Supply Chain Risk Management for defense research and development firms
Your university partner is part of your CUI flow.
Research firms share test data and reports with universities, partner labs and specialist subs. We work out what flows down to each of them and support them through their own self-assessments. Capital Cyber, based in Leesburg, Virginia, provides Supply Chain Risk Management for defense research and development firms and works on-site across Northern Virginia.
For R&D firms that collaborate or subcontract, and the partners who answer to them.
Why are research collaborations a supply chain risk?
Because the data travels. DFARS 252.204-7012 requires the clause in subcontracts where performance will involve covered defense information, and leaves the call to you as the contractor passing the data down: does the information the partner needs keep its identity as covered defense information.
A university lab that receives your controlled test data on its own systems is part of the program from that moment, whatever the collaboration agreement says.
Does a university partner's research status change anything?
Only what is in writing. Under DFARS 252.204-7000, the fundamental research exception rests on a written determination by the contracting officer for a project involving no covered defense information. If your partner's piece of the work has no such determination and touches controlled data, treat it as controlled.
What can you do instead of flowing data down?
Share only what is not controlled, have the partner work inside your environment on accounts you issue, or flow the clauses and confirm the partner can meet them. Picking one of those for each partner, in writing, before data moves is most of the work.
What should you ask a research partner?
Whether they have a current NIST SP 800-171 assessment posted in SPRS for the systems that will hold the data, whether their cloud storage meets the FedRAMP Moderate equivalent requirement, how files move between you, and how they report a cyber incident and pass the report number up to you.
Which requirements does this touch?
NIST SP 800-171AC.L1-3.1.20
External Connections
Connections to a partner's systems are verified and controlled. Evidence is a list of external systems that receive controlled data and the agreement behind each.
AC.L1-3.1.22
Control Public Information
Controlled data does not reach a public repository, preprint or project website through a collaborator. Evidence is the review step for anything posted publicly.
IR.L2-3.6.2
Incident Reporting
A partner knows how to report a cyber incident to DoD and passes the incident report number up. Evidence is the flow-down language and the partner's procedure.
What do you receive?
SCOPED PER CLIENTA read of your contract clauses
The DFARS and CMMC clauses in your awards and what each requires of you.
A map of your partners
Which universities, labs and subs the obligations flow down to, and at what level.
Self-assessment support
Support for your partners and subs through their own NIST SP 800-171 self-assessments, so their answers can be relied on.
Flow-down language and partner questions
For your own subcontracts and agreements, ready for your counsel to review.
What does this service not include?
Scoped to CMMC and NIST SP 800-171 flow-down. Broader supply chain risk, such as counterfeit parts or foreign ownership, is outside it. Each subcontractor's self-assessment and affirmation remain its own; we support them, we do not sign them. Contract and requirements work, not legal advice, and not a substitute for your own counsel reviewing language before it goes into a signed agreement.
The full service, for any industry: Supply Chain Risk Management. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Does a university partner need its own NIST SP 800-171 assessment?
If it receives covered defense information on its own systems, the clauses flow down to it. If it works only inside the research firm's environment, or receives only data that is not controlled, the answer can differ. Decide it per partner, in writing.
Who decides whether data we share with a partner is still CUI?
DFARS 252.204-7012 places that determination on the contractor passing the information down, with the option to consult the contracting officer. Write the decision down for each partner.
Do you sign our partners' self-assessments?
No. Each partner's self-assessment and affirmation remain its own. We support them through it so the answers a research firm receives can be relied on.
Is your flow-down language legal advice?
No. We provide flow-down language and partner questions for your counsel to review before anything goes into a signed agreement. We are not a law firm.
More for defense research and development firms
Supply Chain Risk Management in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.