--- title: Who Needs an SF-328? When It's Required description: Learn when an SF-328 is required for FCL applications, foreign ownership changes, Section 847 reviews, and other government contracting situations. image: https://industryfso.com/hubfs/Website/Pages/Homepage/Pentagon.webp --- [![Industry FSO logo](https://industryfso.com/hubfs/Website/Logos/Industry%20FSO%20logo.svg)](https://industryfso.com) - [About us](https://industryfso.com/about-us) - Services - [All Services](https://industryfso.com/services) - [FSO Services](https://industryfso.com/fso-services) - [FCL Setup & Maintenance](https://industryfso.com/fcl-formation) - [DCSA Review Prep](https://industryfso.com/dcsa-security-reviews) - [Foreign Ownership (FOCI)](https://industryfso.com/foci-consulting) - [Insights](https://industryfso.com/insights) [Speak to an Expert](https://industryfso.com/contact) - [About us](https://industryfso.com/about-us) - Services - [All Services](https://industryfso.com/services) - [FSO Services](https://industryfso.com/fso-services) - [FCL Setup & Maintenance](https://industryfso.com/fcl-formation) - [DCSA Review Prep](https://industryfso.com/dcsa-security-reviews) - [Foreign Ownership (FOCI)](https://industryfso.com/foci-consulting) - [Insights](https://industryfso.com/insights) [Speak to an Expert](https://industryfso.com/contact) - [FOCI](https://industryfso.com/insights/topic/foci) - [SF-328](https://industryfso.com/insights/topic/sf-328) # Who Needs an SF-328? When It's Required ![](https://industryfso.com/hubfs/Website/Global%20images/Sarah%20Phillips.jpg) By [Sarah Phillips](https://industryfso.com/insights/author/sarah-phillips) October 20 2026 7 min read ![Who Needs an SF-328? When It's Required image](https://industryfso.com/hubfs/Website/Pages/Homepage/Pentagon.webp) ## Contents ## Contents The SF-328, Certificate Pertaining to Foreign Interests, is an important part of the government's process for evaluating Foreign Ownership, Control, or Influence (FOCI). For companies pursuing a Facility Clearance (FCL), the form is a familiar requirement. However, other government contractors may encounter the SF-328 when reporting ownership changes, participating in certain security reviews, or responding to government requests for foreign interest information. With the development of new foreign ownership review requirements under Section 847 of the FY2020 National Defense Authorization Act (NDAA), the form may also become relevant to additional Department of Defense (DoD) contractors performing unclassified work. Understanding **when an SF-328 is required—and when it isn't** can help companies avoid unnecessary paperwork while ensuring they meet applicable disclosure obligations. ## What Is the SF-328 Used For? The SF-328 is a standardized government form used to collect information about an organization's foreign ownership, financial relationships, management arrangements, and other foreign interests. The information helps government agencies determine whether foreign persons or entities have the ability to influence a contractor in ways that could create national security concerns. The form addresses matters such as: - Direct and indirect foreign ownership - Foreign voting and governance rights - Foreign individuals serving in management positions - Certain foreign financial relationships - Foreign subsidiaries and business arrangements - Other circumstances that may create foreign influence The SF-328 is a disclosure document. Completing the form does not automatically mean a company is under unacceptable FOCI or requires a mitigation agreement. For a question-by-question walkthrough, see [How to Complete the SF-328: A Step-by-Step Guide](https://industryfso.com/blog/how-to-complete-sf-328). ## 1. Companies Applying for a Facility Clearance One of the most common situations requiring an SF-328 is the initial FCL process. Companies sponsored for an FCL under the National Industrial Security Program (NISP) must provide information about their ownership and control structure so DCSA can evaluate potential FOCI concerns. The SF-328 is part of that review. Importantly, **the requirement is not limited to companies that already have foreign investors**. A U.S.-owned company with no reportable foreign interests may still need to complete the form as part of its FCL application. The purpose is to allow DCSA to evaluate the company's foreign interests, including when the company believes none are present. Companies should not assume that an SF-328 is unnecessary simply because all known owners are U.S. citizens. ### When is it submitted? During the FCL process, DCSA provides instructions concerning the required documentation and submission procedures. The SF-328 is generally included with the applicable entity vetting and facility clearance documentation submitted through the National Industrial Security System (NISS). Companies should follow the instructions provided for their specific FCL package. ## 2. Cleared Contractors Experiencing Ownership Changes Companies that already hold an FCL may need to update their foreign interest disclosures when relevant ownership or control arrangements change. Examples include: - A foreign investor acquiring an ownership interest - An existing foreign shareholder increasing its investment - A merger or acquisition involving a foreign parent company - Changes in voting rights or board appointment authority - Corporate restructuring that changes indirect foreign ownership - New arrangements that provide foreign entities with management influence These changes may affect the company's FOCI status even if its classified contracts and day-to-day security operations remain unchanged. Under the NISPOM, cleared contractors have reporting obligations involving changes in ownership, control, and other relevant corporate circumstances. An updated SF-328 may be required depending on the nature of the change and DCSA's instructions. ### Should a company wait until an acquisition closes? Not necessarily. Certain proposed changes in ownership or control require advance reporting or coordination. For companies contemplating foreign investment or acquisition, it is important to evaluate the potential impact on their FCL before the transaction is completed. This can be especially important when the transaction may require FOCI mitigation or changes to the company's governance structure. For additional background, read [FOCI Mitigation Explained: How Companies Address Foreign Ownership Concerns](https://industryfso.com/blog/foci-mitigation-explained). ## 3. Companies With Existing FOCI Mitigation Agreements Companies operating under FOCI mitigation agreements may have additional disclosure and reporting responsibilities. Depending on the agreement, these companies may be required to report changes involving: - Foreign ownership interests - Parent-company relationships - Board composition - Corporate governance arrangements - Foreign affiliate operations - Financial or contractual relationships The applicable requirements depend on the mitigation instrument and the company's approved security arrangements. For example, a company operating under a Special Security Agreement (SSA) may have ongoing obligations involving its Government Security Committee (GSC), foreign affiliate relationships, and security plans. However, an existing mitigation agreement does not necessarily require a completely new SF-328 every time a minor corporate change occurs. Companies should evaluate the specific reporting requirements and coordinate with DCSA when appropriate. ## 4. Certain DoD Contractors Under Section 847 Section 847 of the FY2020 NDAA established a framework for evaluating foreign ownership risks among certain DoD contractors and subcontractors. Unlike traditional FOCI reviews associated with the FCL process, Section 847 also addresses contractors performing unclassified work. In May 2026, DoD published a proposed DFARS rule describing how additional foreign ownership disclosures and reviews could be incorporated into covered procurements. The proposal would require certain contractors and subcontractors associated with DoD contracts valued above $5 million to provide beneficial ownership and FOCI information, including an SF-328, subject to applicable exceptions. This could affect companies that have never applied for an FCL. However, **the May 2026 DFARS proposal should not be treated as an automatically effective requirement for every DoD contract exceeding $5 million**. Contractors must consider the status of the implementing rule, applicable exceptions, and the actual requirements of their solicitations and contracts. For more information, read [NDAA Section 847 Explained: What Government Contractors Need to Know](https://industryfso.com/blog/ndaa-section-847-explained). ## 5. Companies Responding to Government-Directed Foreign Interest Reviews Although the SF-328 is closely associated with DCSA and the NISP, other government programs may use the form or require similar foreign interest disclosures. A contractor may be asked to provide an SF-328 as part of a specific government security, eligibility, or ownership review. In these situations, the requirement comes from the applicable agency, program, solicitation, or contractual obligation. Companies should confirm: - Which agency or office is requesting the form - The applicable authority or program requirement - Which legal entity must complete it - Whether parent-company information is required - What supporting documentation must accompany the submission - Where and how the form must be submitted Not every SF-328 submission follows the same process used for DCSA facility clearance applications. ## Does Every Government Contractor Need an SF-328? No. There is no universal requirement that every company registered in SAM.gov or pursuing federal contracts must complete an SF-328. For example, a small business performing ordinary civilian-agency services without an FCL or another applicable foreign ownership disclosure requirement would not generally need to submit an SF-328 solely because it is a federal contractor. Likewise, registering a company in SAM.gov does not, by itself, create an SF-328 filing obligation. The requirement depends on the company's activities and the applicable government program. This distinction is particularly important for new government contractors that may be unfamiliar with industrial security requirements. ## Does Foreign Ownership Automatically Require an SF-328? Not necessarily. A company may have foreign shareholders without being subject to an independent SF-328 filing requirement. For example, a foreign-owned company performing commercial work or certain civilian-agency contracts may not need an SF-328 unless an applicable government requirement calls for one. Conversely, a company with no foreign ownership may still be required to complete the form during the FCL process. **The obligation to submit an SF-328 depends on the applicable security or contracting requirement, not simply whether foreign ownership exists.** Foreign ownership can also raise separate questions concerning small-business eligibility, export controls, supply chain restrictions, or other government contracting requirements. For a broader explanation, see [Can a Foreign-Owned Company Win U.S. Government Contracts?](https://industryfso.com/blog/foreign-owned-company-government-contracts). ## Does Every Subsidiary Need Its Own SF-328? Corporate families can present additional complexity. A parent company may own several subsidiaries, some of which hold FCLs while others do not. Determining which entities must submit an SF-328 depends on the applicable government process, corporate structure, and DCSA instructions. In certain circumstances, DCSA permits consolidated reporting arrangements for corporate families. However, companies should not assume that a parent's SF-328 automatically satisfies every subsidiary's disclosure obligations. Before submitting, confirm the required reporting entity, certification authority, and supporting documentation. ## How Often Does the SF-328 Need to Be Updated? There is no single annual renewal rule that applies to every SF-328 submission. For cleared contractors, updates may be necessary when reportable changes occur or when DCSA requests updated information. A new form revision also does not automatically require every cleared company to resubmit its SF-328. DCSA has clarified that companies are not required to submit an updated form solely because the form itself has been revised. Contractors should instead maintain accurate records and comply with applicable change-reporting requirements. This makes internal coordination especially important. An FSO may not learn about new investors, governance changes, or corporate restructuring unless the company's leadership and finance teams have established procedures for communicating those developments. ## SF-328 Requirements by Situation The following table summarizes common circumstances in which an SF-328 may be required. | Company situation | SF-328 requirement | | --- | --- | | Initial DCSA FCL application | Generally required | | Cleared contractor with a material ownership or control change | Updated disclosure may be required | | Company operating under FOCI mitigation | Updates may be required under applicable obligations | | Covered DoD contract under proposed Section 847 rules | Proposed requirement, subject to final implementation and exceptions | | Ordinary civilian-agency contract without other security requirements | Not automatically required | | SAM.gov registration | Not required solely for registration | | Foreign-owned company without an applicable government disclosure requirement | Not automatically required | | Government program specifically requesting an SF-328 | Required when applicable program instructions direct submission | The table provides general guidance. Contractors should follow the requirements applicable to their specific contracts, security programs, and government submissions. ## What Should a Company Do Before Completing an SF-328? If your company has been asked to submit an SF-328, begin by confirming the reason for the request. Understanding the applicable requirement helps determine which entity must complete the form and what supporting information is necessary. A practical preparation process includes: 1. **Confirm the requirement.** Identify whether the SF-328 is associated with an FCL, an ownership change, Section 847, or another government review. 2. **Identify the reporting entity.** Determine which company must certify the form and whether parent-company information is needed. 3. **Review ownership records.** Assemble current capitalization tables, organizational charts, and relevant corporate agreements. 4. **Evaluate foreign relationships.** Identify foreign investors, affiliates, governance rights, and other relationships addressed by the form. 5. **Prepare supporting documentation.** Follow the current SF-328 instructions for affirmative responses. 6. **Conduct a consistency review.** Compare the form with the company's underlying records before certification. 7. **Follow the appropriate submission procedure.** Confirm where and how the form must be submitted. For a more detailed walkthrough, see [How to Complete the SF-328: A Step-by-Step Guide](https://industryfso.com/blog/how-to-complete-sf-328). You may also find our article [Common SF-328 Mistakes and How to Avoid Them](https://industryfso.com/blog/common-sf-328-mistakes) helpful before submitting. ## Getting Help With SF-328 Requirements Understanding whether an SF-328 is required is often straightforward for companies undergoing an initial FCL application. Other situations can be more complicated, particularly when a company has foreign investors, multiple subsidiaries, or a pending acquisition. Industry FSO helps government contractors evaluate foreign ownership disclosure requirements, prepare SF-328 submissions, and coordinate with DCSA when appropriate. Our team also supports FOCI assessments, mitigation planning, and ongoing compliance. Learn more about our [FOCI consulting and SF-328 support services](https://industryfso.com/foci-consulting) or contact Industry FSO to discuss your company's requirements. ![](https://industryfso.com/hubfs/Website/Global%20images/Sarah%20Phillips.jpg) Article by ### Sarah Phillips President & Founder Sarah Phillips founded Industry FSO to make industrial security more accessible and manageable for defense contractors. With deep experience as a Facility Security Officer and a strong understanding of DCSA expectations, Sarah recognized that many small businesses lack the time and resources to manage an FCL on their own. [More articles](https://industryfso.com/insights/author/sarah-phillips) ## Browse more resources Check out more helpful FSO and FCL resources in our Insights section.  [All posts](https://industryfso.com/insights) #### [![When Do You Need a FOCI Attorney?](https://industryfso.com/hubfs/Website/Pages/Homepage/Pentagon.webp) October 20 2026 When Do You Need a FOCI Attorney? Foreign Ownership, Control, or Influence (FOCI) requirements can involve a combination of industrial security regulations, corporate governance, government contracting, and foreign investment law. FOCI SF-328](https://industryfso.com/insights/when-foci-requires-legal-counsel) #### [![How Much Does FOCI Consulting Cost? Rates & Fees](https://industryfso.com/hubfs/Website/Pages/Homepage/Pentagon.webp) October 20 2026 How Much Does FOCI Consulting Cost? Rates & Fees Companies facing Foreign Ownership, Control, or Influence (FOCI) requirements often have an immediate question: How much will it cost to get help? FOCI SF-328](https://industryfso.com/insights/foci-consulting-cost) #### [![FOCI Consultant vs. Attorney: Which Do You Need?](https://industryfso.com/hubfs/Website/Global%20images/Pentagon-aerial-image.jpg) October 20 2026 FOCI Consultant vs. Attorney: Which Do You Need? When a government contractor encounters Foreign Ownership, Control, or Influence (FOCI) requirements, one of the first questions is often whether to hire a law firm or a specialized FOCI consultant. FOCI SF-328](https://industryfso.com/insights/foci-consultant-vs-attorney) [![logo-light](https://industryfso.com/hubfs/Website/Logos/logo-light.svg)](https://industryfso.com) Women-Owned **Services** - [Overview](https://industryfso.com/services) - [FSO Services](https://industryfso.com/fso-services) - [FCL Support](https://industryfso.com/fcl-formation) - [DCSA Review Prep](https://industryfso.com/dcsa-security-reviews) - [FOCI](https://industryfso.com/foci-consulting) **About** - [About Us](https://industryfso.com/about-us) - [Insights](https://industryfso.com/insights) **Contact** - [Contact Us](https://industryfso.com/contact) - [(703) 389-3043](tel:+17033893043) --- © 2026 Industry FSO - [Privacy Policy](https://industryfso.com/privacy-policy) Website by [Blend](https://www.blendb2b.com/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Sarah Phillips", "url" : "https://industryfso.com/insights/author/sarah-phillips" }, "dateModified" : "2026-10-20T13:59:56.095Z", "datePublished" : "2026-10-20T13:59:56.000Z", "headline" : "Who Needs an SF-328? When It's Required", "image" : [ "https://industryfso.com/hubfs/Website/Pages/Homepage/Pentagon.webp" ], "mainEntityOfPage" : { "@id" : "https://industryfso.com/insights/who-needs-sf-328", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://industryfso.com/hubfs/Website/Global%20images/Logo.svg" } } } ``` ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Richmond", "addressRegion" : "VA" }, "areaServed" : "US", "contactPoint" : [ { "@type" : "ContactPoint", "contactType" : "Customer Support", "email" : "hello@industryfso.com", "telephone" : "+1-202-350-1766" } ], "description" : "Industry FSO delivers outsourced Facility Security Officer (FSO) services, DCSA security review preparation, and Facility Clearance (FCL) setup for U.S. defense contractors.", "employee" : [ { "@type" : "Person", "jobTitle" : "President", "name" : "Sarah Phillips", "url" : "https://www.linkedin.com/in/sarvphillips/" }, { "@type" : "Person", "jobTitle" : "Vice President", "name" : "David Waiter", "url" : "https://www.linkedin.com/in/davidwaiter/" } ], "founder" : { "@type" : "Person", "jobTitle" : "President", "name" : "Sarah Phillips", "url" : "https://www.linkedin.com/in/sarvphillips/" }, "foundingDate" : "2024", "foundingLocation" : { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Richmond", "addressRegion" : "VA" } }, "keywords" : "FSO, Facility Security Officer, DCSA review, Facility Clearance, FCL setup, outsourced FSO services", "logo" : "https://industryfso.com/hs-fs/hubfs/Industry-FSO-logo%20(5)-1.png", "name" : "Industry FSO", "sameAs" : [ "https://www.linkedin.com/company/industry-fso" ], "url" : "https://industryfso.com/" } ```