The Defense Counterintelligence and Security Agency (DCSA) published a press release on May 9, 2025, announcing an updated Standard Form 328 (SF-328), Certificate Pertaining to Foreign Interest. The updated form was approved on May 1, 2025, and includes changes aimed to increase users' clarity and understanding of questions and gather more detailed information pertaining to aspects of foreign ownership, control or influence (FOCI) reported to DCSA. One goal of implementing the new form is to reduce processing times by ensuring thorough information is provided on the first submission. When completed, the new SF-328 is considered Controlled Unclassified Information (CUI).
Background Relating to SF-328
DCSA is an agency within the U.S. Department of Defense (DOD) that assesses the risk of FOCI reported by cleared government contractors. DCSA considers a company to be operating under FOCI when a foreign interest has the ability "direct or indirect, whether or not exercised, and whether or not exercisable, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorized access to classified information or may adversely affect the performance of classified contracts."
A government contractor that applies for a facility clearance must submit an SF-328 and update it for any material changes so that DCSA can assess the risks and mitigate any FOCI prior to granting a clearance to the contractor for accessing and handling classified information. The SF-328 requires detailed information on the contractor's association with foreign interests. (For more information on Facility Security Clearances, see Holland & Knight's "Are We All Clear? Facilitating Security Clearances" podcast series.)
The updated form consists of nine questions with detailed instructions on the types of supporting documents requested. It also requires certain contractors to sign a Statement of Full Disclosure of Foreign Affiliations (Foreign Affiliations Statement). Many contractors who have recently submitted an SF-328 prior to the release of the new form have already been asked to provide the additional information requested in the new form.
The changes reflect a deliberate effort of the DOD to more accurately identify FOCI risks of its contractors. The timing is noteworthy, as the DOD will soon be reviewing FOCI considerations for unclassified DOD contracts in excess of $5 million as part of the implementation of Section 847 of the National Defense Authorization Act of 2020. (For more information, see Holland & Knight's previous alert, "DOD Proposed Rule Will Expand FOCI Requirements to Non-Classified Defense Contracts," April 23, 2025.). In addition to the National Industrial Security Program and the new Section 847 mandate, the new SF-328 is authorized for use in the DOD Enhanced Security Program, DOD Small Business Innovation Research and Small Business Technology Transfer (SBIR/STTR) programs, and DOD Cybersecurity Maturity Model Certification (CMMC) Program.
Changes to Questions and Instructions
The general structure of the updated SF-328 is essentially the same as the previous version. However, it includes several key changes to clarify and broaden the scope of questions and will require more detailed disclosures than the previous form.
Updates to Questions
Some of the questions were reformulated to increase clarity and broaden the scope of questions on the previous version of the form. Notable changes to the questions include:
- Question 1 now covers "nominee" shares that were previously captured in deleted Question 8 of the old form.
- Question 5 adds grants and side letters to the list of arrangements with foreign persons.
- Question 7 expands the list of reportable proceeds from a foreign person to include tuition, gifts and endowments in addition to revenue and net income. Importantly, the reporting threshold for aggregate foreign proceeds in Question 7(b) was lowered from 30 percent to 15 percent of total revenue or net income.
The instructions on completing the form are now included as part of the form and reflect DCSA current practice with respect to information that it requires from reporting contractors.
Comprehensive Instructions and Definitions
The updated instructions provide additional detail and guidance for various circumstances and largely reflect what DCSA has been already expecting contractors to provide when submitting their SF-328s. The instructions were intended to provide adequate specificity to ensure sufficient information is provided in the initial submission, reducing the need for additional rounds of questioning.
The updated instructions also incorporate recent DCSA policy, requiring companies to identify the entire beneficial ownership and control structure for any entity holding 5 percent or more interest in the relevant U.S. contractor, and companies answering in the affirmative must provide precise citations to provisions of governance documents that describe the powers and rights held by such foreign interests.
Several substantive differences from the prior requirements include reporting requirements for:
- foreign ownership greater than 5 percent, in aggregate, by multiple foreign persons from the same country or within affiliated entities (the prior instructions were even less clear about how to aggregate certain foreign ownership)
- foreign outsourcing contractual relationships, such as manufacturing, research and development, software development, quality assurance and administrative services
- foreign debt obligations and bankruptcy exposure
The updated questions and instructions also provide specific directives to academic institutions as a special group of government contractors with their unique exposure to foreign influence. In particular, the instructions pertaining to the question on foreign revenue request information about the academic institution's tuition, gifts and endowments. Additionally, when reporting contracts, agreements, understandings, grants, side letters or arrangements with foreign persons, academic institutions under a covered U.S. government contract must also provide further information about the foreign student population, foreign faculty population, research agreements with foreign persons and any exchange programs with foreign persons.
Foreign Affiliations Statement
The previous version of the SF-328's instructions referenced a requirement to provide a Foreign Affiliations Statement in reference to old Question 9 (new Question 8) but did not provide an approved template for industry use. To address industry feedback pertaining to the lack of approved template, the new SF-328 includes a form for the Foreign Affiliations Statement.
A Foreign Affiliations Statement is required when an entity responds affirmatively to Question 8, which asks if any individual holding management positions within the organization also holds a position with or serves as a consultant or representative for any foreign person. For each individual, the contractors must provide a separate Foreign Affiliations Statement listing comprehensive information pertaining to the individual, foreign interest, individual's relationship with the foreign interest and individual's duties with the U.S. entity.
Implementation
The National Industrial Security System (NISS) deployed the updated SF-328 on May 12, 2025. All packages initiated or submitted on or after May 12, 2025, must include the new SF-328 version.
Packages submitted and initiated in NISS prior to May 12, 2025, will not be returned to the contractor for an updated SF-328. Further, contractors are not expected to submit a new SF-328 solely because the form has been updated. Contractors will need to submit a new SF-328 only if they are 1) submitting an initial facility clearance or upgrade request, 2) reporting a change in FOCI considerations impacting the SF-328, 3) reporting a change in ownership resulting in a new excluded parent wherein the excluded parent must submit an SF-328 or 4) renewing their mitigation agreement.
