CMMC flow down requirements: how do primes check subcontractors?

If your firm sends DoD project drawings to structural, MEP or civil subconsultants, CMMC flow down requirements decide what each of them must hold before the subcontract is signed. Getting it wrong can delay an award or put CUI on systems that do not meet the required level.

Does CMMC apply to subcontractors?

Yes. 32 CFR 170.23 says CMMC requirements apply to prime contractors and subcontractors "throughout the supply chain at all tiers" that process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on their own systems. The prime must comply and must require its subcontractors to comply and to flow the requirements down further.

For an architecture or engineering firm, that supply chain is usually a list of subconsultants: structural, MEP and civil engineers, surveyors, specifiers, renderers and reprographics vendors. If you send any of them drawings, specifications or site data marked as CUI, they are inside the requirement. If you are the subconsultant, the same rule reaches you through your prime.

What CMMC level does a subcontractor need?

The level depends on the information you flow down. Section 170.23(a) sets four cases:

• FCI only: the subcontractor needs a CMMC status of Level 1 (Self).
• CUI: the subcontractor needs at least Level 2 (Self).
• CUI, where the prime's contract requires Level 2 (C3PAO): the subcontractor needs at least Level 2 (C3PAO).
• CUI, where the prime's contract requires Level 3 (DIBCAC): the subcontractor needs at least Level 2 (C3PAO).

Paragraph (b) adds that DoD may give specific flowdown guidance in a solicitation or contract. Read the contract before relying on the default table.

How does the Phase 2 suspension change flowdown?

It removes the C3PAO cases for now and leaves the self-assessment cases in place. On July 13, 2026, the Department of War suspended CMMC Phase 2, which was to begin on November 10, 2026 and make Level 2 (C3PAO) certification a condition of award. The department's implementing memo directs contracting officers to remove C3PAO and DIBCAC requirements from solicitations and contracts, and states that Level 1 (Self) and Level 2 (Self) still apply.

So during the suspension, most flowdown questions on AEC projects come down to two statuses: Level 1 (Self) for subconsultants who only receive FCI, and Level 2 (Self) for those who receive CUI. We cover the broader picture in CMMC Phase 2 is suspended. What still applies on Nov 10?

Further guidance is expected after the department's program review. Check the CMMC clause and level in each solicitation and contract you hold, and treat the contract language as controlling.

What must a prime check under CMMC flow down requirements?

A prime must confirm the subcontractor's status before award. DFARS 252.204-7021 (NOV 2025) sets three duties in its subcontract paragraphs:

• Paragraph (f)(2): before awarding a subcontract, ensure the subcontractor has a current CMMC certificate or current CMMC status at the level appropriate for the information being flowed down.
• Paragraph (d)(4): ensure subcontractors complete an affirmation of continuous compliance by their affirming official before award, and maintain it annually, for each system that handles FCI or CUI in performance of the subcontract.
• Paragraph (f)(1): insert the substance of the clause in subcontracts that will involve FCI or CUI, including subcontracts for commercial products and services. Commercially available off-the-shelf (COTS) items are excluded.

A separate clause still applies to CUI work. Under DFARS 252.204-7020 paragraph (g), a prime may not award a subcontract that requires NIST SP 800-171 compliance unless the subcontractor has completed at least a Basic Assessment within the last three years, posted in SPRS.

The rule does not spell out how a prime collects this proof. A practical approach is to request it in writing as part of the subcontract package: the CMMC unique identifier, the CMMC status level and status date, the date of the most recent affirmation, and the name of the affirming official.

What else flows down besides CMMC?

The incident reporting clause flows down too. DFARS 252.204-7012 paragraph (m) requires the prime to include the clause, without alteration except to identify the parties, in subcontracts that involve covered defense information or operationally critical support.

The prime must also require subcontractors to tell it when they ask the contracting officer to vary from a NIST SP 800-171 requirement, and to give the prime the DoD incident report number when they report a cyber incident. The clause defines rapid reporting as within 72 hours of discovery. A subconsultant who suffers a breach of your project files has its own 72-hour clock, and you need to hear about it.

What should an AEC firm do this quarter?

This quarter, build a short flowdown file for every DoD project before the next subcontract goes out.

• List every subconsultant and vendor on each DoD project and mark what they receive: FCI, CUI, or neither.
• For each one, record the required level under 170.23 and the contract's own flowdown language.
• Request the CMMC unique identifier, status date, latest affirmation date and affirming official in writing, and file the response.
• Confirm subcontract templates include the substance of 252.204-7021, 252.204-7020 and 252.204-7012.
• Calendar each subconsultant's annual affirmation date so a lapse does not surface at your next task order.
• Limit what you send. A subconsultant who only needs a site plan may not need the full CUI set, which can change the level required.
• If you are the subconsultant, keep your own SPRS record and annual affirmation current so you can answer a prime's request the same day.

Whether a given subconsultant handles CUI, and which level applies, is a decision for your firm and its contracts and legal advisers.

How does s90 help?

s90 runs IT for architecture, engineering and construction firms in Los Angeles and Orange County, including firms on defense work. We maintain the NIST SP 800-171 controls behind a Level 2 self-assessment, keep the evidence current between affirmations, and help firms set up secure ways to share CUI with subconsultants so less of it lands on systems you do not control. If you want help building a flowdown file before your next DoD subcontract, we are glad to help.