Defense Federal Acquisition Regulation Supplement: Mitigating Risks Related to Foreign Ownership, Control, or Influence

The Intelligence and National Security Alliance (INSA) supports the Department of Defense's objective of strengthening visibility into foreign ownership, control, or influence (FOCI) risks. They provide specific recommendations to ensure the rule is workable for the industrial base, focusing on predictable review timelines, clear guidance on NISS onboarding, and risk-based reporting thresholds.

The commenter, representing a business entity in the defense industrial base, argues that expanding FOCI requirements to unclassified contracts without a scalable, risk-based framework will create unnecessary complexity and disrupt supply chains. They advocate for a tiered approach that focuses on actual risk and influence rather than uniform requirements, and they request a longer implementation timeline of at least 180 days.

An investigative journalist and technology historian opposes the proposed rule, arguing that it lacks clear criteria for risk determination and could lead to selective enforcement against commercial AI companies. The commenter also highlights concerns regarding the DCSA's capacity to handle the increased workload and suggests that the rule creates a perverse incentive against international safety governance.

The commenter, representing a business entity, supports the security objectives of the proposed DFARS rule but argues for a risk-based, tiered framework to avoid disproportionate burdens on unclassified contractors. They specifically recommend scalable mitigation options for uncleared entities, targeted flowdown requirements, a longer implementation window, and alignment with broader acquisition reform objectives.

A U.S. defense industrial base company owned by a foreign parent in a NATO country supports the DoD's objective of mitigating national security risks from foreign ownership, control, or influence (FOCI). However, the company argues that the proposed rule is impractical for non-U.S. entities and suggests several specific amendments to create a tiered, risk-based approach that distinguishes between allied and adversary ownership.

The commenter, representing a business entity, supports the objectives of the proposed rule but argues that it imposes overly burdensome "cleared-environment" requirements on contractors performing unclassified work. They recommend limiting mitigation instruments to board resolutions for unclassified work, creating express exceptions for commercial products and services, and extending the implementation window to 180 days.

The commenter, a software industry professional, expresses concerns about potential government overreach and the need for clear, transparent criteria for risk determination. They argue that excessive oversight and burdensome requirements could stifle innovation and delay the delivery of critical technologies to the DoD.

A cleared defense contractor supports the Department's goal of enhancing visibility into Foreign Ownership, Control, or Influence (FOCI) risks but argues that the proposed rule needs refinement to be operationally feasible. They recommend implementing a risk-based framework with clear definitions, "safe harbor" provisions for existing instruments, and mechanisms to address DCSA backlogs and reporting impracticalities.

Bristol Bay Native Corporation (BBNC), an Alaska Native Regional Corporation, supports the goal of mitigating foreign ownership, control, or influence risks but expresses concern over the administrative burden on small businesses and Alaska Native Corporations. They recommend extending reporting deadlines for small businesses, creating streamlined pathways for statutorily domestic entities, and adopting a risk-based review framework to avoid operational delays.