CMMC for subcontractors: which level applies to your company
A subcontractor that handles only Federal contract information needs CMMC Level 1 (Self). A subcontractor that handles controlled unclassified information (CUI) needs at least CMMC Level 2 (Self), and it needs Level 2 (C3PAO) when the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC). The level is set by two things: the information your company will process, store or transmit for the prime, and the level the prime's contract demands. Under 32 CFR 170.23(a), CMMC applies to subcontractors at every tier that touch FCI or CUI, and the prime must flow the requirement down. Your company owns its own status and its own affirmation. A prime can confirm your status in its records, but it cannot affirm compliance for you, and your Affirming Official makes that statement in SPRS for your own systems.
Start by mapping each data flow in the subcontract. Identify whether you will receive, create or return FCI only, or whether you will handle CUI, including CUI that passes through email, shared drives, ticketing tools or a managed service provider. Then read the subcontract and any DoD-specific flow-down guidance, which 32 CFR 170.23(b) allows a solicitation or contract to provide. The contract text is the document that tells you whether the prime requires a C3PAO assessment, so ask the prime's contracts or security team to confirm the required level in writing before you commit to a schedule or budget. If the subcontract covers commercial products or services, confirm whether any part of it is a COTS item, since DFARS 252.204-7021 excludes COTS items from the flow-down.
Before you accept an award, expect the prime to check that your CMMC status is current at the level matching the information flowed down. Under DFARS 252.204-7021, a Final Level 2 or Level 3 status must be no older than three years, a Final Level 1 status no older than one year, and a Conditional status no older than 180 days, each with a current affirmation. Confirm your status and affirmation dates in SPRS now, and assign an Affirming Official who will re-affirm annually. Also remember that DFARS 252.204-7012 applies separately to any subcontract involving covered defense information, so a subcontractor handling CUI must implement NIST SP 800-171 whatever its CMMC status. Because the DoW suspended Phase II in July 2026 and is revising requirements through a class deviation, confirm with your prime which level its current solicitation actually requires before you spend on a C3PAO assessment.
What the prime must verify before awarding a subcontract
The prime confirms that the subcontract carries the required clause, that the subcontractor holds a current CMMC status at the level its flowed-down information demands, and that the subcontractor's own Affirming Official has affirmed continuing compliance. Each step produces a record the prime can show a contracting officer.
Determine the level the subcontract requires
The prime identifies whether the subcontractor will process, store or transmit Federal contract information or controlled unclassified information in performing the work, and which CMMC level applies. Under 32 CFR 170.23(a), a subcontractor handling only FCI needs Level 1 (Self), while one handling CUI needs at least Level 2 (Self). If the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC), a subcontractor handling CUI needs at least Level 2 (C3PAO). The prime should also check any specific flow-down guidance in the solicitation or contract, which 32 CFR 170.23(b) allows DoD to provide. The output is a written statement of the required level for each subcontract.
Flow down the clause substance
Whenever the subcontract involves processing, storing or transmitting FCI or CUI, the prime must put the substance of DFARS 252.204-7021 into the subcontract under paragraph (f). The requirement covers subcontracts for commercial products and services, but excludes COTS items. The prime's contracts team drafts or amends the subcontract so that its terms reflect the clause. The check that closes this step is a signed subcontract that contains the flow-down language and states the CMMC level required.
Verify the subcontractor's current CMMC status
Before award, the prime must confirm that the subcontractor holds a current CMMC certificate or status at the level appropriate to the information being flowed down. Under DFARS 252.204-7021, a Final Level 1 (Self) status is current for up to 1 year, a Final Level 2 or Level 3 status for up to 3 years, and a Conditional status for up to 180 days. The prime should check the status in SPRS and record the date it was posted. A status that falls outside its window does not satisfy this step, even if the subcontractor held it previously. The output is a dated record of the status and its expiry window.
Confirm the affirmation is current
The prime must confirm that each affirmation required for the subcontractor's status is not older than 1 year. The affirmation comes from the subcontractor's own Affirming Official, who affirms continuing compliance in SPRS for the company's systems. The prime cannot make this affirmation on the subcontractor's behalf. The check that closes this step is a record showing the affirmation date and the Affirming Official's name for the organization, which the prime files with the status record.
Confirm affirmations cover each system handling FCI or CUI
Under DFARS 252.204-7021(d)(4), the subcontractor's Affirming Official must complete an affirmation of continuous compliance, before subcontract award and annually after, for each subcontractor system that handles FCI or CUI. The prime asks the subcontractor to identify those systems in the scope it has assessed and confirms that the SPRS record reflects them. Where the subcontractor's scope does not cover a system that will touch the flowed-down information, the prime should treat the gap as unresolved. The output is a written confirmation that the affirmed scope matches the work in the subcontract.
Confirm CUI handling under DFARS 252.204-7012
Separately from CMMC status, DFARS 252.204-7012(m) requires the prime to flow down the safeguarding clause in subcontracts involving covered defense information. A subcontractor handling CUI must implement NIST SP 800-171 regardless of its CMMC status, so the prime should confirm the subcontract includes this clause as well. The check is a subcontract that references both DFARS 252.204-7012 and 252.204-7021 where both apply, with the subcontractor's security obligations stated in the contract file.
Record the award decision and monitor expiry dates
Once the checks pass, the prime awards the subcontract and files the status, affirmation and clause records together. Because the status and affirmation windows are time limited, the prime should set a tracking date for each subcontractor and ask for renewed evidence before the window closes. The record is complete when the file shows the required level, the clause, the status date and the affirmation date for every subcontractor handling FCI or CUI.
DFARS 252.204-7012 and CMMC: two obligations that run side by side
Under DFARS 252.204-7021, the level a subcontractor needs follows from the information its subcontract touches. A subcontractor that handles only Federal contract information needs Level 1 (Self). One that handles CUI needs at least Level 2 (Self), and needs Level 2 (C3PAO) when the prime's contract requires Level 2 (C3PAO) or Level 3 (DIBCAC). Before awarding the subcontract, the prime must confirm that the subcontractor holds a current CMMC status at that level, and the subcontractor's own Affirming Official must have completed an affirmation of continuous compliance for each system handling FCI or CUI.
- Level follows the information: the test under 32 CFR 170.23(a) is what the subcontractor will process, store or transmit, not the size of the subcontract.
- Status must be current: a Final Level 1 (Self) status is current for one year, Final Level 2 and Level 3 statuses for three years, and Conditional statuses for 180 days.
- Affirmations stay with the company: an Affirming Official affirms only that company's own compliance in SPRS under 32 CFR 170.22, and never on another company's behalf.
- Prime verification is a pre-award step: the prime must check the status before award and the affirmation must be complete before award, then be maintained annually.
Before accepting a subcontract, confirm with the prime which level it will require and which systems are in scope, and check the status and affirmation dates against those rules.
DFARS 252.204-7012(m) is a separate obligation. It requires the prime to flow the clause down to subcontracts involving covered defense information, which means a subcontractor that handles CUI must implement NIST SP 800-171 on its covered systems. This duty applies whether or not the subcontractor holds any CMMC status, because it comes from the contract clause rather than from the certification program. Implementation is the work of meeting the requirements, while CMMC status is the evidence that an assessment confirmed it.
- Applies on the CUI itself: the trigger is covered defense information on a subcontractor system, not the level the prime happens to require.
- Implementation is not optional during a pause: a Phase II suspension does not change what the clause asks a subcontractor to do.
- Flow-down comes from the prime: expect the prime to include the clause in the subcontract, and read the flow-down language before signing.
- Incident and reporting duties also run through the clause: confirm with the prime and your counsel what notification timelines and cooperation duties apply.
- Status and implementation can diverge: a subcontractor may implement the requirements fully and still lack a current status, or hold a status that no longer matches its systems.
Ask the prime which covered systems the clause reaches and how it wants implementation evidence delivered, since the answer shapes the system security plan and scope.
The Department of War suspended CMMC Phase II on 13 July 2026. Phase II had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Under DoW Class Deviation 2026-O0025, Revision 3, dated 3 September 2026, requiring activities may specify Level 1 (Self) or Level 2 (Self) assessments, and contracting officers work with them to remove or revise CMMC requirements in new and existing solicitations and contracts. The suspension changes which level a prime can require. It does not remove the affirmation, SPRS or 252.204-7012 obligations, and Phase I self-assessments, SPRS postings and annual affirmations remain in place.
- Required level may drop: a prime may now ask for Level 2 (Self) where it previously expected Level 2 (C3PAO), so read the solicitation or subcontract for the level actually stated.
- Contract text governs: the level in the subcontract is what applies, and it may be revised, so confirm that the version you sign reflects the current requirement.
- Affirmations still apply: the annual affirmation and SPRS posting remain required for the systems in scope.
- 252.204-7012 still applies: covered defense information still requires NIST SP 800-171 implementation.
- Ask about timing: the rule and DoW position may continue to change, so confirm with the prime and contracting officer the rules in effect on the award date.
Ask the prime to state in writing which CMMC level and which DFARS clauses apply to your subcontract, and keep that statement with your compliance records.
Affirmations and SPRS: who signs for what
Each organization's own Affirming Official affirms that organization's continuing compliance, and no one signs for another company. Under 32 CFR 170.22, the Affirming Official from a prime and the Affirming Official from each subcontractor make their own affirmations in SPRS. A prime cannot submit an affirmation on a subcontractor's behalf, and a subcontractor cannot rely on the prime's affirmation to cover its own systems. The prime's job under DFARS 252.204-7021 is to confirm that the subcontractor's affirmation exists and is current before award, but that verification is not the affirmation itself. Ask each subcontractor which named individual holds the Affirming Official role in SPRS, and confirm that person has the authority to attest for that legal entity.
The affirmation covers the subcontractor's continuing compliance for the systems that handle FCI or CUI, which is the scope the subcontract's flowdown reaches. DFARS 252.204-7021(d)(4) requires the subcontractor to complete the affirmation before subcontract award and to maintain it annually, so the prime should build an expiry check into its supplier records rather than treat the award-day check as permanent. Under DFARS 252.204-7021, an affirmation must be no more than one year old for a status to remain current, and the status itself has its own age limit that depends on whether it is Final Level 1, Final Level 2 or Conditional. Confirm those dates against the eCFR text before setting reminders, because a lapsed affirmation can put a subcontract at risk even when the underlying controls are unchanged.
Before award, the prime should check the subcontractor's status and affirmation in SPRS and record the date, the level and the Affirming Official's name in its own file. The prime should also ask the subcontractor to confirm what its affirmation covers, since a status for one enclave does not describe a second enclave the subcontractor added later. Because the 2026 suspension and the DoW class deviation are changing which levels some solicitations require, confirm with the contracting officer which level the subcontract actually needs, then verify that the subcontractor's affirmation matches that level. Keep the verification record in the subcontract file for the period the prime's own contract requires.
What subcontractors should prepare before the prime asks
A prime must verify your CMMC status before it awards you work that touches federal contract information or CUI, and you must keep your own affirmation current. The six steps below cover what you own, what the prime will ask for, and what an implementation partner can prepare, while the status and affirmations themselves come from the assessment process and your Affirming Official.
Confirm which FCI or CUI flows to you
Start by mapping each subcontract to the information it actually moves. Federal contract information needs Level 1, while CUI needs at least Level 2, and the prime's contract may require a higher level for CUI work. Ask the prime in writing which level it expects, which data sets are involved, and whether the work involves processing, storing or transmitting that information. Record the answer in the contract file so the level is traceable to a specific subcontract rather than a general assumption.
Get your current status and SPRS entry
The prime cannot award a subcontract involving CUI unless you hold a current CMMC status at the level the information requires. Check whether your status is Final or Conditional, confirm its assessment date, and verify your SPRS entry matches your systems. A status that has aged past its validity window will block award, so note the expiry dates in your compliance calendar well before a bid deadline.
Name an Affirming Official
Each organization needs its own Affirming Official, who affirms that company's continuing compliance in SPRS. Your Affirming Official cannot affirm on behalf of a prime or another subcontractor. Choose someone with authority over the systems in scope, confirm they understand what they are attesting to, and set a calendar reminder for the annual affirmation. The prime will check that your affirmation is current before award, so a lapsed affirmation can cost you a subcontract even when your controls are sound.
Implement NIST SP 800-171 for CUI systems
Subcontractors that handle CUI must implement NIST SP 800-171 under DFARS 252.204-7012 regardless of CMMC status, and the CMMC Level 2 requirements draw from the same 110 requirements. Prioritize multifactor authentication, access control, audit logging, encryption of CUI in transit and at rest, and incident reporting. Confirm which of these your existing IT provider covers and which you must document yourself, since gaps in those areas are the most common reasons a self-assessment fails to score.
Document the system boundary and external providers
Define exactly which systems, users, locations and networks touch the subcontract data, and draw that boundary on paper before anyone scores it. Include email, file sharing, collaboration tools, backups and any managed service provider or cloud service that stores or transmits CUI. For each external provider, collect its responsibility matrix and confirm whether its CUI services meet FedRAMP Moderate or an equivalent standard. Undocumented providers are a frequent cause of scope surprises during assessment.
Keep dated evidence in final form
Assessors judge a requirement met only when its evidence is final, not a draft, and when it is dated and traceable to the in-scope systems. Keep policies, system security plan entries, configuration baselines, access reviews, scan reports, training records and incident test results with version history and retention dates. Set a retention rule and confirm it with the prime's contract terms. DeployOpen can prepare systems and organize this evidence, but statuses, affirmations and certificates come only from your Affirming Official and independent assessors.
Who does what: the subcontractor, its implementation partner and the assessor
The subcontractor is the organization that handles the Federal contract information or Controlled Unclassified Information under the subcontract, so it owns its controls, its System Security Plan, its evidence and its compliance record. Under 32 CFR 170.22, an Affirming Official from the subcontractor affirms the subcontractor's own continuing compliance in SPRS, and no one can affirm on its behalf. The subcontractor decides which level its scope requires, based on the information it processes, stores or transmits and on the level the prime's contract requires.
- Scope and level decisions: The subcontractor determines which systems touch FCI or CUI and which level applies under 32 CFR 170.23.
- Controls and documentation: It implements the NIST SP 800-171 Rev. 2 requirements and keeps final, dated evidence for each one.
- Affirmation: Its own Affirming Official signs the affirmation before award and annually, as DFARS 252.204-7021 requires.
- Flow-down handling: It accepts the substance of DFARS 252.204-7012 and 252.204-7021 in its subcontract and keeps CUI safeguards in place regardless of CMMC status.
- Assessment readiness: If a C3PAO assessment applies, it selects and contracts an authorized C3PAO itself.
Before accepting a subcontract, confirm which level the prime requires and who on your side will sign the affirmation.
An implementation partner helps the subcontractor build, configure and document the environment that meets the requirements. DeployOpen works in this role: it plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure, and it prepares systems, configurations and evidence for compliance assessments. The partner does not own the controls, does not sign the affirmation, does not issue a certificate and does not perform the assessment.
- System preparation: The partner configures identity, logging, boundary protection, encryption and other technical controls within the agreed scope.
- Evidence preparation: It produces configuration baselines, system documentation and test records, which the subcontractor reviews and adopts as its own.
- Written scope: Responsibilities, deliverables and timelines are agreed in writing before work starts, so the boundary between partner and client is clear.
- Ongoing support: Upgrades, backups and continuous testing can run under a retainer after the initial work.
- Independence limits: A partner that prepares the environment may be barred from performing the assessment of the same environment, so confirm this with the C3PAO before engaging.
Ask the partner for a responsibility matrix that shows which controls it configures and which the subcontractor must operate and attest to.
The verification step depends on the level the prime requires. A Level 1 (Self) or Level 2 (Self) requirement is met through a self-assessment, where the subcontractor records its results and affirmation in SPRS. A Level 2 (C3PAO) requirement needs a certification assessment performed by a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. Only that C3PAO issues a Level 2 (C3PAO) certificate, and DCMA DIBCAC performs Level 3 certification assessments.
- Who issues the record: An authorized C3PAO issues the Level 2 (C3PAO) certificate, and the subcontractor's affirmation accompanies it.
- Self-assessment record: For Level 1 or Level 2 (Self), the subcontractor's own results and affirmation appear in SPRS.
- Status validity: The prime checks that the status is current for the level flowed down, under the time limits in DFARS 252.204-7021.
- Independence: The assessor must remain independent of the consultants who prepared the environment.
- Current requirements: Confirm which assessment type the prime's solicitation specifies, since the 2026 suspension affects Phase II requirements.
Before award, ask the prime which level and status it will verify, and request the certificate or SPRS record reference in writing.
Where subcontract CMMC deals stall
Most subcontract CMMC delays come from a mismatch between what the prime asks for, what the subcontractor can show, and who signs the paperwork. The cards below cover five recurring problems, each paired with a check or fix that a subcontractor can act on before the award decision.
Prime asks for an unspecified level
A prime sometimes requests Level 2 (C3PAO) when the subcontract or prime contract does not name that level. Under 32 CFR 170.23, the required level follows the FCI or CUI the subcontractor handles and the level the prime contract requires, so the subcontract terms should match that. Ask the prime to cite the contract's requirement in writing, and confirm whether the requiring activity has revised CMMC language under the 2026 class deviation before accepting a higher level.
Lapsed CMMC status
A subcontractor's status must be current when the prime awards the subcontract. Under DFARS 252.204-7021, a Final Level 1 (Self) status is current for one year, Final Level 2 and Level 3 statuses for three years, and Conditional statuses for 180 days, with an affirmation no older than one year. A lapsed or expired status can stop an award even when the technical controls are in place. Track each status date in a shared calendar and renew before the prime's review window opens.
Affirmation filed by the wrong person
Under 32 CFR 170.22, each organization's own Affirming Official must affirm that organization's continuing compliance in SPRS. A prime cannot affirm for a subcontractor, and a subcontractor should not let the prime's Affirming Official submit on its behalf. Confirm that the person named in SPRS is the subcontractor's own official with authority over its systems, and that the affirmation covers the specific systems that handle FCI or CUI for the subcontract.
CUI flowed into an undefined boundary
Primes sometimes send CUI to a subcontractor whose systems, users and data stores have not been mapped. Without a defined boundary, neither the subcontractor nor the assessor can say which assets must meet NIST SP 800-171. DFARS 252.204-7012(m) requires the clause in subcontracts involving covered defense information, so the subcontractor must implement the requirements regardless of CMMC status. Before data moves, document the systems that will hold it, the people who will access it, and the transmission paths, and agree that scope in the subcontract.
Treating the suspension as an end
The 13 July 2026 suspension halted CMMC Phase II and its Level 2 C3PAO requirement, but Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. A subcontractor that stops work on its NIST SP 800-171 program because a prime's solicitation no longer names a certification may still be out of compliance with the flowed-down clause. Ask the prime which clauses still apply to the subcontract, and keep the control program running while the Reform Task Force review is pending.
Frequently asked questions about CMMC for subcontractors
Which CMMC level does a subcontractor need if it handles only FCI?
A subcontractor that handles only Federal contract information needs Level 1 (Self) under 32 CFR 170.23(a). Level 1 covers the 15 safeguarding requirements of FAR 52.204-21. The subcontractor completes the self-assessment itself, posts the result in SPRS, and has its Affirming Official affirm continuing compliance each year. The level follows the information the subcontract touches. Before accepting the work, confirm in writing what data the subcontract involves. If the subcontractor's people, tools or systems will handle CUI at any point, the required level rises to at least Level 2 (Self), so the data classification question comes first.
Is a commercial off-the-shelf supplier covered by CMMC flow-down?
DFARS 252.204-7021(f) requires primes to flow the clause into subcontracts, including subcontracts for commercial products and services, but it excludes COTS items. A supplier that delivers an unmodified COTS product and does not process, store or transmit FCI or CUI for the contract generally falls outside the flow-down. Services work differently. A vendor that hosts, administers, supports or reaches contract data through remote sessions can process or transmit FCI or CUI, which brings it back into scope. Ask the prime to state in writing which items it treats as COTS and which vendor services touch contract information. Cloud and managed providers may also fall under the external service provider rules.
Does the 2026 suspension lower the level a subcontractor needs?
The suspension changes which assessment a requirement can call for, but the test for the required level is unchanged. On 13 July 2026 the Department of War suspended CMMC Phase II, which had required Level 2 C3PAO certification for applicable contracts. A class deviation dated 3 September 2026 lets requiring activities specify Level 1 (Self) or Level 2 (Self) assessments, and contracting officers are working to revise solicitations and contracts. The level for each subcontract still follows 32 CFR 170.23. If a subcontract still names Level 2 (C3PAO) or Level 3, the subcontractor needs that status before award. DFARS 252.204-7012 obligations to implement NIST SP 800-171 for CUI remain in place either way.
Who pays for a subcontractor's CMMC assessment?
The subcontractor pays for its own assessment and its own implementation work, because each organization affirms its own compliance and a prime cannot affirm on a subcontractor's behalf under 32 CFR 170.22. One-time costs include gap analysis, remediation, documentation, enclave or tooling changes and, for Level 2 (C3PAO), the fee paid to the assessor. Recurring costs include the annual affirmation, evidence upkeep, re-assessment at the status interval and staff time. Costs rise with the number of in-scope assets, cloud services that handle CUI and whether a third-party assessment is required. Ask the prime in writing whether it will share any cost. Ask any consultant or implementation partner for a fixed-scope quote with written deliverables.
How long does a subcontractor's CMMC status stay current?
Under DFARS 252.204-7021, a Final Level 1 (Self) status is current for one year, a Final Level 2 or Level 3 status for three years, and a Conditional status for 180 days. Each status also needs an affirmation of continuous compliance that is no more than one year old. The prime must confirm a current status before awarding the subcontract, and the subcontractor must complete the affirmation before award and maintain it annually for each system that handles FCI or CUI. Track the expiry date for every status and affirmation. A lapsed status can stop an award or a renewal, so set reminders well ahead of each date and check the entry in SPRS before offering new work.
Can a subcontractor do its own CMMC assessment?
Yes, when the level required by the subcontract is a self-assessment level. A subcontractor handling only FCI completes a Level 1 (Self) assessment. A subcontractor handling CUI needs at least Level 2 (Self), and it can self-assess when the prime's requirement does not call for Level 2 (C3PAO) or Level 3. Under 32 CFR 170.23(a)(3) and (4), a prime requirement for Level 2 (C3PAO) or Level 3 means the subcontractor needs a third-party assessment, which it cannot perform on itself. A self-assessment is still scored against the NIST SP 800-171A objectives, and a requirement counts as met only when every applicable objective is satisfied with final evidence. The Affirming Official then posts the result in SPRS.
What does the work need from a subcontractor's own staff?
The work needs named owners inside the subcontractor, because controls, evidence and the affirmation belong to its own organization. Expect to need an Affirming Official who can sign for the company in SPRS, an IT or security lead who owns the system boundary and asset inventory, and administrators who can produce configuration, access and logging records in final form. Staff who handle CUI also need to meet the awareness, training and personnel screening practices. An implementation partner can prepare documents, configure systems and organize evidence, but it cannot issue a report or certificate. The subcontractor's people must review every control and approve every statement. Ask for a list of roles and expected time commitments before signing a scope.
How DeployOpen prepares a subcontractor's systems and evidence
DeployOpen helps a subcontractor get its environment ready for the assessment it needs, which is set by the level its prime requires and the information it handles. The work starts with a written, fixed-scope agreement that names the systems that process, store or transmit FCI or CUI, the boundary around them, and the deliverables. Before anything is built, the subcontractor should confirm with its prime which level applies under 32 CFR 170.23 and which Affirming Official will sign for the company. DeployOpen implements and hardens open-source platforms inside the client's own cloud accounts, data centers or networks, configuring identity, logging, encryption, backups and access controls so that the systems can be tested against the NIST SP 800-171 Rev. 2 requirements that Level 2 uses.
Evidence is where most subcontractors lose time, so the preparation work focuses on it. DeployOpen can prepare the system security plan, the configuration baselines, access and audit configurations, and the records that show each requirement operating over time, written so the client's own team can keep them current. Those documents should be final before an assessment begins, because a requirement counts as met only when its objectives are satisfied with evidence in final form. DeployOpen does not issue affirmations, statuses, SPRS scores, reports or certificates. The subcontractor's Affirming Official makes its own affirmation in SPRS, and an independent assessor or certification body issues any certificate. Ask every provider, DeployOpen included, to confirm in writing which parts of the work it performs and which parts remain the client's responsibility.
