Supply Chain Risk Management for defense construction contractors
Which trades get the marked sheets, and what they owe.
A general contractor on a military project may have a dozen trades, and only some of them need marked drawings. We sort out which ones do, what the clauses ask of each, and how to check before award. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for defense construction contractors and works on-site across Northern Virginia.
For general contractors and design-build firms managing trades, and for trades answering a GC's questions.
Does every trade on the job need the same CMMC status?
No. DFARS 252.204-7021 asks the prime to confirm, before awarding a subcontract, that the sub has a current CMMC status appropriate for the information flowed down to it. A security integrator receiving marked access control drawings and a site concrete sub receiving only civil sheets are in different positions.
The practical work is sorting trades by the sheets they need. That sorting is best done when bid packages are assembled, because the bid package is the first place marked drawings leave your control.
What does 7012 make you include in each subcontract?
DFARS 252.204-7012 requires the clause, without alteration except to identify the parties, in subcontracts that involve covered defense information. It also requires the sub to give you the incident report number when it reports a cyber incident to DoD, and to tell you when it asks the contracting officer to vary from a NIST SP 800-171 requirement.
Construction subcontract forms often predate these obligations. Language that adds them is drafted for your counsel to review before it goes into a signed agreement.
What about bid packages sent to trades who never win?
Marked drawings sent to bidders are still marked drawings. If a trade receives a marked set to price the work and is not awarded, that set is still somewhere in their email and on their estimator's laptop. The map should record who received what during bidding and how it was recovered or destroyed.
What if you are the trade?
Your GC will ask for your SPRS score and CMMC status before sending marked sheets, and may ask what systems you will put them on. We help trades work through their own NIST SP 800-171 self-assessments so the answers hold up. The self-assessment and the affirmation remain yours; we support them, we do not sign them.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
A record of which trades receive which marked sheets, through which channel. Evidence is the distribution log for bid packages and issued sets, matched to subcontracts.
IR.L2-3.6.2
Incident Reporting
Your incident process includes receiving incident report numbers from trades, as DFARS 252.204-7012 paragraph (m) requires them to provide. Evidence is the procedure and the subcontract language that asks for it.
PS.L2-3.9.2
Personnel Actions
When a trade finishes or a trade worker leaves the job, their access to drawings and platforms ends. Evidence is account removal records matched to subcontract completion dates.
What do you receive?
SCOPED PER CLIENTA read of the clauses in your prime contracts
DFARS and CMMC clauses on each project, and what each requires of you.
A map of flow-down
Which trades and suppliers receive marked drawings, at what level, from bidding through closeout.
Subcontractor self-assessment support
Helping your trades through their own NIST SP 800-171 self-assessments so their answers can be relied on.
Flow-down language and supplier questions
For your subcontract forms, ready for your counsel to review.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Our trades are small. Do they really need CMMC?
A trade that receives marked drawings carries the flowed-down DFARS clauses and must protect them on its own systems. A trade that only receives unmarked information may need far less. Size does not decide it; what they receive does.
Can you write our subcontract clauses?
We draft flow-down language and supplier questions for your counsel to review before anything is signed. We are not a law firm, and this is contract and requirements work, not legal advice.
Can a trade view drawings without receiving a copy?
Yes, if you give them limited access to an environment you control rather than sending files. That keeps the drawings inside your boundary, though the trade's access still has to be managed and evidenced.
Where does this work start?
With the prime contracts you hold today and a list of the trades and suppliers who receive drawings or project information on that work.
More for defense construction contractors
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.