CMMC subcontractor requirements are not just a subcontractor problem. If you are a prime contractor or a Tier 1 supplier that shares Controlled Unclassified Information (CUI) with lower-tier vendors, fabricators, or service providers, your own CMMC certification and contract standing are directly affected by how well you manage those flow-downs.
This post covers the 5 critical obligations that prime contractors and upper-tier suppliers must address when CUI flows beyond their own four walls.
What Are CMMC Flow-Down Requirements?
When the DoD awards a contract that includes DFARS 252.204-7012 and CMMC requirements, the prime contractor is responsible not only for its own compliance, but for ensuring that any subcontractor it shares CUI with also meets those requirements.
This is called a flow-down obligation. The prime passes the DFARS and CMMC clauses down to its subs, who must then comply independently. Each subcontractor that receives CUI must have its own SPRS score, its own SSP, and, if the work requires CMMC Level 2, its own C3PAO assessment.
The prime cannot certify its subcontractors. Each organization must achieve certification independently.
Relevant resource: DFARS 252.204-7012 Flow-Down Requirement, DoD
Which Contracts Trigger Flow-Down Obligations?
Flow-down requirements are triggered whenever a prime contractor holds a contract with DFARS 252.204-7012, 7019, or 7020 clauses and shares or transmits CUI to a subcontractor as part of the performance of that contract.
If a subcontractor performs work that does not involve CUI, such as a landscaping company, a legal firm reviewing non-technical documents, or a courier, the flow-down requirements do not apply. The trigger is CUI, not the existence of a subcontract.
5 Critical Subcontractor CMMC Obligations for Primes
Obligation 1: Include CMMC Clauses in Subcontract Language
Prime contractors are contractually required to include the applicable DFARS clauses in their subcontract agreements. If your subcontract does not include DFARS 252.204-7012 (and 7019/7020 where applicable), you are out of compliance with your prime contract, regardless of whether the sub is actually compliant.
Review your current subcontract templates. If your standard vendor agreement does not include these clauses, update it before the next contract award.
Obligation 2: Verify Subcontractor SPRS Scores Before Award
Under DFARS 252.204-7020, prime contractors are required to verify that subcontractors handling CUI have a current SPRS score on file before awarding a subcontract. This is a documented obligation, not an informal best practice.
Build SPRS score verification into your subcontractor onboarding process. Request confirmation of the score, ask for the date of the most recent assessment, and document that you verified it.
Obligation 3: Confirm CMMC Level Requirements Match the Work
Not every subcontractor needs CMMC Level 2. If a sub only handles Federal Contract Information (FCI) and not CUI, CMMC Level 1 may be sufficient. If a sub receives, stores, or processes CUI as part of the work, Level 2 is almost certainly required.
Categorize each subcontractor by the type of data they receive. Document your reasoning. This categorization forms part of your own CMMC assessment documentation when the assessor reviews your supply chain oversight practices.
Obligation 4: Do Not Flow CUI to Subcontractors Using Non-Compliant Systems
If a subcontractor is not yet CMMC-compliant, flowing CUI to them creates a compliance gap in your own environment. Your SSP's data flow diagrams will show CUI leaving your boundary and entering an uncertified environment. That is an assessor finding.
Options when a preferred sub is not yet compliant:
- Delay the subcontract until the sub achieves compliance
- Withhold CUI from that sub and have them perform only non-CUI tasks
- Provide a compliance roadmap and timeline as a condition of contract award
Obligation 5: Maintain Records of Subcontractor Compliance Verification
Your compliance verification activities must be documented and retained. This includes the date you verified the sub's SPRS score, the score value at the time of verification, any certifications or letters of attestation from the sub, and any corrective action plans for subs with low scores.
If your prime contract is audited or if a False Claims Act action is initiated, these records are what demonstrate your due diligence as a prime.
What Happens When a Subcontractor Is Not CMMC Compliant?
If a DoD audit or a C3PAO assessment finds that a prime contractor flowed CUI to a non-compliant subcontractor, the prime faces:
- Findings against their own CMMC certification
- Potential DFARS clause violation triggering contract remedies
- False Claims Act liability if the prime attested to supply chain compliance that did not exist
The Civil Cyber-Fraud Initiative specifically targets primes that make compliance representations in bids, proposals, or affirmations that their supply chain due diligence does not support.
How to Build a Supply Chain Compliance Program
A supply chain CMMC compliance program does not need to be elaborate for most mid-size manufacturers. At minimum it should include:
| Program Element | What It Requires |
|---|---|
| Subcontractor CUI inventory | Know which subs receive CUI and what type |
| SPRS verification process | Documented check at onboarding and annual review |
| Subcontract clause library | Standard DFARS flow-down language in templates |
| Non-compliant sub protocol | Written policy for handling subs below threshold |
| Compliance records retention | Minimum 3-year retention of verification records |
Telco United helps prime contractors and upper-tier suppliers build supply chain compliance programs aligned with CMMC and DFARS requirements. Contact our team to get started.