Home › CMMC FAQs › CMMC Model
CMMC Model — Official DoD FAQ

Will CMMC Requirements Flow Down to Subcontractors?

💼
Need to ensure your supply chain is CMMC-compliant? Jun Cyber helps primes and subs navigate flow-down requirements.
Schedule Free Consultation
Official DoD Answer
Source Source: DoD CIO CMMC FAQs v5 (B-Q6)

Yes, CMMC requirements will flow down to subcontractors as outlined in 32 CFR 170.23. The required CMMC level is based on the type of data — FCI or CUI — that will be processed, stored, or transmitted on a contractor's information system. Subcontractors handling FCI or CUI are subject to safeguarding requirements. When the prime contract requires Level 3, the minimum flow-down requirement is Level 2 independent assessment, unless the Government provides specific contractual guidance.

In-Depth Analysis

Understanding Flow-Down Requirements

One of the most significant aspects of CMMC is its flow-down provision. If you're a subcontractor in the defense supply chain, your prime contractor's CMMC obligations directly affect you.

How Flow-Down Works

  • FCI only flows down: Subcontractor needs CMMC Level 1
  • CUI flows down: Subcontractor needs CMMC Level 2
  • Prime has Level 3: Subcontractor minimum is Level 2 independent assessment (not Level 3, unless specifically required)

Key Implications for Subcontractors

If you receive CUI from a prime contractor — even temporarily — you need CMMC Level 2 compliance. This includes scenarios where CUI passes through your systems in transit or is stored in shared environments.

Important: The flow-down is based on the type of data handled, not the prime's level. A Level 3 prime working with a sub that only handles FCI would only require Level 1 from that sub.

For Prime Contractors

You are responsible for ensuring your subcontractors meet the required CMMC level before sharing FCI or CUI. This means you should be verifying your supply chain's CMMC status as part of your teaming arrangements. SPRS can be used to check CMMC status, and subcontractors may voluntarily share their certificates to facilitate teaming.

Have More Questions?

ChatCMMC can answer detailed questions about CMMC compliance, NIST 800-171, assessment preparation, and more — with source citations when available from selected official DoD and NIST sources.

Ask ChatCMMC →

CMMC Readiness Assessment

Find out where your organization stands and what steps you need to take. Jun Cyber's CMMC experts can help you interpret the requirements.

By submitting, you agree to be contacted by Jun Cyber. No spam, ever.

Related Questions

You Might Also Want to Know

CMMC Model

What Is the Difference Between Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)?

→ CMMC Model

How Will My Organization Know What CMMC Level Is Required for a Contract?

→ Implementation

How Will the Department Implement CMMC and How Can Businesses Prepare?

→
Jun Cyber

Ready to Start Your CMMC Journey?

Jun Cyber helps defense contractors prepare for applicable CMMC requirements. From scoping and gap assessments to documentation, remediation, and C3PAO assessment readiness — Jun Cyber provides hands-on compliance support.

📅 Schedule a Consultation Learn About CMMC Select →