Flowing CMMC requirements down to your suppliers

Flowdown starts with what you send

The CMMC flowdown question sounds like a contracts problem, and it gets filed there. In practice it is decided the moment someone in purchasing attaches a drawing to an email. The requirement follows the information, so the level a supplier needs depends on what you actually hand them and what they do with it.

That framing gives you a lever most companies never pull. You cannot change what the regulation requires of a supplier who receives controlled unclassified information. You can often change whether that supplier receives it.

What the clause requires

DFARS 252.204-7021 has three provisions that reach your supply chain. Paragraph (d)(1)(ii) tells the contractor to consult 32 CFR 170.23 and "flow down the correct CMMC level to subcontracts and other contractual instruments." Paragraph (f)(1) requires the substance of the clause in subcontracts and other contractual instruments, including those for commercial products and commercial services, if the instrument will contain a requirement to process, store or transmit federal contract information or CUI.

Paragraph (f)(2) is the one that changes daily behavior. Before awarding the subcontract or other instrument, you must "ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down." Paragraph (d)(4) adds that you must ensure subcontractors and suppliers complete an affirmation of continuous compliance before award and maintain it annually.

The rule at 32 CFR 170.23 says these requirements apply "at all tiers" of the supply chain. A supplier you bring in has the same duty toward the suppliers it brings in.

Match the level to the data

The regulation gives four cases, and the deciding question in each is what information the supplier will process, store or transmit.

If the supplier will handle	And the higher-tier contract requires	Minimum status for the supplier
FCI only, no CUI	Any CMMC level	Level 1 (Self)
CUI	Any contract not listed below	Level 2 (Self)
CUI	Level 2 (C3PAO)	Level 2 (C3PAO)
CUI	Level 3 (DIBCAC)	Level 2 (C3PAO)

Two details deserve attention. The level is set by the data, so a supplier handling only FCI does not need Level 2 merely because your own contract does. And the lines with a C3PAO status depend on what the higher-tier contract actually says. Since the July 13, 2026 suspension of CMMC Phase 2, program managers "must only include the need for CMMC Level 1 (Self) or Level 2 (Self) assessments," and contracting officers have been directed to remove third-party requirements. If your contract no longer carries a C3PAO requirement, do not pass down one that has gone away. If a contract of yours still carries one, sort that out with the contracting officer before you decide what to flow.

Who it reaches and who it does not

Paragraph (f)(1) excludes commercially available off-the-shelf items, and it applies only where the instrument will contain a requirement to handle FCI or CUI. So the supplier of standard catalog fasteners, shipped from stock against a part number with no drawing, generally falls outside it. So does a vendor who never receives any contract information at all.

The line moves quickly in practice. A vendor who sells a standard item but receives your controlled drawing along with the order has been handed information the exclusion does not cover. A vendor doing custom work to your print is a very different case from one shipping a catalog item. Decide each supplier on what actually crosses the boundary.

Map what each supplier receives

Before you touch a purchase order template, build one list. For each supplier on active defense work, write down what you send them, how you send it, whether it carries a distribution statement or other marking, and what they do with it. A heat treater that receives a full drawing and a shipper that receives a packing list are in different places.

Then sort the list into three columns: suppliers who receive no FCI or CUI, suppliers who receive FCI only, and suppliers who receive CUI. The third column is where your attention belongs, and the exercise usually shows you which of those suppliers could be moved to one of the first two.

How to confirm a supplier's status

You cannot look a supplier up. In the DFARS final rule, DoD stated that "there is not an automated process to allow prime contractors to view the CMMC status of subcontractors," and that SPRS "will allow subcontractors to print or take a screen shot of their own CMMC status and affirmation information in SPRS, which they can share as they determine appropriate."

So confirmation is a document exchange. Ask each CUI-handling supplier for a current SPRS screenshot or printout showing the CMMC level and status, status date, CMMC unique identifier and affirmation date, along with a written statement from an officer. Keep it in the supplier file, and calendar the follow-up, because the affirmation is good for one year and a Conditional status runs only 180 days.

The same rule explains what the duty amounts to. DoD described the responsibility as flowing down the requirements and to "not disseminate FCI or CUI to subcontractors that have not indicated they meet the CMMC level" for the information to be shared. A supplier with no status yet receives nothing controlled.

A supplier with no status yet receives nothing controlled.

What to write into the purchase order

Keep the language short and specific. A purchase order that recites every regulation and says nothing about this order protects nobody.

• The clause by substance: the substance of DFARS 252.204-7021, and DFARS 252.204-7012 where the work involves covered defense information
• The required level for this order, stated plainly, such as Level 2 (Self)
• Which information is covered and how it will be identified or marked
• A representation of current status and an annual affirmation, with evidence on request
• The duty to tell you promptly if the supplier's status lapses or its compliance changes
• Its own flowdown: no CUI goes further down the chain without the same requirements and your written approval
• Return or destruction of controlled files when the order closes

DFARS 252.204-7012 flows separately

Paragraph (m) of DFARS 252.204-7012 has its own flowdown, and it runs on a slightly different trigger. The clause goes into subcontracts for operationally critical support or where performance will involve covered defense information, "without alteration, except to identify the parties," including subcontracts for commercial products or services. The contractor has to determine whether the information required for performance retains its identity as covered defense information, consulting the contracting officer if necessary.

It also requires the lower tier to do two things that you should build into your process: notify the next tier up when requesting to vary from a NIST SP 800-171 requirement, and provide the DoD-assigned incident report number as soon as practicable after reporting a cyber incident. If a supplier suffers an incident that touches your data, you need to know, so make sure someone there has your contact details.

Send less

The strongest move available costs almost nothing. Before anything controlled leaves the building, ask what this supplier needs to do this job.

A plating house may need a part outline and a specification callout, and may not need the full drawing. A tube bender may need a bend table. A coating vendor may need a surface area and a masking note. Where you can cut the package to what the job requires, and where the result does not carry controlled information, the supplier may move out of the CUI column. Confirm that judgment against the markings and your contract, and where you cannot tell, ask your customer. Under DFARS 252.204-7012, determining whether the information retains its identity as covered defense information is your responsibility.

Set up one controlled way to send files too. A secure portal or managed transfer used only by named people gives you a record of what went to whom, and it keeps controlled drawings out of a buyer's sent folder.

When a supplier cannot meet the level

This will happen, especially with small specialty shops that do excellent work and have never heard of SPRS. You have three honest options: reduce what you send so the requirement no longer applies, move the work to a supplier with the right status, or give the supplier time to get there while sending them nothing controlled in the meantime. Sending the drawing and hoping is not on that list. The Swiss Automation matter, in which DOJ alleged a machining supplier to DoD prime contractors failed to protect certain drawings, is a public reminder that the requirement reaches well down the chain; the release states the claims are allegations only, with no determination of liability.

Common flowdown failures

• Same clause, same level, every supplier. Over-flowing a Level 2 requirement to someone who only receives FCI wastes their money and yours
• Collecting a statement once. A status from last year may have lapsed since
• A clause with no information control. The purchase order says the right words while purchasing keeps emailing full drawings
• Forgetting non-traditional suppliers. Inspection labs, calibration services and outside IT providers can receive CUI too

Frequently asked questions