One sentence on the Standard Form 328 tells a defense contractor where it stands: your entity’s eligibility determination, “e.g., a facility security clearance,” cannot be decided if you do not complete and update the form. Nine questions sit above that line in the February 2026 revision. Answer “Yes” to any and the Defense Counterintelligence and Security Agency opens a review of foreign ownership, control, or influence. Until it closes favorably, nobody on your payroll touches classified material.

That last clause is where most FOCI coverage goes wrong. Foreign ownership does not stop you hiring. It stops access.

What does the SF-328 actually ask?

Nine questions covering inbound and outbound ownership, foreign officers, latent control, contracts, debt, and revenue concentration. Every “Yes” requires full supporting documentation.

Question 1 asks whether any foreign person, directly or indirectly, owns or subscribes to 5 percent or more of any class of stock, participation interest, units, or capital commitment. It aggregates across foreign persons from one country, so no single holder need cross the line alone. Question 2 runs the other way, and companies forget it: do you, through subsidiaries or affiliates, own 10 percent or more of any foreign interest?

Question 4 is the sharpest item on the form. It reaches any foreign person holding “binding authority or the power, direct or indirect, whether or not exercised,” over the election or tenure of your governing body, and “must be answered affirmatively, even if such power has not been exercised.” A dormant veto in a shareholder agreement counts.

Questions 5 and 6 cover “any contracts, agreements, understandings, grants, side letters, or arrangements with a foreign person(s)” and any debt owed to one; the instructions reach offshore software development, IT, recruiting, HR, and accounting. Question 7 tests revenue, not equity: 5 percent from one foreign person, or 15 percent in aggregate. A U.S.-owned company with one large foreign customer can land in FOCI review without a dollar of foreign equity.

About that 100-minute burden estimate. It is the Paperwork Reduction Act average under OMB control number 0704-0579, taken across every filer regardless of answers. It is not the work facing a company with real foreign ownership, which must attach cap tables, org charts, shareholder agreements, SEC Schedule 13D filings, and governance documents. Treat it as a floor. File accurately, too: a misrepresentation by omission or concealment “may serve as a basis for denial or revocation of clearance.”

Does an affirmative answer disqualify you?

No. It opens a risk-based determination: DCSA weighs eight factors and decides whether FOCI exists, what risk it carries, and what mitigation would make it acceptable.

Those factors include espionage against U.S. targets, enforcement actions for unauthorized technology transfer, compliance history, the sensitivity of the information at stake, and whether a foreign government controls the entity. The standard sits at 117.9(c)(6): an entity must “not be under FOCI to such a degree” that clearing it would be inconsistent with the national interest. Degree, not existence. Plenty of cleared companies have foreign shareholders. For the wider obligations it imposes, see our walkthrough of what 32 CFR Part 117 requires of a cleared employer. And clearing CFIUS does not clear FOCI: the two run “in parallel, but are separate processes.”

What happens to your hiring while FOCI is unresolved?

Hiring continues; access stops. Employees can be processed for clearances concurrently with the company’s eligibility determination, but nobody gets access until both are favorable.

The gate is 117.11(a)(3): an entity found under FOCI “is ineligible for access to classified information unless and until effective security measures have been put in place to negate or mitigate FOCI.” An existing clearance may survive good-faith negotiation, though DCSA can invalidate it anyway. Refuse to negotiate and it “will be invalidated.” Where no measures can remove the risk, it “will be revoked.” Those words differ: GAO calls invalidation an interim measure leaving the contractor ineligible to receive new classified contracts or material while it corrects deficiencies. That second noun matters, because a cut-off from new classified material can stall work already under contract.

Now the part recruiting needs. Section 117.9(e)(1) lets contractors designate employees who need access during contract negotiation or bid preparation; those employees are processed for clearance eligibility “concurrent with entity’s entity eligibility determination.” What 117.9(e)(2) makes unconditional is the finish line: they “will not be granted access to classified information until both a favorable entity eligibility determination and PCL eligibility has been granted.”

So build the cleared bench during mitigation, not after. See what your FSO submits to DCSA, whether a company can sponsor a clearance, and time-to-billing on a cleared hire. How long does mitigation take? DCSA reports no end-to-end metric, and the six-to-eighteen-month ranges in vendor content trace to no primary source.

Which mitigation instrument will DCSA require?

Four, escalating with the degree of foreign control — and the ones harshest on the foreign owner are gentlest on the company’s classified work.

A Voting Trust or Proxy Agreement strips the owner’s governance rights entirely and imposes nothing on the company’s classified access. A Special Security Agreement leaves that owner a board seat and a real voice, and is the only one of the four carrying an access limitation.

What does a National Interest Determination add?

A second approval layer, and for SCI, Restricted Data or COMSEC a documented minimum 60-day wait before employees at an SSA company can touch that material.

Proscribed information is a defined list: TOP SECRET, COMSEC material other than unkeyed controlled cryptographic items, Restricted Data, special access program information, and sensitive compartmented information. Where another agency owns a category it must concur on the NID: ODNI for SCI, Energy for Restricted Data, NSA for COMSEC.

The timing bites, though only on part of that list. The 2020 NISPOM rulemaking spelled out the arithmetic: 32 CFR part 2004 gives the agency up to 30 days to assess a submitted NID, “and then another 30 days for a controlling agency” to make its own, producing a “minimum 60 day delay.” That second clock runs only where another agency owns the category; for TOP SECRET and special access program information the CSA decides alone. The rulemaking said aloud what the wait meant for staff: cleared employees “will no longer have to wait at least 60 days for NIDs after contract award.”

Cleared employees, on payroll, badged, waiting two months. It is a first-time cost, not a per-contract one: no fresh concurrence is needed to renew a contract, add task orders, or renew the SSA. Who owns you matters too. Section 842 of the FY2019 NDAA removed the NID requirement for a U.S. subsidiary under an SSA whose ultimate parent and every intermediate parent sit inside the National Technology and Industrial Base: the United States, the United Kingdom, Canada, and Australia. Read that strictly: a British owner holding you through a third-country vehicle does not qualify.

What does mitigation cost once it is in place?

A permanent operating condition, not a filing: cleared U.S. citizens in seats with small candidate pools, a standing board committee, and limits on what your parent may do for you.

Every cleared entity needs a cleared senior management official, FSO, and insider threat program senior official; the FSO and ITPSO must be U.S. citizen employees. Under mitigation it tightens. Trustees and proxy holders “must be resident U.S. citizens,” and new trustees, proxy holders, and outside directors must be “completely disinterested individuals with no prior involvement” with the entity, its affiliates, or the foreign owner, cleared to the company’s own level, with DCSA guidance extending that test to the nominee’s immediate family. Mitigated companies also stand up a Government Security Committee whose chairman “must concur with the appointment and replacement of FSOs,” so hiring and firing your own FSO becomes a shared decision, unlike the ordinary case in our FSO requirements breakdown.

Then the recurring costs. DCSA meets at least annually with that committee, whose chairman files a compliance report a year after the agreement takes effect and annually thereafter. Security reviews come every 12 months instead of 18, though any facility cleared to possess classified material is already on that baseline. A technology control plan is mandatory, prescribing “unique badging, escort, segregated work area, security indoctrination schemes, and other measures.” A cleared entity also “generally cannot be collocated with the foreign parent,” and shared services from the parent need prior approval.

An honest counterweight: DCSA told GAO in 2023 it was resourced to conduct required oversight of only about 25 to 30 percent of the cleared industrial base, the whole base and not a high-risk slice. The agency is stretched.

Does the SF-328 apply if you hold no clearance?

Increasingly, yes. Section 847 of the FY2020 NDAA reaches DoD contractors and subcontractors above $5 million regardless of clearance status, and the form now covers CMMC and SBIR/STTR eligibility.

Section 847 of Public Law 116-92 defines a covered contractor or subcontractor as a company on DoD work “with a value in excess of $5,000,000,” generally excluding commercial products and services. Covered companies disclose beneficial ownership and whether they are under FOCI, update those disclosures as facts change, and, if under FOCI, name each foreign beneficial owner. GAO cites it as a note to 10 U.S.C. 4819; DCSA’s Office of Entity Vetting expanded to absorb the mission.

The 02/2026 form goes further, citing authorization for the DoD SBIR and STTR programs under Public Law 117-183 and the Cybersecurity Maturity Model Certification program under DFARS 252.204-7012. A small business with no clearance and no classified ambitions can be asked for an SF-328 as a condition of an SBIR award. The hiring consequences are in our piece on CMMC Level 2 staffing.

What changes between now and 2028?

The system that adjudicates FOCI is being rebuilt. DCSA is replacing its entity vetting and facility clearance platforms with NI2 at roughly $163 million, FOCI module first.

GAO reports 12,519 cleared contractor-owned facilities in fiscal year 2023, of which 9,611 required a security review. FOCI work inside that base is lopsided: officials told GAO that the Mid-Atlantic, one of DCSA’s four regions, holds about 45 percent of the agency’s facilities under FOCI. No federal source publishes how many cleared facilities operate under mitigation nationwide, reason to distrust vendor totals.

DCSA plans to spend approximately $163 million developing NI2. As of GAO’s April 2026 report, officials projected the first capability group to begin operating in early 2026 and the last in fiscal 2028. The first module is not incidental: it “focuses primarily on the initial vetting of company facilities for FOCI risks before they enter the NISP.”

So the planning assumption through fiscal 2028 is not that FOCI screening gets easier, nor that it bars foreign capital, which it never has. It is that screening gets faster and applies earlier, to more companies, including ones with no classified work. The employers who come out ahead answer Question 4 accurately the first time and start clearance processing on designated employees the week they begin negotiating, because nothing about mitigation gives back the months spent waiting.

Frequently Asked Questions

Does foreign ownership automatically disqualify a company from a facility clearance?

No. An affirmative answer triggers a risk-based determination under 32 CFR 117.11(c)(1), not a denial, and the standard asks whether an entity is under FOCI “to such a degree” that clearing it would be inconsistent with the national interest. But an entity found under FOCI stays ineligible until effective measures negate or mitigate it.

What percentage of foreign ownership triggers the SF-328?

Question 1 of the 02/2026 revision triggers at 5 percent or more of any class of stock, participation interest, units, or total capital commitment, and can be met in aggregate across foreign persons. Question 2 reaches 10 percent or more outbound ownership; Question 7 reaches 5 percent of revenue from one foreign person, or 15 percent in aggregate.

Can we keep hiring cleared staff while FOCI mitigation is negotiated?

Yes. Under 32 CFR 117.9(e)(1), designated employees are processed for clearance eligibility concurrently with the company’s entity eligibility determination. What 117.9(e)(2) forbids is granting access before both are favorable.

Can a non-U.S. citizen serve as an officer of a cleared company?

Generally no, and never as FSO or ITPSO, both of which must be U.S. citizen employees holding clearances. Key management personnel can be formally excluded from classified access so a foreign executive stays in post. One exception sits at 32 CFR 117.11(e)(1)(iii): under a limited entity eligibility determination for a single, narrowly defined contract, personnel other than the FSO may be citizens of the FOCI country.

Primary sources: 32 CFR 117.11 and 32 CFR 117.9 on govinfo; the SF-328 (rev. 02/2026); the NISPOM final rule, 85 FR 83300; Public Law 116-92; and GAO, GAO-26-107861 (April 2026).