CMMCpedia
Work with me

Terms / The contract

Subcontractor

Any company furnishing supplies or services under a prime contract. CMMC reaches every tier that handles FCI or CUI, not just the first.

Also called sub, subs, supplier.

Official Source Material

Subcontractor — (1) Means any person, other than the prime contractor, who offers to furnish or furnishes any supplies, materials, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract; and (2) Includes any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor.

Source: 48 CFR 3.502-1, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

CMMC reaches every tier, not just the company the prime buys from.

Section 170.23 of 32 CFR Part 170 applies CMMC requirements throughout the supply chain at all tiers that will process, store, or transmit this information. Being a third-tier supplier does not put you outside the program. Your obligation comes from your own subcontract and from what you handle, not from your distance from the Government.

What you handle sets your level, and the rule is short enough to memorize.

If you will only handle Federal Contract Information, you need Level 1 (Self). If you will handle Controlled Unclassified Information, Level 2 (Self) is the minimum. If you handle it and the prime contract requires Level 2 (C3PAO), you need Level 2 (C3PAO). If the prime contract requires Level 3, you still only need Level 2 (C3PAO). That last line surprises people who assume the prime's level flows down unchanged.

You must have a score posted before a prime can award you the work.

Paragraph (g)(2) of DFARS 252.204-7020 forbids a prime contractor from awarding a subcontract subject to NIST SP 800-171 unless you completed at least a Basic Assessment within the last three years. A Basic Assessment is your own review of your system against the standard. Post your score before the prime asks for it. A supplier with no score is a supplier the prime cannot use, whatever the relationship.

Read your own subcontract, because that is the document that binds you.

Your contract is with the company above you, not with DoD. The obligations arrive as flow-down clauses inserted into your subcontract. Search it for 204-7012, 204-7019, 204-7020, 204-7021, and 52.204-21. If you are a subcontractor to a subcontractor, expect your customer to require approval of your own suppliers and to collect their status back up the chain.

What falls short

  • A statement that you are too small or too far down the chain. Section 170.23 names all tiers, and size is not an exemption.
  • A subcontract signed without reading the flow-down clauses. They bind you whether or not you noticed them.
  • An inflated score posted to keep a prime happy. Misrepresenting a score to win work is pursued under the False Claims Act, and supply chain managers are the people who notice first.

Edge cases

  • Your prime sends you material marked CUI that plainly is not. Send it back and ask the customer to identify what is genuinely controlled. Overmarking is common, and a large marked package often turns out to be a small controlled one.
  • You can do the work without ever receiving the controlled material. Ask the prime to sanitize or descope before flow-down. Level 1 costs a fraction of Level 2.
  • You decide not to pursue CMMC. That is a legitimate business decision, and it is better made deliberately than discovered at an award you cannot accept.

Over-engineering

  • Certifying your whole company when one team performs the subcontract. Scope the assessed environment to the systems that perform the work.
  • A variance request to the contracting officer as a first move. The mechanism exists under DFARS 252.204-7012, and it is for a requirement that genuinely cannot apply, not for a requirement that is inconvenient.