Part 1 and Part 2 of this series explained how the Department of Defense’s Proposed Rule would expand Foreign Ownership, Control, or Influence (FOCI) obligations and how the current facility and personnel clearance framework operates. As the government sharpens its focus on foreign influence in the supply chain, the documentation cleared contractors must submit is increasingly consequential. In this installment, PilieroMazza attorneys turn to the paperwork that accompanies contractors’ FOCI and security clearance-related obligations, including the Standard Form 328 (SF 328) and “change condition” packages.
The SF 328: Certificate Pertaining to Foreign Interests
The SF 328, “Certificate Pertaining to Foreign Interests,” is the government’s primary instrument for identifying whether a company is under FOCI. An entity must complete the SF 328 when seeking a facility security clearance (FCL) determination and again whenever significant changes occur to previously submitted information.
The SF 328 contains a series of questions about foreign involvement in the company, including but not limited to foreign persons who directly or indirectly own five percent or more of the company on a fully diluted basis and other foreign relationships that could give rise to control or influence. To prepare a complete and accurate response, a company should assemble an organizational structure chart, identify each foreign owner (whether an individual or an entity) and note the country of formation or domicile for each, and compile a list of its key management personnel.
An affirmative answer to any question on the SF 328 is significant and will result in the Defense Counterintelligence and Security Agency (DCSA) making a risk-based determination about whether the company is under FOCI, the degree to which that influence poses a risk to national security or classified performance, and what mitigation measures, if any, are required. In other words, the SF 328 is the front door to the entire FOCI analysis.
Once complete, cleared companies file the SF 328 and related FOCI materials through DCSA’s National Industrial Security System (NISS). A company preparing for its first FCL can get ahead of the process by working through the current version of the SF 328 now, drafting its answers, and gathering the supporting information each question requires.
Submitting a Change Condition Package After a Transaction
An FCL is a snapshot of a company’s ownership and control at a moment in time. When that picture changes, the company has an affirmative duty to inform DCSA. The FOCI regulations require contractors to report “changed conditions” that affect the entity eligibility determination, which include a change of ownership or control of the contractor, including stock transfers that affect control, as well as changes in operating name or address.
Contractors inform DCSA of material changes to previously provided FOCI information by submitting an updated SF 328 in accordance with DCSA guidance. This updated form, together with the supporting materials described below, is often referred to as a “change condition package.” The FOCI regulations also impose an earlier trigger for transactions involving a foreign acquirer. When a cleared company enters negotiations for a proposed merger, acquisition, or takeover by a foreign interest, it must notify DCSA at the commencement of those negotiations, not after closing.
A complete “change condition” package following a transaction generally includes:
- Notice of the Changed Condition: Identifying the transaction and its effect on ownership or control.
- An Updated SF 328: Reflecting the new ownership structure and any new foreign interests.
- A Proposed Plan to Mitigate FOCI: When the transaction introduces or increases foreign ownership, control, or influence.
- Supporting Transaction and Corporate Documents: Such as purchase, loan, and shareholder agreements, bylaws, operating agreements, articles of incorporation or other organizational documents, and reports filed with other federal agencies.
Timing deserves particular attention. The regulations do not set a single numerical deadline for reporting changed conditions; instead, they tie the timing and format of the report to DCSA-provided guidance, and they require notice of a foreign merger, acquisition, or takeover at the very start of negotiations. The practical takeaway is to report early and to build the FOCI notification into the deal timeline rather than treating it as a post-closing formality. Where a transaction is also subject to review by the Committee on Foreign Investment in the United States (CFIUS), the CFIUS review and DCSA’s industrial-security FOCI review proceed in parallel as separate processes, each with its own considerations and timelines.
PilieroMazza attorneys are well-versed in helping clients navigate DCSA’s requirements for the SF 328 and change condition package. If you need assistance or have questions, please contact Cy Alba, Daniel Figuenick, Cole Fox, or another member of the Firm’s Government Contracts and Corporate & Organizational Governance practice groups.
____________________
If you are seeking practical insights to gain a competitive edge by understanding the government’s compliance requirements, tune into PilieroMazza’s podcasts: GovCon Live!, Clocking in with PilieroMazza, and Ex Rel. Radio.
