Terms / The contract
Prime contractor
The company holding the contract directly with the Government. It owns the CMMC obligation for the whole supply chain beneath it.
Also called prime, primes.
Official Source Material
Prime Contractor, means a person who has entered into a prime contract with the United States.
Source: 48 CFR 3.502-1, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
The prime holds the contract with the Government, and the responsibility runs all the way down.
A prime contractor has entered into a contract directly with the United States. Everyone below it works under a subcontract. The Government looks to the prime for performance of the whole scope, including the cybersecurity obligations. That is why a prime asks you harder questions than the contracting officer ever will. That pressure is the prime managing its own risk, not the prime being difficult.
A prime cannot waive CMMC for you, and cannot grant you an exception.
Section 170.5 of 32 CFR Part 170 reserves waivers to the Government, before solicitation, for an entire contract. A prime has no authority to relieve you of a requirement it must flow down. Treat any offer to do so as a misunderstanding worth correcting in writing, because the obligation survives the conversation and lands on you.
The prime decides what information reaches you, and that decision sets your cost.
Flow-down under 32 CFR 170.23 keys on what you will process, store, or transmit. A prime that sends you Controlled Unclassified Information puts you at Level 2. A prime that strips it first, or sends you only Federal Contract Information, leaves you at Level 1. Ask what will actually be sent, and ask whether it can be sanitized before it arrives. That question has saved small companies six figures.
Ask your prime for a date, not for a commitment.
Primes will not promise future work in exchange for your compliance spend, and asking pushes the conversation nowhere. Ask instead what date they need you compliant by. That gives you something to plan backwards from. Then send a status update they did not ask for: your target assessment date, your current score, and your scope decision. Few suppliers do this, which is exactly why it works.
What falls short
- A supplier agreement that names CMMC without naming the clause. DFARS 252.204-7021 requires the substance of the clause in the subcontract, and a general reference does not carry the obligation.
- A prime accepting a supplier's word about its status. Paragraph (f)(2) of the clause asks the prime to ensure the status exists before award.
- Waiting to hear from your prime before acting. Silence usually means you are not on the critical supplier list, which is information rather than reassurance.
Edge cases
- You are both a prime on one contract and a subcontractor on another. Both sets of obligations apply, and the higher level governs the system that performs both.
- Your prime offers you equipment inside its own environment. That reduces what you hold, but it does not automatically remove your own obligation, so get the arrangement described in writing.
- Your prime overmarks what it sends you. Push back with the specific pages. Asking the customer to identify what is genuinely controlled is a normal request, and it has cut assessment scope dramatically for companies that asked.
Over-engineering
- Building to the prime's own security standard. Your obligation is the level the subcontract states under 32 CFR 170.23, not the prime's internal program.
- Certifying at Level 2 (C3PAO) because your prime holds it. The subcontract level follows the information you receive, and a prime at Level 3 still only requires Level 2 (C3PAO) from you.