CMMCpedia
Work with me

Terms / The contract

Flow-down

Passing a contract requirement to your suppliers. Under 32 CFR 170.23 the CMMC level you flow down depends on what each supplier will handle.

Also called flowdown, flow down, flow-down clause.

Official Source Material

CMMC requirements apply to prime contractors and subcontractors throughout the supply chain at all tiers that will process, store, or transmit any FCI or CUI on contractor information systems in the performance of the DoD contract or subcontract.

Source: 32 CFR 170.23(a), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

Flow-down is how a Government requirement reaches a company the Government never contracted with.

You insert the substance of a clause into your subcontract, and your supplier does the same below it. This is why a third-tier machine shop carries obligations from a contract it has never seen. CMMC flows down at every tier that will process, store, or transmit the protected information, and nothing about the number of tiers changes that.

The level you flow down follows the information, not your own status.

Section 170.23 sets four cases. A supplier handling only Federal Contract Information gets Level 1 (Self). A supplier handling Controlled Unclassified Information gets Level 2 (Self) as a minimum. If your prime contract requires Level 2 (C3PAO), that supplier gets Level 2 (C3PAO). If your prime contract requires Level 3, your supplier still gets Level 2 (C3PAO). Flowing your own level down to everyone is the most common and most expensive mistake in this area.

Sanitize before you flow down, because it is the cheapest lever you have.

What you send decides what your supplier must build. Strip the controlled content, redact the identifying detail, or split the package so most suppliers receive only ordinary business information. A construction prime that separated controlled drawings from routine material orders left most of its trades at basic hygiene. Do this work before the award, not after a supplier tells you the cost.

Verification is your job, and it happens before award.

DFARS 252.204-7021 requires you to ensure a supplier holds the appropriate status before you award. DFARS 252.204-7020 separately bars award to a supplier without a current NIST SP 800-171 assessment. Collect the evidence and keep it. A prime contractor that awards on a promise has a finding of its own.

What falls short

  • A subcontract that mentions CMMC in a cover email. Flow-down works by inserting clause text into the agreement.
  • Flowing the clause down and never checking the result. The clauses require you to ensure status before award, which is an act, not a term.
  • Omitting flow-down from a commercial services subcontract. The clauses reach commercial products and services and exclude only commercially available off-the-shelf items.

Edge cases

  • Your supplier only receives hard copy. Paper that holds the protected information is still in scope, and printing does not remove the obligation.
  • A supplier works inside your environment on your equipment. That may leave them holding nothing of their own, but write down what they can reach and get the arrangement documented before you rely on it.
  • DoD gives specific guidance on flow-down in a particular solicitation. Paragraph (b) of 170.23 allows this, so the contract governs where it speaks.

Over-engineering

  • Requiring Level 2 (C3PAO) from every supplier to keep the process simple. Each unnecessary level costs a supplier an assessment fee and costs you suppliers who leave.
  • A supplier questionnaire that asks about every security control. Status, level, assessment date, and the CMMC unique identifier are what the clauses actually require you to verify.