The Pentagon just told roughly 40,000 contractors they might have a new compliance problem. For most of them, it reads as a burden. For BD-savvy small businesses, it reads as an opportunity map.
The proposed DFARS rule expanding Foreign Ownership, Control, or Influence (FOCI) requirements beyond classified contracts is moving through the rulemaking pipeline. The Pentagon's own estimate puts the affected contractor population at nearly 40,000 companies — a pool that, until now, was largely insulated from the national security vetting that classified work demands. When compliance costs hit, some of that pool will exit. That's not speculation — it's the pattern every previous expansion of security requirements has followed.
What the Rule Actually Does
The current framework is fairly simple: if you hold a facility clearance and work on classified contracts, FOCI is already your problem. Your facility security officer knows the drill.
The proposed DFARS change extends scrutiny to contracts involving controlled unclassified information (CUI), critical technology, and certain sensitive but unclassified work — categories that, over the last decade, have exploded in volume as the DoD has pushed more sensitive work to unclassified environments to speed acquisition timelines.
The practical effect: contractors who have been happily winning unclassified defense work — IT modernization, logistics, R&D support, professional services — may now face the same kind of ownership and governance review that cleared contractors deal with. That means disclosure requirements, mitigation agreements, and in some cases structural changes to ownership or board composition.
For small businesses that are wholly domestic with clean ownership structures, this is paperwork. For competitors with complex capital tables, foreign investors, private equity parents with international LPs, or overseas subsidiaries — it's a harder problem.
Why Your BD Team Should Care Before the Rule Is Final
Rules like this don't reshape markets overnight. But they do reshape markets, and the signal is visible well before the final rule publishes — if you're looking for it.
Here's how the pattern tends to play out:
Phase 1 — Proposed rule drops. Larger primes with complex ownership structures begin quiet internal reviews. Legal and compliance teams get budget. Some foreign-backed portfolio companies start evaluating whether their DoD revenue is worth the governance cost.
Phase 2 — Comment period closes, final rule approaches. Teaming conversations shift. Primes doing FOCI mitigation work need domestically-owned, cleared small business partners who don't add to their FOCI risk profile. That's leverage for you, if you have the clearances and the relationship.
Phase 3 — Rule takes effect. Some competitors exit specific vehicle pools or decline certain solicitations. Contract ceilings that were being competed by five firms get competed by three. Win probability math changes.
None of this requires the rule to be maximally aggressive in its final form. Even a watered-down version with limited scope creates friction for affected contractors — and friction is market signal.
Reading Competitor Exposure
The practical BD question isn't "does FOCI apply to me?" It's "does FOCI apply to the incumbents and competitors I'm tracking?"
A few places to start your research:
Ownership and corporate structure disclosures. SAM.gov entity registrations don't give you cap tables, but they do tell you parent company relationships. If an incumbent is a wholly-owned subsidiary of a foreign parent — or a domestic entity majority-owned by PE with significant overseas LP exposure — that's worth noting in your capture file.
Press coverage of recent acquisitions. Private equity has been aggressive in GovCon consolidation. A competitor that was domestically owned 18 months ago may now have a different FOCI profile. Standard M&A announcements are public. Read them.
FARA and beneficial ownership databases. The Financial Crimes Enforcement Network's beneficial ownership reporting infrastructure, though still evolving, is increasingly useful for understanding who actually controls a given entity.
This isn't opposition research for its own sake. It's capture intelligence. If you're bidding against [Incumbent Vendor] on a contract that's about to become subject to FOCI review, and [Incumbent Vendor] has a foreign PE parent that's been slow to respond to previous compliance requirements, that's a factor in how hard they'll fight to keep the work.
The Teaming Angle
FOCI expansion creates one other dynamic worth naming: it makes purely domestic, security-cleared small businesses more attractive teaming partners for primes who are managing their own FOCI exposure.
If a large prime has a mitigation agreement in place, adding a subcontractor with its own FOCI issues — even minor ones — can complicate their reporting obligations. Primes doing FOCI mitigation work are actively looking for partners who simplify their security posture, not add to it. If your company is U.S.-owned, U.S.-controlled, and already cleared, that's a positioning asset. It belongs in your capabilities statement, your teaming pitch, and your gate review criteria.
This is a version of the same dynamic that CMMC created — another requirements expansion that looked like pure compliance burden but functioned as a market filter, winnowing the field in ways that favored prepared small businesses. We've written about how compliance requirements function as bid filters rather than just overhead — FOCI expansion operates on the same logic at the company level rather than the contract level.
Timing Your Attention
The proposed rule is in rulemaking now. Final rules in this space typically take 12-24 months from proposed to effective — longer if the comment period surfaces significant industry pushback. Industry estimates suggest the affected contractor community will generate substantial comments given the scope.
That timeline is actually useful. It means you have a window to:
- Audit your own corporate structure so you know exactly what your FOCI profile looks like before any contracting officer asks.
- Identify which competitors in your target NAICS codes likely have FOCI exposure.
- Begin positioning your domestic ownership as a differentiator in teaming conversations, particularly on contracts with DoD customers who are already managing FOCI sensitivity.
- Watch for early recompetes on existing contracts where the incumbent's FOCI profile becomes a vulnerability.
The contractors who treat this as a compliance calendar item — something to deal with when the rule is final — will spend that window doing nothing useful. The ones who treat it as a BD signal will have 12 months of head start on repositioning.
Detailed analysis of how requirements expansions like this interact with federal BD tactics — particularly how to translate compliance signal into capture strategy — is the kind of thing most GovCon advisors won't spell out because it makes the market look less neutral than it is. It isn't neutral. The rules favor firms that read them early.
The Uncomfortable Arithmetic
Here's what the compliance industry doesn't say out loud: FOCI expansion, like every major regulatory change in GovCon, will be absorbed unevenly. Large primes will build compliance infrastructure, manage the overhead, and continue winning. Midsize contractors with foreign backing will negotiate mitigation agreements and keep competing. The ones who exit — quietly, without announcement — will be smaller contractors who decide the compliance burden exceeds the expected revenue, and foreign-backed small businesses who can't easily restructure.
That exit creates market space. Not everywhere, not immediately — but on specific vehicles, in specific NAICS codes, for specific agencies with heightened sensitivity to foreign ownership risk. Knowing which of your target opportunities sits in that space is the job.
The rule isn't final. The market shift it signals already is.
Frequently Asked Questions
Does the proposed FOCI DFARS rule affect all DoD contracts or just certain types?
Based on the Pentagon's framing, the proposed rule targets contracts involving controlled unclassified information, critical technology, and sensitive unclassified work — not the entire DoD contract universe. However, "sensitive unclassified" is a broad category that has been expanding steadily as agencies push formerly classified work to unclassified environments. Check the specific proposed rule language via the Federal Register for the current scope definitions.
If my company has no foreign ownership, do I need to do anything?
Probably not as a compliance matter, but yes as a BD matter. You should document your clean ownership structure clearly — in your entity registration, capabilities statement, and teaming pitches — so that it's instantly verifiable to a contracting officer or prime partner who needs to confirm your FOCI profile. Don't assume "obvious" is the same as "documented."
How do I find out if a competitor has FOCI exposure?
Start with SAM.gov entity records for parent-subsidiary relationships, then check publicly available M&A news for recent ownership changes. For deeper research, FinCEN's beneficial ownership infrastructure is increasingly useful. This won't give you certainty, but it gives you enough signal to ask better questions in pre-solicitation market research and teaming conversations.
Does FOCI exposure automatically disqualify a contractor from competing?
No. The DoD has established processes — Special Security Agreements, voting trust arrangements, proxy agreements — that allow foreign-influenced companies to continue holding sensitive contracts under mitigation conditions. FOCI exposure means compliance overhead and potential scrutiny, not automatic disqualification. The BD implication is that affected competitors are carrying costs and constraints you may not be.
Field notes for federal small business contractors. Sharp, direct, and free of the consultant-speak that dominates the GovCon trade press. We help BD leaders allocate proposal capacity better — fewer wasted bids, more wins on the bids that matter.