CMMC Flow-Down Requirements

Most companies in the defense supply chain discover these requirements not from DoD but from a customer — a clause appearing in a subcontract, or a supplier questionnaire asking for an SPRS score. Flow-down is the mechanism, and it works in both directions: primes have to impose and verify, subs have to comply and evidence.

The obligation does not dilute as it descends. A tier-three supplier handling the same technical data package owes the same safeguarding as the prime that sent it. What does change is leverage — and the practical question of who absorbs the cost when a supplier cannot meet the bar.

How flow-down works

DFARS 252.204-7012 requires a contractor to include the clause in subcontracts where the subcontractor will handle covered defense information or provide operationally critical support. The prime does not get to decide that the requirement is inconvenient; it is a term of its own contract.

Two consequences follow that catch people out. First, the determination of whether a subcontractor is in scope rests on what information they will actually receive, which means someone has to think about it deliberately rather than flowing everything down by default. Second, over-flowing is a real cost: imposing Level 2 obligations on a supplier who only ever sees a purchase order pushes cost into your supply chain for no security benefit.

For subcontractors: what you owe

If the clause is in your subcontract, you owe the same things a prime owes: safeguard covered defense information to NIST SP 800-171 Revision 2, report cyber incidents within 72 hours, and where 7019 and 7020 apply, self-assess and post a score to SPRS.

Three practical points:

• You are in scope even with no DoD contract. Your customer’s obligation reaches you through the terms they impose.
• Your scope is set by what you receive. If a prime sends drawings by email, your mail platform is in scope. If they give you portal access and you never download, it may not be. That is worth negotiating before work starts, not after.
• Your own suppliers may be in scope too. Send a drawing to a plating shop or a calibration house and flow-down continues through you.

Start with the clause test, then trace where the information lands.

For prime contractors: what you must impose

Three obligations, in increasing order of difficulty.

Include the clause where the subcontract involves covered defense information. Mechanical, but it requires someone to make the scoping call per supplier.

Decide what each supplier actually needs. This is the lever most primes underuse. A supplier who receives a redacted drawing, or works from a specification rather than a technical data package, may fall out of scope entirely. Reducing what you send is cheaper than funding a compliance programme.

Verify rather than assume. Which brings us to SPRS.

Checking a supplier in SPRS

The Supplier Performance Risk System is where assessment scores are posted under DFARS 252.204-7020, and it is the practical tool a prime uses to check a supplier’s posture. What you can see is the score, the standard assessed against, the date, and the scope the supplier declared.

Read all four, not just the number. A score of 95 assessed eighteen months ago against a scope that excluded the systems now handling your drawings is worth less than a candid 60 assessed last month against the right boundary. The date and the scope are where the useful signal is.

And treat an implausibly perfect score as a question rather than an answer. Given the methodology deducts up to 313 points, a first-time 110 is unusual enough to merit a conversation about how it was reached. See how scoring works.

Logistics and 3PLs: flow-down from several directions

Third-party logistics providers and freight forwarders occupy an awkward position: they sit deep in the supply chain and receive flow-down from multiple primes at once, each with its own interpretation of what is in scope.

The information they hold is usually different in kind from a machine shop’s — shipment and routing data, delivery schedules against defense programmes, sometimes transportation data with its own controls. It is less obviously “technical” and therefore more often overlooked in scoping, while still meeting the definition.

For a provider serving several primes, the practical approach is a single boundary built to the strictest requirement imposed on you, rather than attempting to compartmentalise per customer. Compartmentalisation sounds cheaper and almost never is.

When a supplier cannot comply

This is the conversation nobody wants and everyone eventually has. Four options, in rough order of preference:

1. Reduce what they receive until they are out of scope. Cheapest for both sides where the work allows it.
2. Help them get there. Some primes fund or subsidise supplier compliance where the relationship justifies it. Cheaper than requalifying a specialist source.
3. Bring the work in-house where you have the capability.
4. Move the work. Last resort, particularly where the supplier holds qualification or tooling that would take a year to replace.

What is not an option is flowing the clause down, receiving no evidence, and treating silence as compliance. That leaves the risk with you and the representation with them.

One supplier category deserves separate handling: the IT provider who administers your environment holds the keys to the enclave whether or not the clause reached their contract. See CMMC for IT providers and MSPs.

The clause that carries these obligations down the chain is covered in DFARS 252.204-7012 requirements. Suppliers holding only FCI should check the CMMC Level 1 requirements instead.