Understanding CMMC for subcontractors starts with one fact: your prime contractor is required by contract to pass the requirement down to you in writing. Most small subcontractors first hear about it when they receive a flowdown clause buried in a teaming agreement or subcontract. By then, the award timeline is already moving.
This post is for owners and IT managers at small businesses that support DoD primes - engineering firms, IT services companies, staffing agencies, and others who touch government contract work at any tier. Here is what the requirement means for you and the questions to ask before you sign anything.
How the Flowdown Clause Reaches You
DFARS 252.204-7021 is the contract clause primes must insert into subcontracts where the subcontractor will process, store, or transmit FCI or CUI. The only explicit exception is commercially available off-the-shelf (COTS) items. If you write code, handle technical documentation, provide IT support, or manage data on behalf of a prime, you are almost certainly in scope.
This means you can be two or three tiers below the prime and still carry a CMMC obligation. Your direct customer may not be the DoD, but if they pass government contract data to you, the requirement follows that data. Before awarding a subcontract, the prime must ensure the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information being flowed down.
FCI vs. CUI: The Distinction That Sets Your Level
Getting your required CMMC level right starts with two definitions. FCI - Federal Contract Information - is information provided by or generated for the government under a contract that is not intended for public release. Think deliverable files, statements of work, invoices, and technical data you produce specifically for the contract.
CUI - Controlled Unclassified Information - is information that requires safeguarding under specific laws, regulations, and government-wide policies. CUI is a designated category; not all contract data qualifies, but when it does, the requirements are stricter. The practical test: if your prime marks documents or files with a CUI designation banner, that is CUI. Everything else tied to the contract and not publicly available is likely FCI at minimum.
CMMC for Subcontractors: Levels and Assessment Types
CMMC has three levels. Level 1 covers FCI only and requires a self-assessment. Level 2 covers CUI and allows either a self-assessment or a third-party assessment by a C3PAO - CMMC Third-Party Assessment Organization - depending on what the prime contract specifies. Level 3 applies to CUI in elevated-risk programs and requires an assessment by the DIBCAC, the Defense Industrial Base Cybersecurity Assessment Center.
The split within Level 2 is where small subcontractors often get caught. If the prime contract requires Level 2 (C3PAO), the subcontractor must also achieve Level 2 (C3PAO) at minimum - a self-assessment will not satisfy that requirement. Level 2 encompasses the security requirements for CUI specified in NIST SP 800-171 Rev 2, covering areas like access control, incident response, configuration management, and audit logging. Your required level depends on what data you actually receive, not on the prime's overall contract level.
What Your Prime Will Verify Before Award
Before awarding a subcontract, the prime must confirm two things. First, that you hold a current CMMC certificate or CMMC status posted in SPRS - the Supplier Performance Risk System. Second, that you are maintaining annual affirmations of continuous compliance in SPRS, not just a one-time posting at award.
CMMC status is not permanent. Conditional statuses last 180 days, and final statuses last 1 to 3 years, with annual affirmations required throughout. If you received a conditional status after your initial assessment, you have 180 days to remediate open findings and reach Final status, or your compliance lapses. A Plan of Action and Milestones (POA&M) documents the remediation work you commit to completing during that window. If nothing is posted in SPRS at all, the prime has no way to verify you and cannot award.
Your First Steps: A Practical Checklist
If you just received a flowdown clause or expect one soon, work through these steps in order:
- Ask the prime directly. Request the specific CMMC level required and whether the contract calls for a self-assessment or a C3PAO assessment. Do not assume your level matches the prime's top-line requirement.
- Map where FCI and CUI live. Walk through email, shared drives, ticketing systems, and cloud tools where project files land. Document every location. A common mistake is overlooking shared inboxes or collaboration platforms where contract files quietly accumulate.
- Check your SPRS record. Log in to SPRS and review what is currently posted. If nothing is there, the prime cannot verify you and cannot award the subcontract.
- Define your scope. Work with your IT team or a managed IT services provider to identify which systems actually process, store, or transmit the contract data. Smaller scope means less remediation work and lower assessment cost.
- Gap-assess against your required level. Compare your current controls against the requirements for your CMMC level. Strong cybersecurity fundamentals - multi-factor authentication, encrypted storage, access control, audit logging - cover a large share of Level 2 requirements.
- Build a POA&M if needed. If you cannot meet every requirement before award, a documented Plan of Action and Milestones shows the prime you have a credible path to compliance and supports a conditional CMMC status while you remediate.
Common Mistakes Worth Avoiding
A common mistake is assuming CMMC only applies to the prime or the first-tier sub. The DIB sector includes over 220,000 companies that process, store, or transmit CUI or FCI, and the flowdown requirement reaches every tier that handles that data. If contract files are landing in your systems, the requirement applies to you regardless of where you sit in the supply chain.
Another common mistake is waiting for the prime to define your scope. Ask which data types will be shared before you sign the subcontract. If you can limit what contract data enters your environment, you may reduce your required level and the scope of any assessment. Post-award scope creep - where CUI starts arriving in systems that were never planned for it - is a real problem for small subs who did not set expectations upfront.
Keep in mind that requirements are set to expand to all contractors whose information systems process, store, or transmit FCI or CUI, not just contracts where the program office has specifically mandated it. The time to build good security habits is before that expansion, not after. The post why the antivirus on your work computers is not enough covers baseline controls worth having in place at any CMMC level, and what happens after an employee clicks a bad link is a practical starting point for your incident response thinking.
If you want to talk through your CMMC obligations without spending hours reading through regulations, book a free 15-minute call with Joshua. Junious Digital Labs works with small businesses to sort out IT and cybersecurity requirements, map their systems, and figure out a realistic path forward. No sales pitch - just a straight conversation about where you stand.
