Do Subcontractors Need CMMC? How Flow-Down Actually Works

How Flow-Down Works

When a prime contractor wins a DoW contract involving protected information, it is required to pass the relevant cybersecurity clauses down to its subcontractors. The key clauses:

• DFARS 252.204-7012 — safeguarding covered defense information and reporting incidents; flows down when CUI is involved.
• DFARS 252.204-7021 — the CMMC clause; requires the subcontractor to hold the appropriate CMMC level before protected information is shared.

The prime is responsiblefor ensuring its subs meet the required level. In practice, that means primes are increasingly unwilling to share CUI — or award the subcontract at all — to a supplier that can't demonstrate compliance. Flow-down isn't just a legal formality; it's a gate on whether you win the business.

Which Level Does a Subcontractor Need?

Here is the part that surprises people: a subcontractor does not automatically need the same level as the prime. The required level depends on the sensitivity of the information that actually flows down to you:

• Only FCI flows down → you need CMMC Level 1.
• CUI flows down → you need CMMC Level 2.

So a prime certified at Level 2 might pass only FCI to a particular sub — meaning that sub needs only Level 1. The flip side is just as true: if CUI reaches you, you need Level 2 regardless of how small your piece of the work is. (Not sure which kind of information you handle? Start with what CUI is and how to tell.)

The COTS Exception

There is a meaningful carve-out. Suppliers that provide only commercial off-the-shelf (COTS)products — and never receive or generate FCI or CUI — are generally not subject to CMMC flow-down, because no protected information changes hands. If you sell a standard catalog product and no controlled information touches your systems, CMMC likely doesn't reach you. The moment that changes — a drawing, a spec, a controlled data file — so does your obligation.

What to Ask Your Prime

If you're a subcontractor, get clarity in writing before you accept the work:

• Will any FCI or CUI flow down to us under this subcontract?
• What CMMC level does the prime require of us, and by when?
• Which DFARS clauses are being flowed down?
• How will controlled information be transmitted and marked, so we can scope our environment correctly?

The answers tell you precisely what you need to build — and let you start early, while competitors are still asking the question.

Find Out Where You Stand

Whether CMMC reaches you as a prime or a sub, the first move is the same: measure your posture against the requirements that apply to you. The Dragonfli Group CMMC Accelerator helps you scope what flows down, assess against the relevant NIST SP 800-171 requirements, and produce a draft SSP, POA&M, and gap plan — reviewed by a CMMC Registered Practitioner — so you can give your prime a confident, accurate answer.