10.3 Subcontractor Flow-Down, Supply Chain Governance & SPRS Scoring

Subcontract Flowdown, SPRS & Supply-Chain Decisions

A prime does not choose a subcontractor’s cybersecurity obligations from a generic “FCI equals Level 1, CUI equals Level 2” chart. The governing facts are the clauses in the higher-tier award, the subcontract’s terms, the information and systems involved, any COTS exclusion, the required CMMC status, and the current implementation phase.

Keep the acquisition instruments distinct

This distinction prevents two common errors: treating 7019 as though it were a flowdown clause, and treating a current Basic SPRS assessment under 7020 as though it automatically proved the contract’s separate CMMC status.

Information and contract decision

Start by determining what the subcontractor receives or generates. FCI may trigger FAR 52.204-21 when that clause and its flowdown terms apply. CUI/CDI may trigger DFARS 252.204-7012 and the related assessment clauses present in the award. Then read the solicitation and subcontract for the exact CMMC level and assessment type.

Handling CUI does not by itself answer whether the required status is Level 2 Self or Level 2 C3PAO. That decision is stated through the acquisition process. Likewise, an FCI subcontractor does not acquire a CMMC Level 1 status requirement unless the applicable CMMC clause requires it, even though FAR basic safeguarding can still apply.

DoD began CMMC Phase I on November 10, 2025. On July 13, 2026, the Department suspended Phase II requirements and paused implementation in Phase I while leaving Phase I self-assessment requirements and existing NIST SP 800-171 and DFARS duties in place. Candidates should use the current implementation notice and the actual solicitation rather than assuming the original rollout calendar continued unchanged.

7020 pre-award assessment check

When DFARS 252.204-7020 covers the subcontract, the contractor may not award the subcontract or other instrument subject to NIST SP 800-171 implementation unless the subcontractor completed at least a Basic NIST SP 800-171 DoD Assessment for all relevant covered contractor information systems. The assessment normally must be no more than three years old, unless the solicitation specifies a shorter period.

The check is for a current assessment, not a universal minimum score of 110. The higher-tier contractor verifies the relevant record in SPRS and keeps acquisition evidence appropriate to the process. A CMMC status check under 7021 is a separate question and must match the UID, level, assessment type, scope, status, affirmation, and timing required by that contract.

COTS and commercial-item boundaries

The 7012 and 7021 flowdown provisions exclude subcontracts solely for Commercially Available Off-The-Shelf (COTS) items. COTS has a defined acquisition meaning: a qualifying commercial product sold in substantial quantities and offered without modification in the same form used commercially. A custom part built from controlled technical drawings is not transformed into COTS because similar parts are sold commercially. Nor does “commercial item,” “small business,” or “catalog supplier” automatically prove the narrower COTS test.

A COTS supplier can still receive information under another relationship or perform non-COTS work. Apply the exclusion to the actual subcontract and data flow, not the company’s identity.

Multi-tier flowdown

A required flowdown continues through the supply chain under the language of each clause. A first-tier subcontractor must repeat the analysis before sending covered information or covered work to a lower tier. The prime should maintain traceability from the government award to the subcontract, data category, clause, required system or status, and evidence of the pre-award check.

Useful governance records include:

• a contract and clause matrix tied to each supplier;
• the CUI and FCI flow, including portals, email, file transfer, drawings, and support providers;
• the relevant CAGE codes, assessment scope or CMMC UID, SPRS record, status date, and affirmation where applicable;
• subcontract language and evidence that lower tiers received the correct obligations;
• incident-notification paths that allow the reporting contractor to meet applicable deadlines; and
• periodic checks triggered by expiration, scope change, new information, or contract modification.

These records are evidence of a process, not proof that every technical objective is MET. The assessor selects focused samples and verifies the actual systems and activities relevant to the OSC’s own scope.

Scope-reduction patterns

A prime may reduce a supplier’s CUI exposure through a controlled enclave, VDI, redaction, or redesigned workflow, but only the actual technical result matters. Under the scoping rule, a VDI endpoint can be out of scope only when it cannot process, store, or transmit CUI beyond keyboard, video, and mouse interaction. Clipboard, local drive mapping, print, cache, download, unmanaged screenshots, or administrative access may change that conclusion.

Redaction must genuinely remove the controlled information; relabeling a drawing does not. Encryption protects a transmission but does not by itself make the receiving system out of scope, because the recipient may decrypt and process the CUI.

Scenario method

Use this sequence for a supplier scenario:

1. Identify the item, service, FCI, CUI/CDI, and operationally critical support involved.
2. Read the prime clauses and the proposed subcontract.
3. Test the COTS exclusion precisely.
4. Apply each clause’s own flowdown and pre-award rule.
5. Verify the current Basic assessment under 7020 and the separate contract-required CMMC status under 7021 as applicable.
6. Trace the data, scope, lower tiers, and incident path.

A custom machine shop receiving controlled technical drawings is not a COTS purchase. The prime flows the applicable clauses and verifies the assessment and CMMC status actually required before award. A purchase solely for standard catalog fasteners may qualify for the COTS exclusion. Neither conclusion comes from the supplier’s size or reputation.