On this page
Why subcontractors cannot ignore CMMC
CMMC is not only a prime-contractor issue. The rule applies across the supply chain where contractors and subcontractors will process, store, or transmit FCI or CUI during contract performance. The flowdown obligation is built into the DFARS clause structure and the program rule.
That is why suppliers, machine shops, engineering subs, and manufacturers often run into CMMC before they expected to. A prime asks questions, a subcontract references the clause, or a buyer suddenly asks for proof of current status in SPRS.
How flowdown works in practice
The prime does not just copy its own level everywhere. The requirement has to fit the subcontract and the information that will actually be processed, stored, or transmitted. If the subcontract only involves FCI, the requirement may be Level 1. If the subcontract will involve CUI, the requirement can move to Level 2 or higher depending on the program requirement.
The key discipline for primes is making the information flow explicit. The key discipline for subs is asking which information type they will actually receive and on which systems it will be handled.
The COTS issue
The DFARS clauses include important exclusions for solicitations or contracts solely for commercial off-the-shelf items. That is relevant, but companies should be careful not to over-apply the COTS idea where the work actually involves handling FCI or CUI on contractor systems during performance.
In other words, a company should not assume that because it sells a commercial product line somewhere in the business, its defense work is automatically outside the clauses.
What primes should ask suppliers
- Will this supplier process, store, or transmit FCI or CUI during performance?
- Which systems will be used for that work?
- What CMMC level and assessment type does the subcontract need to flow down?
- Does the supplier have a current CMMC status and annual affirmation where required?
- Are there cloud or external-service dependencies that affect the supplier’s scope?
What suppliers should ask primes
- What information category will we receive: FCI, CUI, or both?
- Which clause and level apply to our subcontract?
- Will our assessment path be self-assessment or C3PAO?
- Which business workflows are actually expected to handle the information?
- Are we expected to use a customer environment, our own environment, or a shared enclave?
Frequently asked questions
Does CMMC apply to subcontractors?
Yes. The rule and clauses apply throughout the supply chain where subcontractors will process, store, or transmit FCI or CUI on contractor systems during performance.
Do all subcontractors need the same level as the prime?
No. The flowed-down level should match the subcontract’s information handling and contract requirement.
If we only receive FCI, do we need Level 2?
Not necessarily. FCI-only work aligns with Level 1. Level 2 is tied to protecting CUI.
If we receive CUI from the prime, do we need Level 2?
Typically yes, if the subcontract requires handling CUI on your contractor systems during performance. The exact level and assessment type come from the subcontract requirement.
Do primes need to verify subcontractor status?
They need to flow down the applicable requirement correctly, and contracting processes will rely on current status for award where required.
Are COTS-only contracts excluded?
The DFARS framework includes exclusions for solicitations or contracts solely for COTS items, but companies should read the clause language carefully and not assume an exclusion where the work actually involves handling FCI or CUI.
Can a supplier use the prime’s enclave or system?
Possibly. The practical answer depends on how the work is structured, where the information lives, and which environment is actually in scope.
What is the first thing a supplier should do?
Confirm what information it will handle and on which systems. That determines the level, scope, and assessment path.
Related articles
Official sources reviewed
Contract language, current regulations, and official CMMC program guidance control.
Want help turning this into a real readiness plan?
Velocity CMMC can scope the environment, map CUI flows, organize the documentation package, support remediation, and help your team prepare for the right assessment path without pretending to be the certifier.