Many companies first meet CMMC as an email from a prime contractor. It asks for your SPRS score, your CMMC status, or a completed questionnaire, often with a deadline attached. You may never have held a DoD contract directly, and the request may not say which level you need or why.
Subcontractors carry the same requirements as primes for the information they handle, with less visibility into the contract that created them. This article explains how CMMC reaches you, how to work out which level applies, and what to agree with your prime before you spend money on an assessment.
How the requirement reaches you
CMMC applies to subcontractors through flow-down. The DFARS CMMC clause, 252.204-7021, requires a prime to include the CMMC requirement in subcontracts where the subcontractor will process, store or transmit FCI or CUI. It also requires the prime to confirm the subcontractor has a current CMMC status at the right level before awarding the subcontract. The obligation flows on to every tier below you in the same way.
CMMC sits on top of older clauses that already flowed down:
DFARS 252.204-7012 requires contractors handling covered defense information to implement NIST SP 800-171, report cyber incidents to DoD, and flow the clause to subcontractors who handle that information.
DFARS 252.204-7019 and 252.204-7020 require a current NIST SP 800-171 assessment posted in SPRS, and require primes to check that their subcontractors have one.
So even before a contract carries a CMMC requirement, a subcontractor handling CUI may already owe a NIST SP 800-171 implementation and an SPRS score. If you are unsure what that score represents, see the SPRS score, explained.
The level follows the information, not the prime
Your level is set by what flows to you, not by the level your prime holds. A prime certified at Level 2 may have subcontractors who need only Level 1, and some who need nothing at all.
If you receive only Federal Contract Information, Level 1 is the expected requirement. That means the 15 basic safeguarding requirements, an annual self-assessment and an annual affirmation.
If you receive CUI, you need Level 2. Whether that is a self-assessment or a C3PAO assessment depends on the requirement the prime flows to you, which in turn reflects the prime contract.
If your subcontract is solely for commercially available off-the-shelf items, the CMMC rules exclude it.
Level 3 is rare and applies to specific high-priority programs. If a prime tells you Level 3 applies, ask them to point to the contract language. The broader structure is in CMMC levels, explained.
Settle what you will receive before anything else
The most valuable conversation you can have with a prime is about what information they will send you. It costs nothing and it can change your scope entirely.
Ask your prime, in writing:
Will we receive CUI under this subcontract, or only FCI?
If CUI, which categories, and how will it be marked?
Which CMMC level and assessment type will the subcontract require?
Will we need to generate CUI ourselves, for example drawings or technical data derived from what you send?
Is there a way to do the work without CUI leaving your environment?
The last question matters. Some primes give subcontractors access to CUI through a system the prime operates and assesses. Depending on how that access is configured, it can reduce what in your own environment falls in scope. Confirm how your assessor will treat the arrangement before relying on it.
Once you know what you will receive, map where it will live. The method is in scoping where CUI lives in your environment.
What your prime will ask you for
Primes now carry an obligation to verify their supply chain, so expect requests. They typically fall into three kinds.
Status. Your CMMC status and level, and the date it was posted. For older clauses, your SPRS score and assessment date. These are short answers, and you should have them ready.
Questionnaires. Some primes send their own security questionnaires on top of CMMC. Answer them consistently with your SSP. Two different descriptions of the same control, sent to two primes, are a problem if either is ever checked.
Documents. Some primes ask for your System Security Plan. Your SSP describes your security architecture in detail, so it is reasonable to agree what you share, and under what confidentiality terms, rather than sending the full document by default.
One environment, many primes
If you supply several primes, you do not need a separate assessment for each. A CMMC status applies to an assessed environment, and every prime that flows you work handled in that environment can rely on it. What you do need is one set of answers, kept current, that you give to all of them.
Your incident reporting duty as a subcontractor
DFARS 252.204-7012 does not stop at implementing controls. A subcontractor covered by the clause must report a cyber incident affecting covered defense information to DoD within 72 hours of discovery. Reporting requires a DoD medium assurance certificate, which takes time to obtain, so get one before you need it.
The clause also requires you to give the incident report number to your prime, or the next higher-tier subcontractor, as soon as practicable. You will also need to preserve images of affected systems and provide access for DoD forensic analysis if requested. Write these steps into your incident response plan now; working them out during an incident is the wrong time.
A starting plan for a small subcontractor
If you are a small company receiving its first CMMC request, this order keeps cost in proportion to what you actually handle:
Confirm the information. Get the prime's answer, in writing, on FCI versus CUI.
Minimize it. Decline CUI you do not need. Consider whether the work can happen in a small, separate environment.
Implement the requirements for that scope. The 15 Level 1 requirements for FCI, or the 110 NIST SP 800-171 requirements for CUI. The practical detail is in NIST 800-171: protecting CUI in practice.
Document it. An SSP for Level 2, and a record of what you assessed for Level 1.
Assess and affirm. Self-assessment or C3PAO, as your subcontract requires, then post the result and affirm it.
Prepare for the ongoing work. Annual affirmations, incident reporting, and flowing the requirement to your own suppliers if they touch the same information.
Step six is the one subcontractors overlook. If you send CUI to a machine shop, a translation service or a consultant, you are now the prime in that relationship, with the same verification duty.
How TrustLynce helps
TrustLynce keeps one set of controls and evidence mapped to NIST SP 800-171, so the answers you give each prime come from the same source. The third-party risk workflow tracks your own suppliers and their reassessment dates when the requirement flows on past you. Our CMMC page covers the framework.