Foreign Ownership, Control, or Influence — FOCI — has been a feature of the U.S. industrial security landscape since the National Industrial Security Program Operating Manual was first promulgated in the 1990s. For most of its history, FOCI was a paperwork exercise: a Foreign Ownership disclosure, a Special Security Agreement, a Proxy Agreement if needed. Closing a transaction with a cleared U.S. defense subsidiary required attention to FOCI; it rarely required substantial business model surgery. That has changed. In 2026, FOCI is no longer a paperwork exercise. It is increasingly the question on which transactions live or die.

Three forces are reshaping the calculus simultaneously: the Defense Counterintelligence and Security Agency's elevation of FOCI as an enforcement priority, the Committee on Foreign Investment in the United States' tightened scrutiny of even small defense-adjacent acquisitions, and a wave of private-equity-backed defense roll-ups that put unfamiliar capital structures in front of regulators who have grown skeptical of them.

The DCSA Posture

DCSA, under the Office of the Director of National Intelligence's continued attention on industrial security gaps, has tightened FOCI mitigation acceptance standards meaningfully since 2024. The 32 CFR Part 117 National Industrial Security Program Operating Manual remains the governing rule, but enforcement practice has evolved (32 CFR Part 117, 2024).

What used to be acceptable mitigation — a Special Security Agreement with a Government Security Committee and quarterly reporting — increasingly does not pass for transactions involving controlled unclassified information, suppliers in the defense industrial base, or any classified workshare. DCSA is requiring Proxy Agreements (the most restrictive form of FOCI mitigation) in transactions that two years ago would have closed under an SSA.

CFIUS: From Headlines to Mid-Cap

CFIUS' high-profile interventions — Nippon Steel's blocked acquisition of U.S. Steel, the unwinding of investments in semiconductor manufacturing — set the public tone. The less visible shift is in mid-cap M&A. CFIUS has expanded mandatory filing requirements to cover essentially any transaction involving a U.S. business with TID (Technology, Infrastructure, Data) characteristics, and the Committee's appetite for prolonged review on transactions involving Chinese, Russian, or Gulf capital sources has grown (U.S. Department of the Treasury, 2025).

The implication for defense M&A is structural: deal teams must build CFIUS readiness into the diligence phase, not the closing phase. A buyer whose limited partner base includes a sovereign wealth fund from a country on the CFIUS scrutiny list now faces a meaningful probability of mitigation requirements, extended review, or outright divestment orders.

The PE-Backed Defense Roll-Up Wave

Private equity's appetite for defense roll-ups has not slowed — if anything, the 2024–2026 environment of multi-year procurement growth, dramatic backlog visibility, and high cash-flow profiles has accelerated PE entry. Veritas Capital, Arlington Capital, and AE Industrial Partners continue to be the most active sponsors, with a long tail of mid-market firms behind them.

What changed is regulator posture. FOCI reviewers and CFIUS staff have grown experienced with the LP structures, GP-LP dynamics, and capital flows of private equity, and they no longer treat 'U.S.-headquartered fund' as a clean indicator. A Delaware LP with limited partners in Singapore, Norway, the UAE, and Canada is now scrutinized on the underlying limited partners, the side-letter rights, and the governance influence — not just the fund's headquarters.

The practical effect: PE-backed defense acquisitions in 2026 must demonstrate FOCI compliance in the same level of detail that a strategic acquirer would, with the added burden of explaining LP structures that DCSA was not trained to parse five years ago (Congressional Research Service, 2025).

The New Mitigation Playbook

Proxy Agreements Are Back

Proxy Agreements — under which a board of cleared U.S. proxy holders exercises all voting rights over the U.S. subsidiary — were used sparingly in the 2010s. They are now the default mitigation for any transaction involving meaningful foreign capital in a classified workshare environment. Proxy boards require careful selection: members must be cleared, must have substantial defense industry experience, and must be insulated from the foreign parent's influence.

Information Barriers and Technology Control Plans

Technology Control Plans, mandated under SSAs and Proxy Agreements, are now subject to ongoing DCSA audit. Companies that drafted TCPs in 2018 and have not refreshed them are exposed. Audit findings are increasingly published and shared across cleared facility sponsors (DCSA Industrial Security Letters, 2025).

Continuous Vetting

DCSA's Continuous Vetting program now covers virtually all cleared personnel. Continuous Vetting changes M&A diligence: a buyer must assess not only the target's current FOCI posture but the realistic CV outcomes for the post-close workforce, including foreign-national engineers, dual citizens, and personnel with significant foreign travel patterns.

What Acquirers Should Do Now

• Build FOCI readiness into diligence: treat FOCI as a transaction-killer in the same way you treat material adverse change clauses. Map LP structures and identify mitigation needs before signing.
• Pre-clear proxy board candidates: the bench of cleared, experienced U.S. defense executives willing to serve as proxy directors is finite. Pre-identify and pre-clear candidates.
• Refresh Technology Control Plans every 24 months: DCSA's tolerance for stale TCPs is gone. Treat refresh as a calendar obligation, not an event-triggered task.
• Engage CFIUS counsel pre-LOI: structuring is harder after signing. CFIUS-experienced counsel should be in the room when the term sheet is drafted, not the SPA.

Cross-Border Capital and the New Normal

The post-2024 defense M&A environment has revealed a structural shift in how capital flows through the industrial base. Sovereign wealth funds from Norway, Saudi Arabia, the UAE, and Singapore have grown substantial limited partner positions in U.S. private equity funds — including funds active in defense roll-ups. The capital is welcome; the regulatory implications are not yet fully internalized by sponsors who built their LP base in a more permissive era.

DCSA and CFIUS reviewers now routinely request side-letter provisions, governance rights documentation, and LP-level transparency that was not standard practice in 2018. The result is a meaningfully longer diligence process for any transaction involving a fund with cross-border LP exposure. Sponsors who structured funds to minimize LP-level transparency are now confronting deals that require them to expose precisely the information their fund structure was designed to obscure (Congressional Research Service, 2024).

Sponsor Concentration Risk in the DIB

A specific feature of the 2026 defense M&A landscape is sponsor concentration. The same handful of PE sponsors — Veritas, Arlington, AE Industrial — own substantial portions of the Tier-2 and Tier-3 defense industrial base. When a single sponsor's portfolio spans dozens of qualified suppliers, the operational risk profile of that sponsor becomes a national security question. A liquidity event at one of these sponsors triggers governance, FOCI, and operational continuity considerations that span the industrial base.

The DoD has not yet articulated a formal sponsor-concentration policy, but informal regulatory pressure is building. Sponsors with concentrated DIB portfolios are increasingly being asked to demonstrate succession planning, fund-of-funds insulation, and operational continuity arrangements that the original transactions did not require.

Practical Mitigations: What Works in 2026

The FOCI mitigation toolkit has expanded substantially in the past two years. Beyond the traditional SSA, Proxy Agreement, and Voting Trust frameworks, DCSA now routinely accepts hybrid mitigation structures that combine governance controls with operational segregation. Information barriers — long a feature of cross-border financial services — have crossed into defense governance, with cleared U.S. management teams operating insulated from foreign-influence-bearing capital structures.

Successful mitigation packages share three features: cleared U.S. operational leadership with substantive authority over classified workshare; transparent LP-level reporting that allows DCSA continuous oversight; and credible exit mechanisms in the event of an LP-level change of control. Sponsors that can deliver all three close transactions in the current environment. Those that cannot find themselves owning assets they cannot sell.

Trust Is Now an Operating Cost

The shift in FOCI enforcement is not an aberration. It reflects a broader policy view, bipartisan and durable, that the defense industrial base must be insulated from foreign influence at a level of granularity that was not deemed necessary fifteen years ago. The cost of operating a cleared U.S. defense business in 2026 includes continuous compliance investment that was once treated as one-time legal expense. The acquirers, sponsors, and operators who internalize this reality will continue to close deals. Those who treat FOCI as a check-the-box exercise will increasingly find themselves owning untransactable assets. Trust is no longer assumed in defense M&A. It is earned, mitigated, audited, and paid for.