FOCI Action Planning and Implementation.
For purchasing, record the operational consequences: who may receive technical data, which site is approved for the work, who can authorize a change, and what would interrupt performance. Translate those consequences into order controls with the security owner.
When should you refresh the review?
Refresh when something changes, not only when the annual questionnaire is due. Useful triggers include a sale, merger, new parent, refinancing that changes control rights, board-rights change, new affiliate service arrangement, or a new work scope. These are recommended review prompts; the contract and security program set actual reporting requirements.
For cleared entities, significant changes to previously submitted information require an updated SF 328 under the rule. Route those changes to the facility security officer or responsible security contact. 32 CFR 117.11(c).
An illustrative case: your only qualified machining supplier announces a foreign-parent acquisition. The buyer records the announced and closing dates, the security owner checks relevant access and contract terms, and the planner checks inventory cover. Pending questions remain open with owners. The team avoids treating an unchanged ship-from address as evidence that nothing changed.
If continuity is exposed, develop the sourcing response alongside the security review. A second source may protect production but does not cure an unresolved information-access problem. Use dual sourcing for the qualification work and risk mitigation for actions and closure evidence.
What questions do teams ask about FOCI review?
FOCI review needs clear boundaries between supplier evidence, contract interpretation, and government security decisions. Use the questions below to assign responsibility and avoid treating a completed questionnaire as clearance. Each answer supports a practical next step while leaving applicable security determinations with the responsible officials.
Does foreign ownership mean a supplier is prohibited?
No. Determine the applicable sourcing restrictions, security requirements, and actual exposure. FOCI mitigation and prohibited-source screening answer different questions. Keep the reasons for each decision visible.
Is a supplier questionnaire enough?
It is a starting point. Check which legal entity and date it covers, compare it with other evidence, and resolve contradictory or missing answers. A completed form does not establish government security eligibility.
Who should own the review?
Give purchasing responsibility for collecting evidence and managing supplier actions. Give the security and contracts owners responsibility for interpreting their requirements. Assign one person to resolve the overall finding so it does not disappear between functions.
A useful first step is to complete the ownership record for the suppliers whose loss would stop the build. Then link every unresolved question to an owner and a dated follow-up. If your team needs help organizing supplier follow-up, talk to our team.
This article is general information, not legal or tax advice. Check how the rules apply to your business with your legal or tax advisor.