When a defense-related contract includes CMMC requirements, those requirements do not stop at the prime contractor. They flow down to subcontractors that handle Controlled Unclassified Information. For a general contractor with a deep bench of specialty trades, that raises practical questions: which subs are affected, how do we tell them, and what if they cannot comply?
With the DFARS acquisition rule for CMMC effective November 10, 2025 and requirements phasing into contracts, these conversations are becoming real. This article offers a practical approach for primes and for subs.
How flow-down works
In general terms, a prime contractor must ensure that subcontractors who process, store or transmit CUI meet the appropriate CMMC level for the work, and that the required status is in place before CUI is shared. The level depends on the type of information, as specified by the contract. Subs that never handle CUI generally are not subject to Level 2 requirements for that contract, though other clauses may still apply.
This is a general summary. Read the actual contract clauses and consult counsel or a qualified advisor.
For primes: build a supply chain plan
1. Identify what actually needs to flow down
Review your contract and determine which parts of the work involve CUI. Often only a few subcontractors need access. The less CUI you share, the fewer subs need to be assessed. Consider whether sensitive documents can be limited to a small group or provided in redacted form.
2. Map subs to data
Create a simple matrix of subcontractors and the type of information each needs. Mark who handles CUI, who does not, and who might in the future.
3. Communicate early
Notify your subs at the bid stage. Explain the requirement, the timeline and what you will ask them to provide. Early notice avoids last-minute disqualifications.
4. Define what you will ask for
Typically this includes evidence of the required CMMC status and supporting documentation, as the program rules specify. Prepare a standard request so every sub gets the same questions.
5. Add the right contract language
Include flow-down clauses, incident notification expectations and requirements for protecting CUI. Coordinate with counsel.
6. Plan for gaps
Some small subs will not be ready. Options include narrowing their scope so they do not touch CUI, providing a controlled environment for them to work within, or choosing alternate subs. Decide in advance how you will handle each case.
For subs: get ready
If you are a subcontractor, consider these steps.
- Ask what is needed. Find out which contracts include CUI and what the prime expects from you.
- Scope narrowly. Determine what systems truly handle CUI and consider an enclave.
- Compare to NIST SP 800-171. Run a self-assessment to identify gaps, and document them in a plan.
- Fix the high-impact items first. Multi-factor authentication, encryption, access control, logging and incident response often drive the most improvement.
- Write the policies. Documentation matters, and so does proving people follow it.
- Choose providers carefully. Managed service and cloud providers that touch CUI may need to meet requirements of their own.
- Keep evidence. Assessors want proof such as configuration screenshots, logs, training records and policies.
Common pitfalls
- Sharing CUI by regular email with every sub because it is convenient.
- Assuming a sub's general IT security satisfies the requirement without evidence.
- Waiting until award to start discussions.
- Treating CMMC as a one-time project rather than an ongoing practice with annual affirmations.
A realistic timeline
Building a compliant environment takes months, not weeks. Primes who begin now will have time to support subs. Subs who begin now will have time to choose the most cost-effective path.
How Ironfield Cyber helps
Ironfield Cyber works with primes to build subcontractor communication and readiness programs, and with subs to scope, assess and remediate. If you want to start with a short gap review against NIST SP 800-171, we can do that and give you a prioritized list.