A prime contractor's onboarding control should begin before CUI is sent to a subcontractor. The prime needs to know what information will flow, which safeguarding and CMMC clauses apply, what status the subcontract requires, and which systems will receive the information.
For a small defense contractor, the useful test is whether the organization can show how the requirement applies inside the defined FCI/CUI boundary, who operates it, and what current evidence proves it is working.
The rule in plain English
Flowdown is not just copying clause text into a subcontract. The prime should connect the clause to the actual work package, data type, subcontractor system, required status, incident reporting, and ongoing change notification.
Where CMMC status is required by the subcontract, use current program and acquisition rules rather than a generic supplier questionnaire.
How to implement it without overbuilding
Create an onboarding gate covering FCI/CUI identification, clause selection, subcontractor representation/status, system identifiers where relevant, data-transfer method, incident contacts, and downstream flowdown obligations.
Require re-review when subcontract scope or information type changes.
What evidence to keep
Keep the executed subcontract, clause matrix, data description, supplier security representations, status evidence, transfer approval, and periodic revalidation.
Track who approved release of CUI to the subcontractor and on what basis.
Where teams get into trouble
A common failure is sending technical data during proposal or kickoff before the security gate is complete. Another is treating a corporate certification as automatically covering every subcontractor system.
Small-contractor walkthrough
A prime is about to release a technical package to a new machine-shop subcontractor. The supplier onboarding gate should confirm data type, applicable clauses, required status, approved transfer path, incident contacts, and downstream flowdown before the file is sent.
The fastest way to find a weak implementation is to pick a recent real event and replay it from beginning to end.
Prime-subcontractor CMMC questions are easiest to solve before protected data moves. Put the information type, clause, required status, approved system, and reporting contacts into the onboarding or contracting workflow.
For supplier onboarding, the approval trail should be reconstructable from the procurement record itself: what data will flow, which CMMC status was required, which system or CMMC UID the supplier will use, who verified it, and when the supplier became eligible to receive protected information. If procurement cannot show that sequence, fix the gate rather than adding another questionnaire.
Do not use supplier questionnaires as substitutes for the actual subcontract terms or current government status. Record the basis for the decision so procurement, program, IT, and security teams use the same assumptions.
- Identify data type.
- Select applicable clauses.
- Verify required status.
- Approve transfer method.
Use the four-case rule before flowing anything down
32 CFR 170.23 makes subcontractor flowdown data-driven. FCI-only work requires Level 1 (Self). CUI work requires at least Level 2 (Self). When the associated prime contract requires Level 2 (C3PAO), a CUI-handling subcontractor needs at least Level 2 (C3PAO). When the prime contract requires Level 3, the general rule still sets Level 2 (C3PAO) as the CUI-subcontractor minimum unless DoD supplies more specific guidance.
That decision should happen from the work package and data flow, not from a blanket supplier tier. A vendor receiving no FCI/CUI is different from a shop receiving controlled drawings. A subcontractor receiving only FCI is different from an engineer receiving CUI. Record the reason for the assigned level before procurement sends a questionnaire.
- FCI only → Level 1 (Self).
- CUI → Level 2 (Self) minimum.
- CUI + prime Level 2 C3PAO → Level 2 C3PAO minimum.
- CUI + prime Level 3 → Level 2 C3PAO minimum unless specific guidance says otherwise.
Pre-award verification and the data-release gate
DFARS 252.204-7021 requires the correct flowdown and pre-award verification of current status appropriate to the information being shared. Store the subcontract requirement, data type, required assessment type, performance system, relevant CMMC UID/status evidence, and annual-affirmation responsibility in the supplier onboarding record.
The prime is not supposed to conduct its own substitute C3PAO assessment of the supplier's controls. Its job is to make the correct contractual flowdown, verify the required status/affirmation, and avoid disseminating FCI/CUI to an ineligible system. Link engineering's file-release process to supplier approval so controlled drawings cannot bypass procurement's status check.
Re-run flowdown when the work changes
A supplier can begin with FCI-only work and later receive drawings, specifications, or test data that change the requirement. Require notification when the performance system, status, key provider, CUI workflow, or work package changes, and re-run the 170.23 decision before releasing new information.
Sample five recent subcontract awards and trace each from scope of work to information type to status verification to first data transfer. Any award where the data classification was guessed after signing should become a process correction.
Last-mile topic check
Include a hard data-release control: procurement approval alone is not enough if engineers can email CUI to a supplier whose status was never verified for the receiving system.
A short working check
- ✓Identify data type.
- ✓Select applicable clauses.
- ✓Verify required status.
- ✓Approve transfer method.
- ✓Record incident contacts.
- ✓Revalidate after scope changes.
Common questions
Does every subcontract need DFARS 252.204-7012?
Apply the clause according to its flowdown conditions and the subcontract/data facts; do not use a blanket answer detached from the clause.
Should the prime ask for the full SSP?
Not automatically. Request only what is necessary and contractually appropriate; SSPs can contain sensitive security information.
What if the subcontractor changes systems?
Require change notification when it affects the system handling protected information or represented status.
Who owns downstream flowdown?
Each contractor should understand its obligations to flow applicable requirements to lower tiers where required.
Does a Level 3 prime flow Level 3 to every CUI subcontractor?
Not under the general 32 CFR 170.23 rule. The minimum is Level 2 (C3PAO) for a CUI subcontractor unless DoD provides more specific guidance.
Official sources used for this guide
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
