Flow-down: what primes actually require from their subcontractors

Many subcontractors first meet CMMC not in a solicitation but in an email from a prime: a questionnaire, a clause, a deadline. That is flow-down at work. The Department of Defense sets requirements at the top of the chain, and contract clauses push those requirements downward to everyone who touches the protected information. If you handle a prime's Controlled Unclassified Information, their obligations become your obligations — whether or not you have a direct contract with the government.

How the clauses flow down

Two clauses do the work. DFARS 252.204-7012 has flowed down for years: it requires any contractor or subcontractor handling CUI to implement NIST SP 800-171 and to report cyber incidents to the DoD within 72 hours through DIBNet. The clause explicitly obligates the prime to include it in subcontracts where CUI is involved — and to require the sub to flow it down further, all the way to the bottom of the chain.

CMMC adds the verification layer through DFARS 252.204-7021. Where 7012 says "implement the controls," 7021 says "prove it at the required level." The CMMC clause likewise flows down: a prime carrying a Level 2 requirement must ensure the subcontractors who handle its CUI meet the appropriate CMMC level before they receive that information. The chain is only as compliant as its weakest link that touches CUI.

Subs handling CUI need their own level

This is the point that surprises smaller firms: a prime's certification does not cover you. If CUI flows to your systems, you need your own assessment at the level appropriate to the information you handle. The level is tied to sensitivity, not to your position in the chain.

• Level 1 — 17 controls, for Federal Contract Information (FCI) only. Annual self-assessment. Appropriate for subs who receive FCI but never touch CUI.
• Level 2 — the full 110 NIST SP 800-171 controls, for CUI. Certified by a C3PAO on a three-year cycle. This is the level most CUI-handling subcontractors will need.
• Level 3 — Level 2 plus a subset of NIST SP 800-172, assessed by the government (DIBCAC), for the highest-risk programs.

A sub that receives CUI but only carries a Level 1 posture is a compliance gap for the entire program. Primes know this, which is why the questionnaires have gotten specific.

How primes assess their subs

Primes are accountable for the security of the CUI they share, so they have moved from trust to verification. Expect some combination of the following.

• SPRS score requests. A prime can look up or request your NIST SP 800-171 score in SPRS. A low or missing score is an immediate flag.
• Security questionnaires. Detailed questions about your boundary, your controls, whether you operate a CUI enclave, and your assessment status.
• Evidence and artifact requests. Some primes ask for your SSP, a summary of your POA&M, or proof of specific controls before routing CUI to you.
• Contractual attestation. Flow-down language in the subcontract that binds you to the same 7012 and 7021 obligations, with the right to verify.

Answer the questionnaire honestly

There is a strong temptation to answer optimistically to keep the work. Resist it. Attestations flow into the record, and a false claim about your security posture is not a paperwork error — it carries real legal exposure, including under the False Claims Act, and it will not survive a later C3PAO assessment. A prime would far rather see an honest "not yet, here is our plan and timeline" than a confident claim that collapses under sampling.

• Answer to your real boundary. Describe the environment that actually handles the CUI, not an aspirational one.
• Distinguish met from planned. If a control is on your POA&M, say so. A credible plan beats a hollow claim.
• Keep your SPRS score current. The number the prime pulls should match the story you tell in the questionnaire.

What happens if a sub can't meet the level

If a subcontractor cannot reach the required level in time, the prime has a small set of options, none of which favor the sub who waited. The prime may re-scope the work so the sub no longer receives CUI — sometimes by having the sub work only with FCI or non-controlled data. It may route the CUI portion elsewhere, to a sub who is ready. Or it may replace the sub on that scope entirely. A prime racing its own deadline will not carry a sub who cannot demonstrate the level, because doing so puts the prime's own eligibility at risk.

The most constructive position is to arrive with a credible readiness plan: a scoped boundary, an honest score, and a dated path to the level. Primes will work with a sub who is clearly moving; they cannot afford one who is only promising.

Timing: this is a Phase 2 problem, arriving early

The certification requirement for CUI — Level 2 certified by a C3PAO — lands at award for CUI contracts in Phase 2, beginning November 10, 2026. But flow-down does not wait for your own contract to name a level. A prime facing its Phase 2 obligation will push the requirement down ahead of that date, because the prime must have compliant subs lined up before it can certify its own program.

In practice, the deadline you feel is your prime's deadline, and it arrives before the calendar suggests. Given that a Level 2 posture takes months to build and C3PAO capacity is finite, a sub who starts when the questionnaire lands is already behind. The subs who keep the work are the ones who started before they were asked.

Where Atom fits — and where we do not

We help subcontractors answer the prime honestly and then close the distance between that honest answer and the required level: scoping the CUI boundary, scoring against 800-171, building the SSP and POA&M, remediating, and running the controls between affirmations. When a prime's questionnaire lands, you have a defensible answer and a plan behind it. We are direct about one boundary: Atom is not a C3PAO and does not issue CMMC certifications. We make you the sub a prime keeps.