CMMC for Subcontractors: How Flow-Down Works, Tier by Tier
CMMC reaches every tier of the supply chain that handles FCI or CUI. Which level a subcontractor needs, what the prime has to check before award, and what to do when a prime just says “be CMMC compliant.”
CMMC doesn't stop at the prime. It applies to every company in the supply chain, at every tier, that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) for the work. You don't need a DoD contract of your own for it to reach you. If you're a subcontractor, the level you need depends on what information your prime passes down to you, not on the prime's level or your size.
- It applies at every tier that will process, store, or transmit FCI or CUI for the contract.
- FCI only: Level 1 (Self). Any CUI: Level 2 (Self) at minimum, or Level 2 (C3PAO) if the prime’s contract requires a C3PAO assessment.
- Primes must check before award that each sub holds a current CMMC status and affirmation for the information being passed down.
- No FCI or CUI, no CMMC for that work. Commercially available off-the-shelf items are excluded from the clause.
Does CMMC apply to subcontractors?
Yes. The CMMC rule is direct about it: requirements "apply to prime contractors and subcontractors throughout the supply chain at all tiers that will process, store, or transmit any FCI or CUI" on their information systems for the DoD contract or subcontract (32 CFR § 170.23). Primes have to comply and have to flow the requirements down.
The rule also says exactly which level each subcontractor needs:
“…compliance will be required throughout the supply chain at all tiers with the applicable CMMC level and assessment type for each subcontract as follows: (1) If a subcontractor will only process, store, or transmit FCI (and not CUI) in performance of the subcontract, then a CMMC Status of Level 1 (Self) is required … (2) If a subcontractor will process, store, or transmit CUI …, then a CMMC Status of Level 2 (Self) is the minimum requirement … (3) If a subcontractor will process, store, or transmit CUI … and the associated prime contract has a requirement for a CMMC Status of Level 2 (C3PAO), then the CMMC Status of Level 2 (C3PAO) is the minimum requirement for the subcontractor.”
- 1Every tierSubs, their subs, and so on down, wherever the information goes.
- 2FCI onlyLevel 1 (Self): the 15 requirements, a yearly self-assessment and affirmation.
- 3Any CUIAt least Level 2 (Self), even if the sub only touches a little of it.
- 4C3PAO follows CUIIf the prime needs a C3PAO assessment, so does every sub that handles CUI.
Two consequences people miss. First, the level follows the information, not the prime: a prime working at Level 2 can have Level 1 subs, as long as those subs never receive CUI. Second, the C3PAO requirement passes down only with CUI. A sub that handles only FCI stays at Level 1 (Self), whatever the prime's assessment type.
New solicitations can currently require only Level 1 or Level 2 self-assessments (see what the Phase 2 suspension changed). In practice that means FCI subs need Level 1 (Self) and CUI subs need Level 2 (Self) today. The C3PAO flow-down applies again whenever C3PAO requirements return.
What it looks like down a supply chain
Here's one prime contract that involves CUI, and how the requirement lands at each tier:
ONE CONTRACT · FOUR TIERSPRIMESUBCONTRACTOR- PRIME01The primeHolds the level its contract requires, and flows it down
- TIER 1 · CUI02Machine shopReceives CUI drawings: Level 2 (Self) at minimum
- TIER 2 · FCI03Finishing vendorGets only POs and schedules: Level 1 (Self)
- TIER 3 · COTS04Parts supplierSells off-the-shelf items: outside the clause
The tiers are illustrative, but the logic is the rule’s: each company’s level is set by what it receives.
What does the prime have to check?
The CMMC contract clause, DFARS 252.204-7021, puts two duties on the prime:
- Flow the clause down. Its substance goes into subcontracts that will involve FCI or CUI, including subcontracts for commercial products and services. The one exclusion is commercially available off-the-shelf (COTS) items.
- Check before award. Before awarding a subcontract, the prime has to make sure the subcontractor has a current CMMC status or certificate at the level appropriate for the information being flowed down, and that the sub completes its affirmation before award and keeps it current every year.
So as a sub, expect your prime to ask you to confirm your CMMC status and affirmation before you're awarded the work, and again as contracts renew. If you can't, the prime can't award to you under that clause.
"Be CMMC compliant": what to do when the prime doesn't say which level
Suppliers often get a questionnaire or an email asking them to "be CMMC compliant" with no level attached. Don't guess, and don't over-buy. Work it out from the information:
- Ask what you’ll receive. Will the prime send drawings, specifications, or technical data, or only POs, schedules, and quantities? See CUI vs. FCI, with real examples.
- Ask for the level in writing. The prime has to flow down a specific level and assessment type. Get the answer in an email you can keep.
- Check for DFARS 252.204-7012. It’s in almost every DoD contract, so its presence alone doesn’t settle it. If it’s in your subcontract, ask whether you’ll actually receive CUI, and plan on Level 2 if you will.
- Know when it doesn’t apply. If you’ll receive no FCI or CUI, or you only sell COTS items, the CMMC requirement doesn’t reach that work.
- Check your timeline. The prime has to confirm your status before award, so a Level 1 self-assessment and affirmation should be in SPRS before the subcontract is signed.
Your prime just asked about CMMC?
Our three-question CMMC level check will tell you in a minute whether Level 1 or Level 2 likely applies to the work you're quoting. If it's Level 1, here's what the 15 requirements take and how the annual affirmation works. If it's Level 2, or you're not sure what the prime will send you, a short scoping call with a CMMC Certified Assessor, with the subcontract or RFQ in hand, usually settles it.