Answer Your Prime's Cybersecurity Questionnaire With Evidence, Not Promises

What is my prime actually asking for when it sends a cybersecurity questionnaire?

A prime that holds a Department of War contract with DFARS 252.204-7012 has to flow that clause down to subcontractors whose work involves covered defense information. If the contract carries DFARS 252.204-7021, the prime also has to make sure subcontractors meet the required CMMC level. Under the rule, it cannot treat your status as someone else's problem.

The questionnaire is how the prime documents that it checked. Most of them ask some version of these questions:

• Do you handle Federal Contract Information, Controlled Unclassified Information, or both?
• Do you have a System Security Plan covering the systems that touch that information?
• Have you posted a NIST SP 800-171 self-assessment score in the Supplier Performance Risk System (SPRS), and when?
• Do you have open items on a Plan of Action and Milestones?
• Can you report a cyber incident to the Department of War within 72 hours, as 7012 requires?
• If you use a cloud service for CUI, does it meet the FedRAMP Moderate baseline or its equivalent?
• What CMMC status do you hold, or which assessment are you preparing for?

Each of these maps to a contract requirement. Read the questionnaire that way and it stops looking like paperwork. It is your prime asking you to show the same evidence an assessor would ask for.

Why is checking "yes" without evidence a risk for my company?

A questionnaire answer can end up in the prime's supplier file, in its own compliance records and sometimes in its reports to the government. If the answer is wrong, the prime has been misled and so, possibly, has the Department of War.

The Department of Justice launched its Civil Cyber-Fraud Initiative in 2021 to use the False Claims Act against contractors that misrepresent their cybersecurity. Most of the public attention has gone to prime contractors. A subcontractor's false statement can still be part of the chain, though, and primes know it. That is why more of them now ask for supporting documents and not just checkboxes.

There is also a practical risk. If you check "yes" on multi-factor authentication and the prime's team, or later a CMMC assessor, asks to see it enforced on remote access and privileged accounts, you need to be able to show it. If you can't, the relationship takes the hit. Saying "not yet, and here is our plan" goes over much better than having a "yes" fall apart.

What evidence should sit behind each answer?

NIST SP 800-171A and the CMMC assessment process both describe three ways to verify a requirement: examine (look at documents and records), interview (talk to the people responsible) and test (watch the control work). Build your answers so that each one survives all three.

Here is a practical way to match questionnaire answers to evidence:

1. Data handling: a short written statement of what FCI and CUI you receive, from whom, and where it lives, along with a network or data flow diagram showing the boundary.
2. System Security Plan: the current SSP, with a version and approval record, describing how each NIST SP 800-171 requirement is met or not met.
3. SPRS score: the score you posted, the date of the assessment and the SSP version it was based on. DFARS 252.204-7019 requires a current assessment, meaning one completed within the last three years.
4. Plan of Action and Milestones: the POA&M listing each unmet requirement, the fix you plan, who owns it and a target date.
5. Incident reporting: your incident response procedure, proof that you have the DoD-approved medium assurance certificate needed to report through DIBNet, and a record of a tabletop exercise or test. Under 7012, a subcontractor also has to give its prime the incident report number.
6. Cloud services: the provider's FedRAMP authorization listing or the equivalency documentation, plus your contract or configuration showing that CUI is actually stored in that environment.
7. Technical controls: screenshots or exported settings for things like multi-factor authentication, account lockout, audit logging and encryption, each dated and tied to the system it covers.
8. People controls: training completion records, access review logs and signed acknowledgments of acceptable use.

You do not have to attach all of this to every questionnaire. You do have to be able to produce it when someone asks. Write each answer so that a reader knows which artifact supports it.

How do I answer when the honest answer is "not yet"?

Answer it honestly and specifically. A blank or a vague "in progress" makes a prime nervous. A precise answer that names the gap, the plan and the date usually does not.

A strong "not yet" answer has four parts: the requirement in question, what you have in place today, the POA&M item number covering the gap, and the target date for closing it. For example, you might say that multi-factor authentication is enforced on email and remote access, that enforcement on the shop floor engineering workstation is tracked as a POA&M item, and that you expect to complete it within the quarter.

Two cautions. First, if a requirement is truly not applicable, write down why. Do not mark it "not applicable" just to avoid a gap. Second, CMMC limits which requirements can sit on a POA&M and how long they can stay open, and the CMMC rule at 32 CFR Part 170 also requires an affirmation from a senior company official. If you are working toward a CMMC assessment, read those rules before you describe your gaps to a prime. Otherwise your questionnaire answers and your later affirmation might not match.

How does the recent DFARS reorganization change what I tell my prime?

For most small suppliers, it changes very little in substance. Based on the Dentons summary, the deviation reorganizes where the cybersecurity requirements sit in the DFARS and keeps the adequate security obligation for covered defense information. A TrustedSec post from this past week covers a related, practical question: how FCI and CUI should be handled before a contract is awarded, and which organizations the CMMC clause gets flowed to.

The practical effect for you:

• Answer questionnaires against the clauses actually in your purchase order or subcontract, not against what you saw in an article.
• If your prime cites a clause number you don't recognize, ask which requirement it corresponds to. Do not guess.
• Keep your evidence organized by requirement, not by clause number. NIST SP 800-171 requirements stay stable even when the clause numbering changes.

How the deviation will be applied across every contract type and agency is not fully settled. If your prime's questionnaire relies on new numbering, a short written question back to the prime's supply chain or contracts team is a reasonable step.

How do I stop rebuilding answers for every new questionnaire?

Build a standing evidence package once and keep it current. Many small suppliers get questionnaires from several primes, each with its own format but nearly the same questions underneath.

A workable package includes a one-page company security summary, the current SSP, the POA&M, your SPRS score and assessment date, your incident response procedure, cloud provider documentation and a folder of dated technical evidence organized by NIST SP 800-171 requirement family. Assign one person to own it. Review it whenever your systems change and before each new questionnaire goes out.

With that in place, answering a questionnaire becomes mostly a matter of matching the prime's question to an artifact you already have. It also means that when an assessor eventually sits down with you, the evidence they ask for is the same evidence your primes have already seen.

Sources

• 32 CFR Part 170, Cybersecurity Maturity Model Certification Program
• NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information
• Department of Justice, Civil Cyber-Fraud Initiative announcement
• Dentons, CMMC Phase II Follow-Up: New FAR Part 40, CUI and Contractor Action
• TrustedSec, Handling Pre-Contract FCI and CUI
• ISI, Prime Contractor CMMC Requirements in 2026