CMMC Flow-Down to Subcontractors: What Primes Must Require

FCI vs CUI Determines the Floor

As of September 2026, Phase II suspension means new designations are typically Level 1 (Self) or Level 2 (Self) only — but existing contract language and DFARS 7012 safeguarding still apply. See timeline.

What Primes Typically Flow

• Applicable DFARS 252.204-7012 safeguarding and 72-hour cyber incident reporting
• SPRS / assessment reporting expectations tied to 7019 / 7020 / 7021 as in the prime contract
• Required CMMC level and assessment type matching the subcontract’s information
• Cooperation for prime or government assessment access
• Notification when the sub cannot meet Conditional POA&M closeout timelines (180 days where Conditional status applies)

Practical Steps

1. Inventory which subs touch FCI/CUI (including MSPs).
2. Map each to Level 1 vs Level 2 vs out-of-scope.
3. Collect SSP summaries / SPRS status where contracts require.
4. Track annual affirmations and assessment expiration (L2 assessment cadence every 3 years with annual affirmation).

How CyberSilo Helps

• CSA workspaces for prime and sub evidence tracking
• Shared requirement IDs so flow-down questionnaires map to 800-171 families
• ThreatHawk for logging where the prime samples sub / ESP telemetry

Frequently Asked Questions

Must every subcontractor get Level 2 C3PAO?

No. Level depends on information type and what the solicitation/contract designates. During Phase II suspension, requiring activities may designate only Level 1 (Self) or Level 2 (Self).

Does flow-down apply to MSPs?

Yes when they process, store, or transmit FCI/CUI or provide security protection for those systems. Document shared responsibility.

What if a sub fails Conditional closeout?

Conditional CMMC status (where allowed for L2/L3) requires POA&M closeout within 180 days of the Conditional CMMC Status Date. Missed closeout threatens status — primes should require early notice.

Related CMMC Resources

CMMC hub · DFARS clauses · SPRS · Small business · POA&M