Dealmakers On Notice: DCSA Filings Expected To Surge

Key Takeaways

A revised version of the Standard Form 328 ("SF-328"), used by the Defense Counterintelligence and Security Agency ("DCSA") to assess Foreign Ownership, Control, or Influence ("FOCI") risks, became mandatory on May 12, 2025.
While previously limited to contractors performing classified work, these disclosure obligations are now expanding to cover a much broader set of companies and transactions, including unclassified U.S. Department of Defense ("DoD") contracts over $5 million.
This expansion is expected to dramatically increase the number of entities subject to DCSA review, as implementation of Section 847 of the FY 2020 National Defense Authorization Act ("NDAA") brings a wide array of defense suppliers and investors into scope.
Investors, including private equity sponsors and sovereign wealth funds, should prepare for DCSA filings and related considerations to become more frequent elements of transaction diligence involving a wider range of U.S. government contractors, not just those performing classified defense work.
Disclosure requirements now reach deeper into ownership, governance, foreign funding, outsourcing, and individual affiliations, with particular implications for foreign investors, private equity sponsors, and U.S. contractors whose portfolio companies engage in U.S. government contracting.
Moreover, DCSA's shift from post-filing clarification to front-end disclosure means foreign capital must now be evaluated and disclosed before triggering events by both U.S. businesses and their investors.
For dealmakers, the takeaway is clear. While compliance obligations remain with the U.S. business, foreign investors and transaction parties should anticipate potential transactional delays where FOCI issues are not assessed and addressed in advance.

Overview

DCSA is the U.S. government entity responsible for overseeing security clearances and assessing FOCI risks for contractors handling sensitive DoD information. Although national security reviews of foreign investments in U.S. businesses are often associated with the Committee on Foreign Investment in the United States ("CFIUS"), DCSA plays a distinct role in assessing FOCI risks for contractors supporting U.S. defense operations, including through SF-328 filings.

Historically, SF-328 compliance applied primarily to contractors performing classified work. However, as Section 847 of the FY 2020 National Defense Authorization Act ("NDAA") takes effect, DCSA's reach will extend to unclassified DoD contracts over $5 million, capturing a vastly expanded pool of companies and investors. For dealmakers, this means that facility security clearances ("FCLs") and mitigation of FOCI concerns must be assessed, planned for, and addressed as part of transaction structuring.

DCSA expects the number of annual FOCI reviews to increase from roughly 2,000 to 41,000. The new SF-328 is engineered to support this surge by harmonizing expectations, embedding standard definitions, and reducing ambiguity. This also represents a regulatory sea change: from reviewing only "cleared" contractors to reviewing all significant defense suppliers for foreign influence risk. Foreign investors (even those whose U.S. investments do not currently perform classified work) should assess whether existing or contemplated holdings may fall within the expanded Section 847 regime.

1. A More Demanding First Gate: Disclosure as Frontline Risk Screening

The revised SF-328 became mandatory for all relevant filings submitted on or after May 12, 2025. This includes new FCL applications, change condition packages involving FOCI developments, and new or renewed mitigation agreements. The form itself has been condensed from ten to nine questions, but embeds significantly more detailed instructions, tighter definitions, and broader disclosure triggers. The form now explicitly incorporates expectations that, until recently, were often conveyed only through iterative Q&A with the DCSA reviewers.

Key changes include:

Expanded Scope of Foreign Interests. The updated form clarifies that nominee shares, contractual grants, side letters, and even tuition or endowment funding must be disclosed where linked to a foreign person. Foreign investors with board rights, information rights, or bespoke side arrangements will need to ensure that such positions are understood and, where applicable, disclosed.
Lower Reporting Thresholds. The threshold for reporting aggregate foreign proceeds (e.g., revenue, gifts, endowments) has been reduced from 30% to 15% of total revenue or net income, a potentially low bar for multinational portfolio companies with cross-border revenue streams.
New Disclosure Categories. The form now captures foreign outsourcing relationships (e.g., software development, quality assurance, administrative services), foreign-held debt, and bankruptcy exposure, requiring investors to understand their exposure not just through equity, but also through financial and commercial relationships.

Many of these updates reflect longstanding DCSA practices that were already playing out in follow-up requests. But the new form formalizes those expectations and moves them to the front of the review process, raising the stakes for first-pass completeness.

2. Individual Foreign Ties: From Background Risk to Disclosure Requirement

The revised SF-328 also introduces a standardized Statement of Full Disclosure of Foreign Affiliations. This standardized form must be completed whenever key personnel (e.g., executives, board members, consultants) hold positions with foreign entities.

Each statement must clearly outline the nature of the relationship, the foreign interest involved, and any overlap with the individual's responsibilities at the U.S. contractor. Where a foreign investor places observers or directors on the boards of U.S. companies seeking or holding facility clearances, those individuals' affiliations will need to be tracked and may trigger reporting.

While DCSA has not issued public commentary on its enforcement posture, the form design signals a strategic shift: reduce discretion by embedding compliance expectations into the form itself. The agency appears focused on front-loading reviews, minimizing reliance on back-end clarification and surfacing all material foreign touchpoints in the first instance.

3. Who Must Comply and When

The revised SF-328 is mandatory for:

New FCL applications submitted on or after May 12, 2025;
Change condition packages involving FOCI developments;
New or renewed mitigation agreements involving excluded parents or foreign acquirers; and
Any submission made in connection with Section 847 implementation.

Contractors who submitted the prior SF-328 before May 12, 2025 do not need to refile, but any future submissions must use the revised version. The form is now fully embedded in the National Industry Security System ("NISS"), and DCSA has made clear that all new filings must comply with the updated standard.

For foreign investors, this means that any new equity investment, board designation, or governance arrangement involving a contractor performing defense work, even if such work is not classified, may trigger FOCI review and associated disclosure obligations.

4. What to Do

To prepare for expanded oversight and a more demanding disclosure standard, both U.S. contractors and their foreign investors should consider the following actions:

Assess Portfolio Company FOCI Risk. Map which holdings perform (or seek to perform) U.S. government work and identify those likely to trigger SF-328 or Section 847-based reviews.
Map Governance and Rights Structures. Inventory board seats, observer rights, veto powers, and other governance arrangements across portfolio companies. Ensure disclosure obligations can be met without delay.
Quantify Foreign Influence at the Margin. Consider whether indirect equity interests or common limited partner arrangements, particularly those aggregated across entities in the same jurisdiction, may exceed disclosure thresholds.
Track and Manage Individual Affiliations. Maintain visibility into whether any appointees or designees to U.S. boards or advisory positions also serve foreign entities that could raise concerns.
Coordinate with U.S. Partners Early. Where possible, discuss and align on disclosure strategy in advance of equity injections, governance changes, or bids for defense-related work.

Conclusion

The revised SF-328 is more than a disclosure form; it is a frontline instrument of national security oversight. As FOCI review extends deeper into the U.S. defense and tech ecosystems, foreign investors must treat FOCI risk as a standing diligence and governance concern, not a one-time box to check.

Whether pursuing a minority stake, expanding board involvement, or providing capital to a growing contractor, investors must be prepared to submit fully. Regulators now expect full-spectrum transparency across equity, influence, and affiliation and will evaluate exposure accordingly. Funds that embed this expectation into their investment strategy, governance planning, and portfolio monitoring will be best positioned to avoid regulatory friction and preserve deal certainty.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.