The list is long, but it is not random
Subcontractors experience prime onboarding as an unpredictable stream of requests from people who have never met each other — supply chain, contracts, security, quality, finance — each with a form and a deadline. From inside the prime it is not chaotic at all. Each request exists because a specific obligation flows down to them from the government and they cannot accept it without passing part of it to you. Once you can see which obligation is behind each ask, two useful things happen. You stop treating the requests as bureaucracy, and you start being able to predict what is coming next and get ahead of the three items that genuinely take months.
Getting ahead matters more than it sounds. A prime that has to choose between two capable subcontractors will choose the one whose paperwork will not put the delivery date at risk, and they make that judgment early, from how quickly the first few items come back. A supplier who answers a qualification packet in two days with complete, honest documents has told them something about how the delivery will go.
You are probably here because
- A prime sent a packet with a short deadline and you want to know what is coming after it
- You are deciding whether to pursue subcontract work at all and want the real cost of admission
- Somebody asked for a score you have never posted and a certificate you have never heard of
- You have been a sub before and it went badly at the flowdown stage
The timing table is the part to keep. The three long-lead items are the ones to start this week regardless of where the pursuit stands.
Stage one: qualification
This comes before anybody has decided anything, and it is mostly identity and eligibility. The prime is checking that you exist, that you can be paid, and that adding you does not create a problem for them.
Expect: your unique entity identifier and commercial and government entity code, active registration in the government's entity system with the expiry date, your business size under the relevant industry code, any socioeconomic status you claim, certificates of insurance, tax documentation, banking details, and a capability statement. Expect a representation on prohibited telecommunications equipment under the Section 889 clauses, and expect them to check the public exclusions list themselves.
Expect also, if the work has any chance of touching defense information: your cybersecurity self-assessment score in the government's supplier performance system, its date, and a description of what the score covers. The prime asks because the assessment clauses oblige them to confirm a subcontractor has a current score on file before awarding certain subcontracts. That is their obligation, not their curiosity, and being unable to answer it stalls the pursuit rather than annoying anyone.
Expect a portal. Large primes run supplier systems, often a shared industry platform, and registration takes longer than the fifteen minutes the email suggests. Do it once, properly, with a real owner inside your company who will keep it current, because a lapsed registration surfaces at the worst possible moment.
Stage two: non-disclosure, then teaming
Two documents, in that order, and conflating them is a common early mistake.
The non-disclosure agreement should come first and should be mutual. It exists so you can talk about the actual work. Read the term, the definition of confidential information, the residuals clause if there is one, and whether it survives the pursuit. A prime's standard form is written for the prime, which is normal; asking for mutuality and a sane term is normal too.
The teaming agreement is the commercial one and deserves more attention than it usually gets, because it is signed under time pressure while everyone is enthusiastic. The questions worth answering in writing: what is your workshare and is it described in enough detail to be enforceable, is the arrangement exclusive and in which direction, what happens if the prime wins with a different sub, what happens if the customer directs a change, and how the agreement ends. We have written separately on the terms that should stop you signing, and the pattern is consistent — the problems are almost never in what the agreement says, they are in what it declines to say about your scope.
Stage three: proposal support
If the pursuit is live, the requests change character. Now they want content, and the deadlines get short, because the prime has had the solicitation for weeks and is passing you the part they cannot write.
Expect resumes for named staff in a prescribed format, letters of commitment for anyone named, past performance descriptions with references who will actually answer, a technical narrative in their template rather than yours, and pricing in a structure you did not choose. Expect questions about your accounting system, your indirect rate structure, and whether your rates have ever been reviewed by a government audit agency. On a set-aside award, expect attention to how much of the work can flow to firms that are not similarly situated, because the limitation on subcontracting constrains the prime's own compliance.
Two pieces of advice on this stage. Keep resumes, past performance write-ups and rate build-ups current in your own files year-round, so a two-day turnaround is an export rather than a project. And price the work you will actually do, not the number you think wins, because a rate you cannot deliver on becomes a delivery problem four months later rather than a pricing win today.
| Stage | What they ask for | Realistic lead time |
|---|---|---|
| Qualification | Entity identifiers, registration status, insurance, tax and banking, size and status, telecommunications representation, capability statement | Days — if the records are current |
| Cyber qualification | Self-assessment score with its date and scope, certification status where required | Months, if you have never assessed |
| Non-disclosure | Mutual agreement before technical discussion | Days to two weeks |
| Teaming | Workshare, exclusivity, what happens on a win and on a loss | Two to six weeks, and worth every day |
| Proposal | Resumes, commitment letters, past performance, technical text in their template, priced build-up | Days, on their clock |
| Subcontract | Flowdown acceptance, negotiated terms, incident reporting contacts and credentials | Weeks, and longer if you negotiate |
| Performance | Annual affirmations, renewals, updated scores, incident notification, supplier reviews | Recurring, forever |
| Closeout | Data return or destruction with certificates, records retention, final invoices, release | Weeks, and often forgotten |
Stage four: the subcontract and its flowdowns
The award document arrives with an attachment listing government clauses that apply to you. It will be long, some of it will not apply to your scope, and the prime's default is to flow everything because deciding case by case costs them time.
Read it anyway, and read the cybersecurity ones closely. The safeguarding clause carries obligations beyond implementing the security requirements: reporting a cyber incident to the government within a short window measured in hours, preserving system images for a defined period, submitting malicious software to the designated laboratory, cooperating with damage assessment, and flowing the same clause to your own subcontractors. The assessment clauses require a current score and grant the government access to assess you directly. Where a certification level is specified, it is a condition of the work rather than an aspiration.
One item consistently surprises people and belongs on your list this week rather than after award: reporting a cyber incident through the government's portal requires a specific type of digital certificate obtained from an approved external authority. Obtaining one involves identity verification and takes real time. A firm that discovers this on the day it needs to report has a problem that no amount of urgency solves.
What is worth negotiating, if you have any standing to ask: the liability provisions, the intellectual property and data rights terms, payment timing, termination for convenience and what you recover, and the flowdowns that plainly do not apply to your scope. A prime will often remove clauses that are irrelevant if you identify them specifically. They will rarely remove them if you object in general.
Will a prime move on this if you ask? — our read
Our judgment of how these asks land, not a survey. Everything moves upward when you are genuinely hard to replace, and downward when you are one of thirty.
Stage five: during performance
The requests do not stop at award, and the recurring ones are the ones people forget to staff.
Annual items: renewal of your entity registration, insurance certificates, updated self-assessment score, and the affirmation of continued compliance made by a named senior official. Somebody has to own that calendar, and in a small firm it should be a person rather than a role that nobody currently fills.
Event-driven items: notification if your ownership changes, if your size status changes, if key personnel leave, and if you have a security incident. Read the incident notification obligations closely, because you may owe the prime notice on a tighter timeline than you owe the government, and the two are separate duties rather than one.
Ongoing items: supplier performance reviews, quality audits, and occasionally an on-site assessment. Also worth knowing — performance ratings in the government's system are recorded against the prime, not against you. If you want documented past performance out of the work, ask the prime for a reference letter describing your scope and your performance, at a moment when the relationship is good. Nobody will offer it.
Stage six: closeout
Closeout is where a good relationship quietly becomes a problem, because everyone has moved on and nobody has budgeted the hours.
Expect requests for the return or destruction of controlled information with certificates of destruction, confirmation of your records retention, final invoices within a stated period, and a release of claims. Do the data disposition properly and document it, because “we deleted it” without a record is the same as not having done it. Then think about what you want to carry forward: the reference letter, the past performance write-up while people still remember the details, and an honest internal note on what the work actually cost you compared to what you priced.
What to ask them
The requests run one direction by default. A few questions, asked early and politely, save more trouble than anything else on this page.
- What categories of information will you actually send us, and is any of it controlled or export-controlled
- Which certification level does this subcontract require, and on what basis
- Would you hold the data or host our people, rather than transmitting it to us
- Which flowdowns apply to our scope, and which are in the template by default
- What are your payment terms in practice, not on paper
- Who is our single point of contact when four departments are asking at once
- What does your notification obligation to us look like if there is an incident on your side
- Will you provide a reference letter at closeout describing our scope and performance
Where this goes wrong
- Starting the cybersecurity work when the packet arrives — it is the one item measured in months
- Signing a teaming agreement with a one-sentence workshare because everyone was optimistic
- Rebuilding resumes and past performance from scratch every pursuit, on a two-day deadline
- Accepting the whole flowdown list without identifying the clauses that plainly do not apply
- Discovering the incident-reporting credential requirement on the day of an incident
- No owner for the annual renewals, so a registration lapses mid-performance
- Never asking the prime to hold the data, which is free to ask and sometimes granted
- Leaving closeout unstaffed, and losing the reference letter along with the relationship
Bottom line
Nothing on the list is arbitrary; each item traces back to an obligation the prime carries and cannot hold alone. The three that take real time are the cybersecurity posture, the teaming terms, and the incident-reporting credential, and all three can be started before any particular pursuit exists. Everything else is a filing problem, which means it is solvable by keeping your own records current and giving one person ownership of the calendar. Do that and you become the supplier whose paperwork never threatens a delivery date, which is a smaller thing to be than a technical differentiator and a surprisingly durable one.
Frequently asked questions
Because the assessment clauses put that obligation on them. A prime awarding a subcontract that carries the safeguarding clause has to confirm the subcontractor has a current self-assessment score posted in the government's supplier performance system. It is a condition on their side rather than a preference, which is why the pursuit stalls rather than proceeding when you cannot answer.
On some, yes. Primes flow the full list because deciding case by case costs them time, and they will often remove clauses you identify specifically as inapplicable to your scope. Mandatory clauses are mandatory and will not move. The productive approach is a short marked-up list with a reason beside each item, rather than a general objection to the length of the attachment.
Three things, and none of them can be compressed at the end. Getting a defensible cybersecurity posture and an honest score, which is months rather than weeks if you are starting from nothing. Negotiating teaming terms that describe your workshare specifically. And obtaining the digital certificate required to report a cyber incident through the government's portal, which involves identity verification and its own processing time.
Not automatically, and this catches people out. Formal performance ratings are recorded against the prime. What you can get is a reference letter from the prime describing your scope and your performance, which is genuinely useful in later pursuits — but you have to ask for it, ideally at closeout while the details are fresh and the relationship is good.
For the filing and the calendar, no. This is administrative work that one organised person inside your company can own, and it is better owned inside because the records need maintaining year-round. Outside help earns its keep on the parts with real engineering in them — designing a boundary, standing up an environment that will survive an assessment, or untangling terms after a pursuit has already gone sideways.