Will CMMC Requirements Flow Down to Subcontractors?

Understanding Flow-Down Requirements

One of the most significant aspects of CMMC is its flow-down provision. If you're a subcontractor in the defense supply chain, your prime contractor's CMMC obligations directly affect you.

How Flow-Down Works

• FCI only flows down: Subcontractor needs CMMC Level 1
• CUI flows down: Subcontractor needs CMMC Level 2
• Prime has Level 3: Subcontractor minimum is Level 2 independent assessment (not Level 3, unless specifically required)

Key Implications for Subcontractors

If you receive CUI from a prime contractor — even temporarily — you need CMMC Level 2 compliance. This includes scenarios where CUI passes through your systems in transit or is stored in shared environments.

Important: The flow-down is based on the type of data handled, not the prime's level. A Level 3 prime working with a sub that only handles FCI would only require Level 1 from that sub.

For Prime Contractors

You are responsible for ensuring your subcontractors meet the required CMMC level before sharing FCI or CUI. This means you should be verifying your supply chain's CMMC status as part of your teaming arrangements. SPRS can be used to check CMMC status, and subcontractors may voluntarily share their certificates to facilitate teaming.