Subcontractor CMMC Status: Three Questions to Ask Before You Award Work

Why do I have to check a subcontractor's CMMC status at all?

You have to check because your contract requires it. DFARS 252.204-7021 tells you to flow the CMMC clause down to any sub who will handle FCI or CUI.

The clause also has a timing rule. Before you award, you must make sure the sub has a current CMMC status at the right level for the data you send them.

DFARS 252.204-7020 adds a second check. Before you award a sub covered by 252.204-7012, the sub needs a NIST SP 800-171 assessment posted in SPRS that is no more than three years old.

An assessor who looks at your supply chain will ask how you checked. A sub's verbal "we're good" is not evidence.

Question 1: What CMMC level do you hold, and can you show me?

Start with the data you plan to send. The sub's level has to fit that data.

• FCI only: the sub needs at least a Level 1 self-assessment.
• CUI: the sub needs at least Level 2.
• If your contract requires Level 2 with a C3PAO assessment, a sub handling CUI needs that same C3PAO status.
• If your contract requires Level 3, a sub handling CUI needs at least a Level 2 C3PAO status.

Those floors come from the CMMC program rule at 32 CFR 170.23.

Then ask for proof in writing:

1. The level and the assessment type, self or C3PAO.
2. The status date.
3. The CMMC Unique Identifier (UID) from SPRS.
4. The latest affirmation by their affirming official.

Primes generally cannot look up a sub's record in SPRS. Ask the sub to send it to you.

Question 2: Does that status cover the systems that will handle our files?

A CMMC status applies to the systems that were assessed. It does not cover everything the company owns.

A shop may hold Level 2 for one secure enclave. Your drawings could still land on an engineer's laptop outside that enclave. In that case the status does not cover your work.

So ask where your files will live. Ask them to confirm that those systems are inside the assessed scope. The clause ties UIDs to information systems, so ask for the UID for those systems.

If they store your CUI in a cloud service, ask about it too. Under 7012, that service must meet FedRAMP Moderate or an equivalent standard.

Question 3: Is the status current, and will you tell us if it changes?

A status can expire. Ask for the dates that control it.

• A Level 2 conditional status means open items remain on a plan of action. Those items must close within 180 days.
• A final Level 2 status lasts three years. The sub must affirm it every year.
• Level 1 requires a new self-assessment and affirmation every year.

Ask the sub to tell you in writing if their status lapses or changes.

Ask about incidents too. Under 7012, a sub must report a cyber incident to the Department of War within 72 hours. The sub must also give you the incident report number. Find out who on their side does that.

What should I keep on file for my assessor?

No rule sets an exact format. A simple folder for each sub works well.

Keep these items in it:

• The subcontract, showing the 7012, 7020 and 7021 flowdowns.
• A note on what you send them: FCI, CUI, or both.
• Their level, assessment type, status date, UID and latest affirmation.
• The date you checked, which should come before the award date.
• Their confirmation that your files stay inside the assessed scope.
• Reminder dates for affirmations and any conditional deadline.
• Their incident reporting contact.

When an assessor asks about a sub, you open the folder. That is the whole goal.

Does the Phase 2 pause change subcontractor CMMC status checks?

No. If 7021 is in your contract, the check before award still applies.

Phase 2 is suspended. We will not guess when it resumes.

Even without 7021, the 7012 and 7020 flowdowns still apply. Your subs still owe NIST SP 800-171, a current SPRS assessment and incident reporting.

Sources

• 48 CFR 252.204-7021, CMMC Requirements (eCFR)
• 48 CFR 252.204-7020, NIST SP 800-171 DoD Assessment Requirements (eCFR)
• 48 CFR 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (eCFR)
• 32 CFR Part 170, CMMC Program (eCFR)
• DoD CIO CMMC program page
• Compass MSP, Why Waiting Is the Costliest Strategy in Defense Contracting