Most companies in the defense supply chain never hold a contract with DoD. They hold a purchase order or subcontract from a prime or a higher-tier supplier, and they discover their obligations when a clause appears in that document or a supplier questionnaire asks for an SPRS score.
This page is the operational view from the subcontractor's desk: what you owe, to whom, and what your customer is entitled to check. The mechanics of how the clauses flow, and what primes must impose, are on the parent guide to CMMC flow-down requirements.
Which clauses reach you, and what each one means
| Clause | What it requires of a subcontractor |
|---|---|
| DFARS 252.204-7012 | Implement NIST SP 800-171 for covered defense information, report cyber incidents within 72 hours, preserve images and malware, use FedRAMP Moderate or equivalent cloud for CUI, and flow the clause further down |
| DFARS 252.204-7019 | Hold a current NIST SP 800-171 assessment — no more than three years old — posted in SPRS |
| DFARS 252.204-7020 | Give DoD access for Medium or High assessments, and ensure your own subs have current assessments before you award to them |
| DFARS 252.204-7021 | The CMMC clause. The September 2026 class deviation directs contracting officers to remove CMMC assessment requirements for now |
| FAR 52.204-21 | Fifteen basic safeguarding requirements for Federal Contract Information — the basis of CMMC Level 1 |
If you handle only Federal Contract Information and no CUI, your baseline is FAR 52.204-21 and CMMC Level 1. If CUI reaches you, you are in NIST SP 800-171 territory and the Level 2 requirements are your target.
The obligation does not shrink as it flows down
A tier-three machine shop holding the same technical data package as the prime owes the same safeguarding for it. There is no reduced version of NIST SP 800-171 for small suppliers. What differs is scope: a subcontractor that keeps CUI inside a small, well-defined boundary can meet the full standard at a fraction of the cost of one that lets drawings spread across its whole network. See how to find CUI in your own systems.
What your prime will ask for
- Confirmation that a current assessment is posted in SPRS, and often the score and date.
- Whether you hold CUI, FCI or neither for the work in question.
- Your incident reporting contact and confirmation that you hold a medium assurance certificate for DoD reporting.
- Whether your cloud services meet the FedRAMP Moderate or equivalent standard.
- Increasingly, a copy of your SSP summary or a completed security questionnaire.
Primes can see in SPRS whether a supplier has a current assessment and its score. Under DFARS 252.204-7020 they may not award a subcontract that requires NIST SP 800-171 to a supplier without one. That makes SPRS the practical gate for subcontract awards — see how the SPRS score works.
Incident reporting runs in two directions
Under 252.204-7012 a subcontractor reports cyber incidents affecting covered defense information directly to DoD through the DIBNet portal within 72 hours of discovery, and also provides the incident report number to the prime as soon as practicable. That means a subcontractor needs its own medium assurance certificate and its own incident response capability, not a reliance on the prime's. The requirement is covered in detail in the DFARS 252.204-7012 guide.
Practical steps for a subcontractor
- Read every active subcontract and purchase order for 7012, 7019, 7020, 7021 and FAR 52.204-21.
- Identify exactly which data you receive from customers and whether it is marked or should be treated as CUI.
- Define a boundary that keeps CUI in as few systems as possible.
- Complete a self-assessment against the 110 requirements and post the score to SPRS.
- Write the SSP and a POA&M for anything not yet implemented.
- Flow the same clauses to any of your own suppliers who receive CUI.
Frequently asked questions
Do subcontractors need their own SPRS score?
Yes, where the subcontract requires NIST SP 800-171. Each company posts its own assessment; a prime's score does not cover its suppliers.
Can a prime share its CUI environment with us?
Some primes provide access to their own enclave so the subcontractor never stores CUI locally. If the work genuinely stays inside the prime's environment, your scope shrinks accordingly. Document the arrangement.
Does the CMMC suspension change what subcontractors owe?
It removes third-party CMMC assessment requirements for now. It does not remove DFARS 252.204-7012, 7019 or 7020, which remain in force and flow down as before.