Defense Subcontractor Requirements: Flowdown, CMMC & CUI Compliance

Why Defense Subcontractors Are Exposed

The defense industrial base has a compliance blind spot: most of the cybersecurity and regulatory burden flows from DoD to prime contractors — but the actual work, including handling the most sensitive technical data, often happens at the sub level. [AI-GENERATED] context

The gap is widening. As CMMC requirements phase into prime contracts through 2026, primes are under legal obligation to ensure their subcontractors comply. Many are just now auditing their supply chains. Subcontractors who aren't ready are being replaced.

DFARS Flowdown Requirements

DFARS (Defense Federal Acquisition Regulation Supplement) clauses are requirements written into prime contracts that must be passed down — "flowed down" — to subcontractors. Some clauses are mandatory flow-downs; others are at prime discretion. For cybersecurity, the mandatory ones create direct subcontractor obligations. [VERIFIED] DFARS Part 244, DFARS 252.204-7012(m)

Key DFARS Clauses That Flow to Subcontractors

[VERIFIED] DFARS clause texts at acquisition.gov; 32 CFR Part 170 (CMMC Final Rule)

CMMC Assessment Scope for Subcontractors

CMMC scope for a subcontractor is defined by the same boundary that defines your CUI environment: every system, person, and process that touches Controlled Unclassified Information is in scope. The size of that boundary determines how expensive and time-consuming certification will be. [AI-GENERATED] scoping guidance

What Defines Your CUI Boundary as a Sub

• What the prime sends you: Technical drawings, specs, contract performance information, export-controlled data — if it's CUI, it creates scope
• How you receive it: Email, file share, physical media — every channel that CUI crosses enters scope
• Where you store it: Workstations, servers, cloud drives — all in-scope systems require CMMC compliance
• Who touches it: Any employee or contractor with access to in-scope systems must be part of your security program

CMMC Level Required for Subs

[VERIFIED] CMMC Final Rule 32 CFR Part 170 §170.19; DFARS 252.204-7021(c)(4)

CUI Handling Obligations

Once CUI enters your systems, you are legally responsible for its protection. The requirements aren't negotiable — they're federal law by way of Executive Order 13556 and 32 CFR Part 2002. [VERIFIED] 32 CFR Part 2002, DFARS 252.204-7012

What Counts as CUI in Defense Subcontracts

CUI in defense work commonly includes:

• Technical drawings and specifications — anything with engineering detail about a covered defense system
• ITAR-controlled technical data — technology for developing, producing, or maintaining defense articles on the USML
• EAR-controlled items — items on the Commerce Control List requiring export licensing
• Contract performance information — pricing, subcontractor data, delivery schedules that DoD considers sensitive
• Personally Identifiable Information (PII) of DoD personnel or contractors
• Unclassified Naval Nuclear Propulsion Information (UNNI) — separate CUI category for relevant programs

Required CUI Protections

What Primes Look For When Qualifying Subs

The era of "we'll deal with compliance later" is ending. Primes are actively auditing subcontractor compliance posture — partly because they're legally required to, and partly because a sub's cybersecurity failure can compromise the prime's contract, reputation, and program. [AI-GENERATED] qualification framework context

The Sub Qualification Checklist

Before awarding a subcontract involving CUI, mature prime contractors typically verify:

• Active SAM.gov registration — must be current and not excluded
• SPRS score on file — visible in PIEE; negative scores or absent scores are immediate red flags
• CMMC certification status — required for contracts with CMMC requirements in scope (phasing in)
• System Security Plan (SSP) — documented and current; primes increasingly request a copy or summary
• ITAR/EAR registration — required if the sub will handle ITAR-controlled technical data; must be registered with DDTC
• Cyber liability insurance — minimum $1M, increasingly $5M for programs with significant CUI
• Technical qualifications — relevant certifications, past performance on similar programs
• Small business status — primes have subcontracting plan requirements; SB status opens additional opportunities
• Quality management system — ISO 9001 or AS9100D for manufacturing; CMMI for software
• Export compliance program — documented ITAR/EAR program with a DECO or compliance officer designated

Insurance & Bonding Requirements

Insurance minimums vary by prime and program. These are common ranges for defense subcontracts: [AI-GENERATED] ranges — verify with prime's terms and conditions

Getting on Prime Vendor Lists

The six defense primes and major non-traditional companies all have different qualification processes. Here's what each looks for and how to get in. [AI-GENERATED] qualification guidance based on publicly available supplier program information

Getting Sub-Ready: Your Action Plan

Compliance isn't built overnight. The subs who win in the next 18 months are the ones who started today. [AI-GENERATED] prioritization guidance

1. Get on SAM.gov and Keep It Current

   Active SAM.gov registration is the minimum entry requirement for any DoD subcontract. Registration expires annually — a lapsed registration locks you out. Verify your CAGE code, NAICS codes, and business size certifications are accurate. This is free and takes 30 minutes.

2. Calculate and Submit Your SPRS Score

   Run a NIST SP 800-171 self-assessment (use the SPRS Score Calculator), document your results in an SSP, and submit your score via PIEE. A positive score in SPRS is now effectively a prerequisite for subcontract awards. Negative scores are visible to primes and flag you as high risk.

3. Define and Reduce Your CUI Boundary

   Before spending money on CMMC readiness, map exactly where CUI enters, moves, and is stored in your environment. If CUI is scattered broadly, consider implementing a CUI enclave — a dedicated, hardened environment for CUI handling — to reduce certification scope and cost.

4. Close NIST SP 800-171 Gaps

   Run the CMMC Readiness Assessment to identify your current gaps. Build a POA&M with realistic dates. Focus on high-weight controls first (MFA, incident response, malware protection, encryption). Document everything — evidence is what assessors actually evaluate.

5. Get Your ITAR/EAR House in Order

   If you're handling technical data for defense articles, verify whether ITAR registration with the State Department (DDTC) is required. For commercial technologies with defense applications, confirm your EAR classification. Export control violations carry criminal penalties — this isn't optional paperwork.

6. Engage a C3PAO for CMMC Level 2

   If CMMC Level 2 is in your near-term contracts, engage an authorized C3PAO now — schedules are filling up. A pre-assessment gap analysis (from an RPO or C3PAO) typically costs $5K–$15K and tells you exactly what needs to be fixed before you spend on a full assessment. See the C3PAO Assessment Guide for selection criteria.

ITAR and EAR Export Control Obligations

Export controls are a distinct — and frequently misunderstood — obligation for defense subcontractors. They run parallel to CMMC and DFARS, and non-compliance carries criminal penalties. [VERIFIED] 22 CFR Parts 120–130 (ITAR), 15 CFR Parts 730–774 (EAR)

[VERIFIED] 22 CFR Part 120 (ITAR definitions); 15 CFR Part 730 (EAR scope); DDTC.state.gov

Frequently Asked Questions