Supply Chain Risk Management for government IT and services contractors
Flow-down across task orders and teaming partners.
Services contracts move CUI across company lines all the time: to a sub on one task order, from a prime on another, into a shared workspace on a proposal. We map where it goes and what each party owes. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for government IT and services contractors and works on-site across Northern Virginia.
For IT and services primes managing subcontractors, and subs answering a prime's questions.
Why is flow-down harder on task orders?
Because the obligation is set per subcontract, and in services work the subcontracts multiply. One sub may hold FCI on a help desk task order and CUI on an engineering one. Another may be on your team for a proposal and never touch contract data at all. A single blanket answer for each partner is usually wrong for at least one of them.
DFARS 252.204-7021 asks the prime, before awarding a subcontract, to confirm the sub has a current CMMC status appropriate to the information being flowed down. That has to be worked out per task order, not per company.
What does 7012 require you to pass down?
DFARS 252.204-7012 requires the clause itself, without alteration except to identify the parties, in subcontracts that will involve covered defense information or operationally critical support. It also requires subcontractors to tell you when they ask the contracting officer to vary from a NIST SP 800-171 requirement, and to give you the incident report number when they report a cyber incident to DoD.
That second set of obligations is the one most subcontracts miss. If your sub reports an incident and you never hear about it, you have a gap in your own program as well as theirs.
What happens when you are the subcontractor?
Your prime will ask for your SPRS score, your CMMC status, and increasingly for something behind them: a current SSP, a POA&M, an answer about where CUI lives. The aim is to answer those accurately and quickly, because a prime that cannot get a straight answer will find a sub that can give one.
We help subcontractors work through their own NIST SP 800-171 self-assessments so the answers hold up. The self-assessment and the affirmation remain yours; we support them, we do not sign them.
Does a teaming agreement count?
Proposal work before award may or may not involve controlled information, depending on what the solicitation released and how it was marked. If a partner receives marked material through your shared workspace, the flow is real even if the subcontract is not signed yet. The map should include those flows, with the language for them left for your counsel to review.
Which requirements does this touch?
NIST SP 800-171AC.L2-3.1.3
Control CUI Flow
Knowing and controlling which teaming partners receive CUI, through which channel, on which task order. Evidence is a documented flow per subcontract and the sharing controls that match it.
IR.L2-3.6.2
Incident Reporting
Your incident process should include receiving incident report numbers from subcontractors, as 7012 paragraph (m) requires them to provide. Evidence is the procedure and the subcontract language that asks for it.
RA.L2-3.11.1
Risk Assessments
A periodic risk assessment that includes the subcontractors and partners who receive CUI from you. Evidence is the assessment, dated, with suppliers named and their status recorded.
What do you receive?
SCOPED PER CLIENTA read of the clauses in your prime contracts
DFARS and CMMC clauses on each vehicle and task order, and what each requires of you.
A map of flow-down
Which subcontractors and teaming partners those obligations reach, and at what level, task order by task order.
Subcontractor self-assessment support
Helping your subs through their own NIST SP 800-171 self-assessments so the answers you receive can be relied on.
Flow-down language and supplier questions
For your own subcontracts, ready for your counsel to review.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does every sub on our contract need the same CMMC level as us?
No. DFARS 252.204-7021 ties the subcontractor's required status to the information actually flowed down to it. A sub holding only FCI on its task order needs what FCI requires, not your level.
Can you write our subcontract clauses?
We draft flow-down language and supplier questions for your counsel to review before anything goes into a signed agreement. We are not a law firm, and this is contract and requirements work, not legal advice.
Our prime sent us a security questionnaire. Can you help?
Yes. We help subcontractors answer accurately, which usually means working through the self-assessment first so the answers match what is in place. The answers and any affirmation remain yours.
Where does this work start?
With the prime contracts and task orders you hold today, and a list of the subcontractors and teaming partners who touch that work.
More for government IT and services contractors
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.