Flow-Down Clauses: How to Track Subcontractor CMMC Compliance

DFARS Clause 252.204-7021 doesn’t just apply to prime contractors. It flows down to every subcontractor in the supply chain that handles Federal Contract Information or Controlled Unclassified Information in performance of the work. For primes, this creates a compliance management obligation that extends beyond your own walls—and into relationships you may have limited visibility into.

Here’s how to build a practical subcontractor CMMC tracking program that satisfies your flow-down obligations without overwhelming your contracts team.

What the Flow-Down Obligation Actually Requires

Under DFARS 7021, a prime contractor must include the CMMC clause in every subcontract or purchase order where the subcontractor will process, store, or transmit FCI or CUI in performance of the work. The clause flows the applicable CMMC level requirement to the sub—not necessarily the same level as the prime. The level depends on the type of information the sub handles for their specific work scope.

This means the prime’s obligation is twofold: first, to identify which subs handle government data and what kind; second, to flow the appropriate CMMC clause into those subcontracts and verify that subs meet the requirement before they perform work involving government data.

Primes who don’t perform this due diligence face the same False Claims Act exposure as contractors who misrepresent their own compliance. If a prime certifies compliance with DFARS 7021 while knowing their subs aren’t compliant, that’s a problem.

Step 1: CUI Data Flow Mapping Across Your Supply Chain

Before you can manage subcontractor compliance, you need to know which subs actually handle CUI. This requires a data flow mapping exercise for each prime contract: trace where CUI originates, which subcontractors receive it, and what they do with it.

Common scenarios where subs unexpectedly touch CUI: engineering subcontractors who receive technical specifications (often CUI); IT service providers who have remote access to systems processing CUI; professional services firms who receive proposal data that includes program details; and translation or documentation subcontractors who receive technical documents.

For each identified sub, document: which prime contracts they support, what CUI categories they handle, and what CMMC level applies to their work.

Step 2: SPRS Verification and Contractual Requirements

For every sub identified as handling CUI, verify that they have a current SPRS entry reflecting the required CMMC Status. Primes have access to SPRS to check subcontractor scores.

Beyond SPRS verification, the contract with each sub needs to include the CMMC clause with the applicable level requirement. Existing subcontracts without this clause need to be modified before those subs perform any CUI-related work. New subcontracts need the clause from the beginning.

Step 3: Building a Tracking System

A practical subcontractor CMMC tracking system doesn’t need to be sophisticated, but it does need to be systematic. At minimum, maintain a register that includes: sub name, applicable prime contracts, CUI types handled, required CMMC level, current SPRS score, score submission date, and date your subcontract includes the CMMC clause.

Review this register quarterly: check for SPRS score changes, identify subs whose scores are approaching expiration (assessments more than three years old), and flag subs whose scores fall below the required threshold.

Managing Compliance Issues in the Supply Chain

When a subcontractor’s SPRS score falls below the required level or their CMMC Status lapses, you have a compliance management decision to make. Options include: allowing the sub a remediation period before performing further CUI work; suspending the sub from CUI-related work until compliance is restored; or replacing the sub with a compliant alternative.

The right answer depends on the criticality of the sub to program performance and the nature of the compliance gap. Documenting your decision and the basis for it is important regardless of which path you take.

For large prime contractors managing hundreds of subcontractors, a vendor management platform with compliance tracking capabilities can automate much of this monitoring. For smaller primes, a well-maintained spreadsheet and calendar-based review process is sufficient.

Learn how VSO supports defense contractors with CMMC program management or contact us to discuss your supply chain compliance program.

Frequently Asked Questions

Are all subcontractors subject to CMMC flow-down requirements?

Only subcontractors who will process, store, or transmit FCI or CUI in performance of the work. Subs providing goods or services that don’t involve government information (office supplies, facility maintenance) are not subject to CMMC flow-down. The determination is based on whether government data flows to the sub.

What CMMC level must I flow down to my subcontractors?

The level depends on the type of information the sub handles for their specific work scope—not the prime’s level. A sub that only handles FCI needs Level 1; a sub handling CUI needs Level 2. The prime is responsible for making this determination based on the work the sub performs.

Can I verify my subcontractor’s CMMC Status independently?

Yes. SPRS is accessible to authorized users including prime contractors for the purpose of verifying subcontractor compliance. You can check a sub’s SPRS score and CMMC Status as part of your flow-down compliance verification.

What happens if my subcontractor fails a C3PAO assessment?

If a sub’s CMMC Status lapses due to assessment failure, they cannot perform work involving CUI until their status is restored. The prime needs to either suspend the sub from CUI-related work or find an alternative. This is a program performance risk that should be identified and managed proactively.

Do I need to audit my subcontractor’s actual controls, or is their SPRS score sufficient?

For most CMMC purposes, a current SPRS score with the required CMMC Status is sufficient verification. However, primes with higher-sensitivity programs may conduct additional due diligence including reviewing subs’ SSPs or requiring attestation letters. The level of verification should be proportionate to the sensitivity of the CUI the sub handles.