By Mick Fox, Chief Operating Officer, TechnoMile
If you have been around GovCon long enough, you know that regulatory updates rarely feel dramatic on paper. They read like small tweaks – a definition clarified here, a reporting requirement adjusted there. But anyone who’s lived through a few cycles knows the truth: even the “minor” changes can shift how the entire game is played.
The latest DFARS cycle includes a proposed Foreign Ownership, Control, or Influence, or FOCI, rule and a new National Industrial Security System, or NISS, eligibility gate that, if finalized, could freeze a contract award mid-stream — and it would reach far beyond classified work, covering any unclassified DOW contract or subcontract, at any tier, valued above $5 million.
It reminds me of the NFL’s kickoff fair-catch adjustment from a few seasons ago. On paper, it looked like nothing – just a small tweak that moved the ball to the 25-yard line if you called a fair catch inside that line. Most fans barely noticed. But special teams coaches noticed. Kickers noticed. Returners definitely noticed. Suddenly, strategy changed. Field position changed. Risk-reward calculations changed.
A tiny rulebook update reshaped how teams approached an entire phase of professional football. Now think of the DFARS changes on the table right now — the ones that look small at first glance — these are the ones that would ripple through BD, capture, proposal development, compliance, subcontracting and post-award execution, if adopted as written. Teams will need to rethink workflows, tighten documentation and align earlier across functions.
That’s exactly what’s at stake with the proposed DFARS FOCI rule.
You can already see this in the so-called “minor” changes proposed in the latest DFARS cycle. Commercial products and services would generally be exempt from the new FOCI disclosure regime, but that exemption wouldn’t be absolute. If a senior DOW official flags the contract as involving sensitive data or systems, BD teams pursuing what they assumed was a “safe” commercial deal would need to be ready to produce beneficial-ownership disclosures they never needed before. In practice, that would mean a change to how BD teams operate day to day: they’ve been used to skipping ownership documentation entirely on commercial deals, assuming the exemption covered them. Under the proposed rule, they’d need to confirm whether that same official could pull their specific opportunity back into FOCI review before investing in pursuing or shaping it — or risk chasing a deal they can’t ultimately win.
That means BD teams should start flagging any commercial opportunity touching sensitive data or systems for FOCI review before proposal development starts, not after — regardless of whether the rule is finalized as written.
The rule is not yet final; the public comment period is closed July 6. But the message is already clear: organizations that wait until implementation to understand the requirements will find themselves rushing to retrofit processes, controls and supplier oversight. Proposed DFARS 240.27X-4, within the new DFARS Part 240 (Information Security and Supply Chain Security), makes the point explicit: it would prohibit contracting officers from awarding a contract, issuing a modification, or exercising an option unless the contractor or prospective contractor maintains an eligible status in the NISS. If finalized as written, eligibility would become a recurring gatekeeper for contract performance, not a one-time onboarding requirement, but a checkpoint that could affect every award, modification and option exercise.
What appears on the surface to be a supply-chain reporting requirement is, in proposed form, a fundamental redesign of vendor intake, supply-chain governance and compliance management. Contractors will need stronger internal controls, earlier engagement with suppliers and more robust documentation than many organizations currently maintain, well before any final rule takes effect. The stakes rise at the subcontractor level. Under the proposed rule, the new FOCI requirements and beneficial-ownership disclosure obligations would apply regardless of whether subcontractors are prepared. If a covered subcontractor fails to submit its SF 328, lacks eligible NISS status, or cannot meet required reporting timelines, the resulting disruption will not remain isolated to that supplier. Delayed awards, stalled contract modifications and blocked option exercises could quickly cascade to the prime contractor. In effect, a subcontractor’s compliance gap would become the prime’contract’s’s performance risk. For business development and capture teams accustomed to treating subcontractor compliance as an independent responsibility, that assumption may no longer hold up once the rule takes effect.
This is where the real operational impact would show up. A sentence added to a clause could change how capture builds its gate reviews, what compliance needs from subcontractors before a teaming agreement is signed, and what program managers must be able to prove months after award. The proposed change is one line. Its potential operational footprint is everything downstream of it.
At the end of the day, none of these proposed updates look dramatic in isolation. They read like small rulebook edits, the kind most people skim past. That’s the real story here: the rulebook is changing quietly, but if this rule is finalized as proposed, the way you play will have already changed by the time most contractors notice.
The contractors who struggle won’t be the ones who missed the Federal Register notice. They’ll be the ones who read it, decided it was administrative and handed it to legal without looping in operations.
The contractors who come out ahead won’t be the ones who wait for the final rule or the next training cycle. They’ll be the ones who treat this proposed change like the kickoff adjustment — noticing the shift early, preparing ahead of finalization and turning what looks like a subtle rule change into a strategic advantage.
Start now: audit which of your commercial contracts could be pulled into FOCI review if this rule is finalized and get ahead of subcontractor SF 328 submissions before your next teaming agreement, using a centralized, secure system to manage declarations and supporting artifacts.
And that’s before a broader FAR overhaul even arrives. For now, it’s this proposed DFARS change — not the headline-grabbing rewrite of the FAR itself — that will determine who’s ready and who’s scrambling once a final rule is published.
Because in GovCon, just like in football, the teams that win aren’t the ones who read the rulebook. They are the ones who understand what it means on the field — before the whistle blows.
