SUPPLEMENTARY INFORMATION:

I. Background

DoD is proposing to revise the DFARS to implement paragraphs (b)(2)(A), (b)(2)(C), and (c)(1) of section 847 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2020 (Pub. L. 116-92) and paragraph (c)(2) of section 819 of the NDAA for FY 2021 (Pub. L. 116-283). Paragraph (b)(2)(A) of section 847 requires covered contractors and subcontractors to disclose to the Defense Counterintelligence and Security Agency (DCSA) their beneficial ownership and whether they are under foreign ownership, control, or influence (FOCI) with updates for any changes. Paragraph (b)(2)(A) also requires covered contractors and subcontractors, if determined to be under FOCI, to disclose contact information for each of their foreign owners that is a beneficial owner.

Paragraph (b)(2)(C) of section 847 requires contract clauses providing for and enforcing disclosures related to changes in FOCI or beneficial ownership during performance of the contract or subcontract and the effective mitigation of risks related to FOCI throughout the duration of the contract or subcontract.

Paragraph (c)(1) of section 847 establishes that the disclosure and risk mitigation requirements of the statute may apply to contracts for commercial products or commercial services when a designated senior DoD official makes a determination that the contract involves a risk or potential risk to national security because of sensitive data, systems, or processes.

Paragraph (c)(2) of section 819 adds a statutory deadline for DoD to revise relevant directives, guidance, training, and policies, including amending the DFARS to implement section 847 of the NDAA for FY 2020.

In addition, DoD is proposing to revise the DFARS to implement elements of a policy under DoD Instruction 5205.87, Mitigating Risks Related to Foreign Ownership, Control, or Influence for Covered DoD Contractors and Subcontractors, as required by section 847 of the NDAA for FY 2020. DoD Instruction 5205.87 establishes procedures related to the disclosure of beneficial ownership and FOCI information and mitigation of FOCI risk.

II. Discussion and Analysis

The rule proposes to amend the DFARS by creating part 240, Information Security and Supply Chain Security. In part 240, DoD proposes to create section 240.27X, Mitigation of Risks Related to Beneficial Ownership or Foreign Ownership, Control, or Influence, to implement paragraphs (b)(2)(A), (b)(2)(C), and (c)(1) of section 847 of the NDAA for FY 2020, paragraph (c)(2) of section 819 of the NDAA for FY 2021, and elements of DoD Instruction 5205.87.

DoD proposes to add section 240.27X-1 to establish the scope of the section and adds the definition of “covered contractor or subcontractor” at 240.27X-2, to clarify which entities are impacted by the statutory requirements.

Section 240.27X-3, Policy, is proposed to describe the statutory requirements for disclosing information and mitigating FOCI risks throughout the duration of the contract or subcontract. This section also addresses exemption of the disclosure and risk mitigation requirements for commercial products and commercial services, unless the designated senior DoD official determines that the contract involves a risk or potential risk to national security. The senior DoD official has not yet been designated. The term “designated senior DoD official” is used in this proposed rule as a placeholder.

The requirements at 240.27X-4, Procedures, are proposed to establish the procedures necessary for contracting officers to implement the statutory disclosure and risk mitigation requirements. The section directs the contracting officer to not award, modify a contract, or exercise an option unless the offeror or contractor has a status of eligible in the National Industrial Security System (NISS), available at https://niss.dcsa.mil.

Section 240.27X-5 prescribes use of the provision and clause in solicitations and contracts with a value in excess of $5 million. The language at 240.27X-5 clarifies that the provision and clause are only to be included in solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services if the designated senior DoD official determines that the contract involves a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes.

Updates are proposed in subpart 212.3 to include the provision and clause in the list of provisions and clauses that are applicable to commercial products and commercial services. In addition, updates in subpart 217.2 are proposed to clarify that, prior to exercising an option, the contracting officer must verify that the contractor has a status of eligible in NISS.

A new solicitation provision was added at 252.240-70XX, Disclosure of ( printed page 24784) Beneficial Ownership or Foreign Ownership, Control, or Influence-Representation. The new solicitation provision requires offerors to disclose their Standard Form (SF) 328, Certificate Pertaining to Foreign Interests, and supporting documents for DCSA review in NISS. The solicitation provision also requires offerors to represent by submission of the offer that the offeror has submitted the SF 328 and the contact information of each beneficial owner in NISS and that the information is current, accurate, and complete. In addition, the solicitation provision puts offerors on notice that if the requiring activity determines, based on input from DCSA, that FOCI or beneficial ownership poses a risk or potential risk of compromise to national security that may be mitigated, the offeror must agree at the time of award to implement a risk mitigation strategy within 90 days of award.

A new contract clause is proposed at 252.240-70YY, Disclosure of Beneficial Ownership or Foreign Ownership, Control, or Influence. The new contract clause requires contractors to—

(1) Disclose to DCSA their beneficial ownership and whether they are under FOCI by submitting an updated SF 328 in NISS;

(2) Update the SF 328 and supporting documents, to include the contact information of each beneficial owner in NISS.

III. Applicability to Contracts at or Below the Simplified Acquisition Threshold (SAT), for Commercial Products (Including Commercially Available Off-the-Shelf (COTS) Items), and for Commercial Services

This proposed rule includes a new solicitation provision and contract clause to implement the requirements of paragraphs (b)(2)(A), (b)(2)(C), and (c)(1) of section 847 of the NDAA for FY 2020 (Pub. L. 116-92) and paragraph (c)(2) of section 819 of the NDAA for FY 2021 (Pub. L. 116-283): (1) The provision at DFARS 252.240-70XX, Disclosure of Beneficial Ownership or Foreign Ownership, Control, or Influence—Representation; and (2) the clause at DFARS 252.240-70YY, Disclosure of Foreign Ownership, Control, or Influence or Beneficial Ownership.

The provision at DFARS 252.240-70XX is prescribed at DFARS 240.27X-5(a) for use in solicitations that include the clause at 252.240-70YY. The clause at DFARS 252.240-70YY is prescribed at DFARS 240.27X-5(b) for use in solicitations and contracts with a value in excess of $5 million. The clause is also required in solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, if the designated senior DoD official determines that the contract involves a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes.

DoD does not intend to apply the proposed rule to contracts at or below the SAT, because the requirements of the proposed rule only apply to contracts valued above $5 million. DoD intends to apply the proposed rule to contracts for the acquisition of commercial products including commercially available off-the-shelf (COTS) items and for the acquisition of commercial services, as prescribed.

A. Applicability to Contracts at or Below the Simplified Acquisition Threshold

The statute at 41 U.S.C. 1905 governs the applicability of laws to contracts or subcontracts in amounts not greater than the simplified acquisition threshold. It limits the applicability of laws to such contracts or subcontracts. The statute at 41 U.S.C. 1905 provides that if a provision of law contains criminal or civil penalties, or if the Federal Acquisition Regulatory Council makes a written determination that it is not in the best interest of the Federal Government to exempt contracts or subcontracts at or below the SAT, the law will apply to them. The Principal Director, Defense Pricing, Contracting, and Acquisition Policy (DPCAP), is the appropriate authority to make comparable determinations for regulations to be published in the DFARS, which is part of the Federal Acquisition Regulation system of regulations. DoD does not intend to make that determination. Therefore, this proposed rule will not apply at or below the simplified acquisition threshold.

B. Applicability to Contracts for the Acquisition of Commercial Products Including COTS Items and for the Acquisition of Commercial Services

The statute at 10 U.S.C. 3452 exempts contracts and subcontracts for the acquisition of commercial products including COTS items, and commercial services from provisions of law enacted after October 13, 1994, unless the Under Secretary of Defense (Acquisition and Sustainment) (USD(A&S)) makes a written determination that it would not be in the best interest of DoD to exempt contracts for the procurement of commercial products and commercial services from the applicability of the provision or contract requirement, except for a provision of law that—

• Provides for criminal or civil penalties;
• Requires that certain articles be bought from American sources pursuant to10 U.S.C. 4862, or that strategic materials critical to national security be bought from American sources pursuant to 10 U.S.C. 4863; or
• Specifically refers to10 U.S.C. 3452 and states that it shall apply to contracts and subcontracts for the acquisition of commercial products (including COTS items) and commercial services.

The statutes implemented in this proposed rule do not impose criminal or civil penalties, do not require purchase pursuant to 10 U.S.C. 4862 or 4863, and do not refer to 10 U.S.C. 3452. Therefore, sections 847 and 819 will not apply to the acquisition of commercial services or commercial products including COTS items unless a written determination is made. Due to delegations of authority, the Principal Director, DPCAP is the appropriate authority to make this determination.

DoD intends to make the determination to apply the statutes to the acquisition of commercial products including COTS items and to the acquisition of commercial services. Therefore, this proposed rule will apply to the acquisition of commercial products including COTS items and to the acquisition of commercial services, if a designed official determines that the contract involves a risk or potential risk to national security because of sensitive data, systems, or processes.

C. Determinations

Given that section 847 of the NDAA for FY 2020 and section 819 of the NDAA for FY 2021 were enacted to promote the mitigation of FOCI or beneficial ownership risk in the supply chain, and FOCI or beneficial ownership risk is related to the ownership of the company and not necessarily what is being procured, it is in the best interest of DoD to apply the statute to contracts for the acquisition of commercial services and commercial products, including COTS items, as defined at Federal Acquisition Regulation 2.101. An exception for contracts for the acquisition of commercial services and commercial products, including COTS items, would exclude the contracts intended to be covered by the law, thereby undermining the overarching public policy purpose of the law.

IV. Expected Impact of the Rule

DoD is proposing to amend the DFARS to include the following solicitation and contractual requirements to implement the statutory requirements at paragraphs (b)(2)(A), (b)(2)(C), and (c)(1) of section 847 of the NDAA for FY 2020 (Pub. L. 116-92) and ( printed page 24785) paragraph (c)(2) of section 819 of the NDAA for FY 2021 (Pub. L. 116-283):

• Offeror and contractor requirements to disclose to DCSA their beneficial ownership and whether they are under FOCI.
• Contractor requirement to provide updates to their FOCI and beneficial ownership disclosures to DCSA for the life of the contract.
• Contractor requirement to disclose contact information for each of its foreign owners that is a beneficial owner, if determined to be under FOCI.
• Contractor requirement to mitigate risks related to FOCI within 90 days of contract award, modification, exercise of option, or identification of risks during contract performance.

As described in section VIII of this preamble, the costs associated with the technical requirements related to the FOCI risk mitigation are outside of the scope of this proposed rule. The costs associated with the requirements for offerors to disclose FOCI and beneficial ownership information to DCSA are covered by two information collection approvals completed by the Office of the Under Secretary of Defense for Intelligence and Security: (1) Certificate Pertaining to Foreign Interests, SF-328, OMB Control Number 0704-0579; and (2) National Industrial Security System (NISS), OMB Control Number 0705-0006. The burden calculated for OMB Control Number 0704-0579 for the SF 328 is $7,352,560, and the burden calculated for OMB Control Number 0705-0006 for the NISS is $712,281 (source: reginfo.gov).

This proposed DFARS rule, if finalized, will apply to contracts valued above $5 million. The proposed rule may also apply to certain contracts for commercial products and commercial services if a designated senior DoD official determines that the contract involves a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes.

According to data from the Federal Procurement Data System (FPDS), the average number of unique entities for fiscal years 2022 through 2024 with awards above $5 million, excluding awards using exclusively commercial procedures, is 3,774. Of those entities, 2,148 (57%) are unique small businesses. DoD has no way to know how many exclusively commercial awards will have an exception that applies the disclosure and reporting requirements to those offerors and contractors, so it assumes exclusively commercial awards will not include reporting and disclosure requirements.

To calculate the number of potential offerors and subcontractors impacted by this proposed rule, DoD assumes for every unique entity with awards above $5 million, there are two offerors on average per award and that the entities awarded contracts have on average 5 subcontractors, for a total of 37,740 potentially impacted entities. Of those entities, 21,511 (57%) are estimated to be small businesses.

For updates to disclosures, DoD does not know the number of contractors who will need to make updates to their FOCI and beneficial ownership disclosure information, or the number of updates they will need to make. DoD assumes half of all contractors may have to update information during the performance of the contract. To estimate the number of impacted contractors, DoD used the average number of unique awardees with contracts valued above $5 million, which is 3,774. DoD multiplied 3,774 by an assumed 5 subcontractors per unique awardee, which equals 18,870. DoD multiplied this number by 50 percent to arrive at an estimate of 9,435 contractors would need to update their disclosures.

In addition, prior to exercising an option or modifying a contract, contractors will need to disclose FOCI and beneficial ownership information to DCSA. DoD does not have a way to estimate the number of potential modifications or options exercised, so DoD assumes 10% of the assumed total number of impacted contractors (18,870) could be impacted. Therefore, DoD assumes that 1,887 contractors may be subject to modifications or the exercise of options that would result in disclosure update requirements.

The proposed rule includes a requirement for offerors to represent, by submission of an offer, that (1) they have submitted the SF 328 and contact information for each beneficial owner in the NISS and (2) the information is current, accurate, and complete. DoD estimates that, before submitting their offers, 7,548 offerors will verify submission of the required information and that the information provided is current, accurate, and complete. DoD further estimates these offerors may submit 2 offers per year in response to solicitations containing the representation requirement. The verification is expected to require about 10 minutes and to be performed by a journeyman employee equivalent to a General Schedule grade 12, step 5 ($66.23, including overhead rate of 36.25%). The annual cost associated with the verification is $168,534.

An important benefit of this proposed rule is that, if finalized, it will help reduce the risk of foreign adversaries gaining unauthorized access to DoD information. The proposed rule provides for the implementation of statutory FOCI and beneficial ownership requirements, resulting in more secure DoD acquisitions. The proposed rule also reduces the risk of the introduction of contract performance risk and theft of DoD intellectual property by foreign adversaries. As a result, this proposed rule will support the underlying statutory requirement to reduce FOCI and beneficial ownership risk to national security.

V. Executive Orders 12866 and 13563

Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is a significant regulatory action and, therefore, was subject to review under section 6(b) of E.O. 12866, Regulatory Planning and Review, as amended.

VI. Executive Order 14192

This proposed rule, if finalized as proposed, is not expected to be subject to E.O. 14192, because the proposed rule is being issued with respect to a national security function of the United States. The proposed rule implements the contractual requirements of section 847 of the NDAA for FY 2020 related to FOCI and beneficial ownership. The proposed rule is critical to the national security of the United States and directly supports DoD's mission of maintaining a secure and resilient defense industrial base (DIB). The implementation of the contractual requirements in this proposed rule is not merely an administrative action but a vital step in safeguarding the nation's military and technological advantage from FOCI risk.

The primary benefit of the section 847 requirement is the unprecedented level of visibility it provides into the ownership structures of offerors and contractors, particularly for contracts that do not involve access to classified information. Historically, this has been a significant vulnerability. Foreign adversaries have exploited this gap to gain access to sensitive, unclassified information, intellectual property, and critical technologies through various ( printed page 24786) ownership, control, and influence avenues of foreign interest. By mandating the disclosure of FOCI and beneficial ownership, this rule proposes to close that gap, directly reducing the risk of unauthorized access to DoD information and mitigating the potential for theft of intellectual property that underpins our warfighting capabilities. This directly enhances the security of DoD acquisitions and minimizes contract performance risks associated with contractors who may be subject to foreign adversary leverage.

This initiative is fully aligned with and supports a broader, Governmentwide strategy to secure the nation's critical supply chains, as articulated in recent Executive orders. For example, E.O. 14017, America's Supply Chains, directs a whole-of-Government approach to assessing and strengthening supply chain resilience, with a specific focus on the DIB. Section 847 is a direct and necessary implementation of this directive, providing the foundational data required to understand and mitigate foreign-based risks with the defense supply chain.

Furthermore, the proposed rule complements the objectives of E.O. 14028, Improving the Nation's Cybersecurity, which emphasizes the need to secure the software supply chain and improve the detection of cybersecurity vulnerabilities. By identifying potentially compromised or influenced offerors and contractors, section 847 serves as a critical upstream defense, preventing threats from entering the supply chain in the first place. This proactive stance is essential for protecting the integrity of the data and systems on which DoD relies.

In essence, this proposed rule is not an isolated regulatory burden but a cornerstone of DoD's strategy to counter pervasive threats from strategic competitors. It provides the necessary tools to ensure our partners in industry are secure, trustworthy, and free from the influence of those who seek to harm our national interests. Application of the requirements of E.O. 14192 to this proposed rule would unacceptably impede DoD's ability to meet the above objectives and limit the ability to meet congressionally managed, mission-critical security functions. For these reasons, DoD finds the implementation of the contractual requirements in this proposed rule critical to national security.

VII. Regulatory Flexibility Act

DoD does not expect this proposed rule, when finalized, to have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., because the rule simply requires certain offerors and contractors to disclose information about FOCI and beneficial ownership and to conduct risk mitigation efforts, if applicable. However, an initial regulatory flexibility analysis has been performed and is summarized as follows:

This proposed rule is necessary to respond to the threat to U.S. national security posed by beneficial ownership and foreign ownership, control, or influence (FOCI) risks under contracts and subcontracts. The purpose of this proposed rule is to implement statutory disclosure and risk mitigation requirements related to information associated with FOCI and beneficial ownership. This proposed rule requires covered contractors and subcontractors to share their FOCI disclosures and beneficial ownership information with the Defense Counterintelligence and Security Agency (DCSA). This proposed rule also requires covered contractors to mitigate risks associated with being under FOCI within 90 days of contract award, modification, option exercise, or identification of risks during contract performance. Covered contractors and subcontractors are existing or prospective contractors or subcontractors, at any tier, of DoD with a contract or subcontract valued above $5 million.

The proposed rule does not apply to commercial products and commercial services, unless the designated senior DoD official determines that the contract involves a risk or potential risk to national security or potential compromise because of sensitive data, systems, or processes.

One objective of this proposed rule is to partially implement section 847 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2020 (Pub. L. 116-92) and section 819 of the NDAA for FY 2021 (Pub. L. 116-283). This proposed rule also implements elements of DoD Instruction 5205.87, Mitigating Risks Related to Foreign Ownership, Control, or Influence for Covered DoD Contractors and Subcontractors.

This proposed rule will impact small businesses that are existing or prospective contractors or subcontractors of DoD on contracts valued above $5 million. In addition, this proposed rule will impact commercial entities. According to data from the Federal Procurement Data System, the average number of unique entities for FY 2022 through FY 2024 with awards above $5 million, excluding awards using exclusively commercial procedures, is 3,774, of which 2,148 (57%) are unique small entities. DoD has no way to know how many exclusively commercial awards will have an exception that applies the disclosure and reporting requirements to those offerors and awardees. Therefore DoD assumes exclusively commercial awards will not include reporting and disclosure requirements.

To calculate the number of potential offerors and subcontractors impacted by this proposed rule, DoD assumes for every unique entity with awards above $5 million, there are two offerors on average per award and that awardees have on average 5 subcontractors. The estimated total number of potentially impacted awardees is 37,740, of which 21,511 (57%) are estimated to be small entities.

This proposed rule does not impose new reporting, recordkeeping, or other compliance requirements for small entities beyond those approved in OMB Control Numbers 0704-0579, Certificate Pertaining to Foreign Interests, SF-328; and 0705-0006, National Industrial Security System (NISS). The projected reporting and compliance requirements associated with OMB Control Numbers 0704-0579 and 0705-0006 include the following: (1) disclosing to DCSA any FOCI and beneficial ownership information by submitting an updated SF 328, Certificate Pertaining to Foreign Interest, in NISS along with any supporting information; (2) maintaining the information in NISS for the duration of the contract; and (3) if determined to be under FOCI, disclosing to DCSA in NISS the contact information for all foreign owners that are beneficial owners. In addition, if there is a requirement for a contractor to complete a risk mitigation strategy, they will be required to do so within 90 days of contract award.

These reporting requirements would apply to any small entities that are existing or prospective contractors or subcontractors of DoD on contracts valued above $5 million.

This proposed rule does not duplicate, overlap, or conflict with any other Federal rules.

There are no known alternatives that would accomplish the stated objectives of the applicable statute.

DoD invites comments from small business concerns and other interested parties on the expected impact of this proposed rule on small entities.

DoD will also consider comments from small entities concerning the existing regulations in subparts affected by this proposed rule in accordance with 5 U.S.C. 610. Interested parties must submit such comments separately ( printed page 24787) and should cite 5 U.S.C. 610 (DFARS Case 2021-D011), in correspondence.

VIII. Paperwork Reduction Act

This proposed rule contains information collection requirements that require the approval of the Office of Management and Budget under the Paperwork Reduction Act (44 U.S.C. chapter 35). However, the Office of the Under Secretary of Defense for Intelligence and Security completed two information collection approvals: (1) Certificate Pertaining to Foreign Interests, SF-328, OMB Control Number 0704-0579; and (2) National Industrial Security System (NISS), DCSA Form 147, OMB Control Number 0705-0006.

Accordingly, DoD has not submitted a request for approval of a new information collection requirement concerning DFARS Case 2020-D011, Mitigating Risks Related to Foreign Ownership, Control, or Influence, to the Office of Management and Budget.

Therefore, the Defense Acquisition Regulations System proposes to amend 48 CFR chapter 2 as follows:

1. The authority citation for part 212 continues to read as follows:

Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.

2. Amend section 212.301 by—

a. Redesignating paragraphs (f)(xvii) through (xxii) as (f)(xviii) through (xxiii); and

b. Adding new paragraph (f)(xvii).

The addition reads as follows:

3. The authority citation for part 217 continues to read as follows:

Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.

4. Amend section 217.207 by adding paragraph (c)(3) to read as follows:

5. Add part 240 to read as follows:

6. The authority citation for part 252 continues to read as follows:

Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.

7. Add sections 252.240-70XX and 252.240-70YY to read as follows:

91 FR 24783