DFARS 7012 flow-down: what primes must pass to subcontractors

Which subcontracts must carry DFARS 7012, and who decides

If you are a prime or subcontractor preparing a DoD subcontract, the DFARS 252.204-7012 clause must be flowed down to any subcontract for operationally critical support, and to any subcontract whose performance involves covered defense information, including commercial subcontracts. The prime decides which information required for the subcontract still counts as covered defense information, and consults the contracting officer when the answer is unclear. Work through this decision for each subcontract before award, not once for the whole program. The decision turns on the information flow in each subcontract. Ask what the subcontractor will receive from you, what it will create or store for the work, and whether that material keeps its identity as covered defense information once it leaves your environment. A subcontract for a commercial service may still qualify if the subcontractor may hold such information on its systems. Record the reasoning in the subcontract file so an auditor or the contracting officer can follow it later.

Your organization owns its controls and remains accountable for them. A partner such as DeployOpen can help prepare the systems, scoping documents and evidence that show how a subcontractor or prime meets NIST SP 800-171, but DeployOpen does not issue assessment results. Only an independent assessor can do that, and the DoD Basic Assessment is recorded through the government's own submission process. Confirm with your contracting officer which assessment level each subcontract requires before you negotiate, because that level determines what evidence you need to produce. In practice, the flow-down question is where most suppliers make mistakes. Read the current clause text on the eCFR entry for DFARS 252.204-7012 and confirm with the prime which revision of NIST SP 800-171 applies to your subcontract, since DoD guidance on revisions has changed recently. Treat any unresolved question about covered defense information as an open action item with a named owner, rather than assuming the answer.

How a prime flows DFARS 7012 down to a subcontract

This sequence lets a prime decide which subcontracts must carry DFARS 252.204-7012, pass the clause on without changing its substance, and record why each decision was made. Each step ends with a document that an assessor or contracting officer can review.

Inventory every proposed subcontract
The prime's contracts or subcontracts team lists each subcontract and purchase order under the prime contract, along with the work the subcontractor will perform. Procurement, the program manager and the security lead review the list together. The output is a subcontract register that records the scope of each subcontract, so no award goes out before it has been screened.
Identify subcontracts that trigger the clause
For each entry, the reviewer asks two questions: does the subcontractor provide operationally critical support, and will its performance involve covered defense information. Commercial subcontracts are included in this test, so a commercial product or service does not get a pass by default. The output is a written flag on each subcontract stating whether DFARS 252.204-7012 applies and the reason.
Determine what information the subcontractor will receive
For each flagged subcontract, the prime identifies the specific information the subcontractor needs to perform, such as technical data, drawings or specifications. The reviewer then decides whether that information still retains its identity as covered defense information. The output is a short information map that names each data set and records the decision, so the scope of the flow-down is tied to actual data rather than to the whole program.
Consult the contracting officer when unsure
Where the prime cannot determine whether required information remains covered defense information, the clause directs it to consult the contracting officer. The prime sends the question with the information map attached and keeps the response with the subcontract file. The output is a dated record of the contracting officer's guidance, or a documented basis for the prime's own decision if no question was needed.
Flow the clause down without alteration
The prime inserts DFARS 252.204-7012 into each flagged subcontract in its full text. The only permitted change is to identify the parties, so the prime should not edit, summarize or narrow the clause. Subcontracts that do not meet the trigger should still be reviewed against FAR 52.204-21 where the subcontractor may hold federal contract information. The output is an executed subcontract with the clause attached and the parties identified.
Check the subcontractor's Basic Assessment before award
Before awarding a subcontract that is subject to NIST SP 800-171, the prime confirms the subcontractor has a Basic Assessment on record within the last 3 years, as the codified DFARS 252.204-7020 requires. The prime records the assessment date and score source, and where a score is missing or stale, it withholds the award until the gap is closed. The output is a file note confirming the assessment check.
Record the decisions in the subcontract file
The prime assembles the register, flags, information map, contracting officer correspondence, flow-down copy and assessment check into one subcontract file. Each subcontract should be retrievable on its own, so an auditor or DoD reviewer can follow the reasoning. The output is a complete file for every subcontract, reviewed again when the scope or information changes during performance.

What subcontractors must report back to the prime

A subcontractor under a flowed-down DFARS 252.204-7012 clause carries its own obligations back up the supply chain. The cards below cover the notices, report numbers, assessment currency and release requests that the prime relies on to meet its own duties, and they make clear that the subcontractor owns its controls and its report to DoD.

Notice before requesting a variance

Under DFARS 252.204-7012(m)(2), a subcontractor that asks the contracting officer to vary from a NIST SP 800-171 requirement must first notify the prime, or the next higher tier subcontractor. The notice lets the prime judge whether the variance affects the parent contract's security commitments. Subcontractors should document which requirement is affected, the proposed alternative and the system boundary involved, and send that package to the prime before the request goes to the contracting officer. The subcontractor owns the variance request and the controls it describes.

Incident report number to the prime

After a subcontractor reports a cyber incident to DoD, DFARS 252.204-7012(m)(2) requires it to give the prime the DoD-assigned incident report number as soon as practicable. The prime needs that number to connect the subcontractor's report to its own reporting and to any follow-on requests for forensic access or damage assessment. Subcontractors should set an internal handoff step in their incident runbook so the number reaches the prime without waiting for a formal close-out. The subcontractor remains responsible for the report it files with DoD.

Basic Assessment completed within three years

Before a prime can award a subcontract subject to NIST SP 800-171, the codified DFARS 252.204-7020 requires that the subcontractor has completed at least a Basic Assessment within the last 3 years. Primes check this in the Supplier Performance Risk System, so a stale or missing score can stop an award. Subcontractors should confirm that their score reflects the current system security plan and that the assessment date falls inside the window. Keeping the score accurate is the subcontractor's own duty, and an assessment score that overstates implementation creates exposure under the False Claims Act.

Release requests through the prime

Under DFARS 252.204-7000(b) and (c), a subcontractor that wants to release contract information must submit the request through the prime. The request must identify the information, the medium and the purpose, and it must reach the contracting officer at least 10 business days before release. Subcontractors should build this lead time into publication, conference and marketing calendars, and they should not assume that the prime will forward an incomplete request. The prime handles routing, but the subcontractor owns the content of the request and the decision to disclose.

Why the Basic Assessment check happens before award

A prime cannot award a subcontract that involves SP 800-171 unless the subcontractor has completed at least a Basic Assessment within the last 3 years. That bar comes from DFARS 252.204-7020, and it moves the check to the front of the sourcing decision. Before award, ask each candidate subcontractor for the date and score of its current Basic Assessment, confirm it was submitted in the Supplier Performance Risk System (SPRS), and record the score in the subcontract file. If the candidate has no assessment inside the window, the subcontract cannot go forward on that basis until one exists.

A self-assessment score shows what the subcontractor claimed, not what it has implemented. A Basic Assessment is scored against the NIST SP 800-171 DoD Assessment Methodology, and the score reflects the requirements the subcontractor reported as met, so a high number can sit on top of a stale system security plan or a missing plan of action and milestones. Ask for the system security plan boundary, the list of systems that will touch covered defense information, and the date of the last review. Confirm the assessment still describes the environment that will do the work. Where the subcontractor expects a Medium or High assessment, the rule gives it 14 business days after the assessment to provide more information or rebut findings, so plan that window into the schedule.

DeployOpen prepares systems, documentation and evidence that a subcontractor can use for its own assessment. It does not calculate or issue SPRS scores, and it does not decide whether a subcontractor passes. Subcontractors should confirm with their contracting officer and their own assessor which assessment applies to their contract, because the applicable NIST revision and assessment rules are changing in 2026. Primes should confirm the current requirements in the clause text before relying on any score.

How FAR 52.204-21 and DFARS 252.204-7000 differ from DFARS 7012

FAR 52.204-21 applies where a subcontractor may have federal contract information (FCI) residing in or transiting its information system. The clause is the basic safeguarding baseline for FCI, not CUI, and it is required in subcontracts, including those for commercial products and services other than COTS items, when that condition is met. A prime cannot assume that a commercial subcontract is exempt because the item is not a defense product. The question is whether the subcontractor's systems will hold or carry FCI.

Trigger: the subcontractor's information system may have FCI residing in it or transiting it.
Commercial scope: the clause reaches commercial products and services other than COTS items, so commercial subcontracts are not automatically excluded.
Level required: under 32 CFR 170.23(a), a subcontractor handling only FCI needs Level 1 (Self).
Separate from 7012: FAR 52.204-21 does not bring covered defense information or the 72-hour reporting duty into the subcontract.
Flow-down wording: confirm the clause text and the subcontractor's status against the clause itself in the eCFR text of FAR 52.204-21.

Before award, confirm with the contracting officer whether the subcontract work touches FCI, and record the answer in the subcontract file.

Which assessment level a subcontractor needs

This table compares the minimum CMMC level a subcontractor needs under 32 CFR 170.23(a) based on the information it handles, and what the prime should check before award. The level follows the type of information in scope, not the size of the company. Rev. 2 controls underpin the Level 2 requirements as DoD currently applies them.

Subcontractor handles	Required level under 32 CFR 170.23(a)	What the prime should check
Federal contract information (FCI) only	Level 1 (Self)	Confirm the flow-down clause is in the subcontract and that the subcontractor has an annual self-assessment and affirmation on record
Controlled unclassified information (CUI)	At least Level 2 (Self)	Confirm a current SPRS entry from a Basic Assessment completed within the last 3 years and that the subcontractor can produce its system security plan
CUI and operationally critical support	At least Level 2 (Self), with the prime deciding if a higher level applies	Ask the contracting officer whether a higher assessment level is required before awarding the subcontract
Covered defense information in commercial items	Level 2 (Self) at minimum, flowed down under DFARS 252.204-7012(m)	Confirm the prime has determined whether the information keeps its identity as covered defense information
Subcontractor has no access to FCI or CUI	No CMMC level required under 32 CFR 170.23(a)	Document the scoping decision in the subcontract file and revisit it if the work scope changes
Subcontractor needs a variance from a Rev. 2 requirement	Level 2 controls still apply unless the variance is accepted	Require notice to the prime when the subcontractor asks the contracting officer to vary from an SP 800-171 requirement

What changes now that DoD has revised the clause

Confirm the clause version in every solicitation and subcontract before you flow anything down. DoW Class Deviation 2026-O0025, Revision 3, signed on 3 September 2026, directs contracting officers to use a revised DFARS 252.204-7012 that names NIST SP 800-171 Revision 2 explicitly. The deviation cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. For a prime, that means the requirement set in your contract may be the 110 Rev. 2 requirements even though Rev. 3 is the current NIST version. Ask the contracting officer which version governs each award, and record the answer in the subcontract file so the flow-down language and the System Security Plan point at the same baseline.

The proposed FAR overhaul published on 23 June 2026 points in a different direction. It would require contractors handling CUI to comply with SP 800-171 Rev. 3, using organization-defined parameter values published by the DoW CIO. Comments closed on 23 July 2026, and the rule was not final as of October 2026. Primes should not assume either outcome. Plan a dual-baseline mapping of the Rev. 2 requirements to Rev. 3 requirements, identify where new Rev. 3 families such as Supply Chain Risk Management affect your subcontractor selection, and ask each subcontractor whether its assessment covers one baseline or both.

Whichever version applies, a prime that changes the clause text in a subcontract has changed the flow-down, even if the edit looks administrative. Keep the clause text unaltered except for identifying the parties, and when the baseline in a new solicitation differs from the one in an existing subcontract, document the decision and consult the contracting officer. Re-check the Basic Assessment status of each subcontractor against the version the subcontract names, because a score earned against one baseline does not automatically show readiness for the other.

Questions primes and subcontractors ask about flow-down

Does a commercial subcontract have to include DFARS 252.204-7012?

Yes, if the subcontract supports operationally critical functions or its performance involves covered defense information. Under DFARS 252.204-7012(m), the clause must flow down to those subcontracts, and that includes commercial subcontracts. The prime passes the clause down without alteration, except to identify the parties. Separately, FAR 52.204-21(c) requires the basic safeguarding clause in subcontracts for commercial products and services other than COTS items where the subcontractor may hold federal contract information. Ask the contracting officer to confirm which of your subcontracts fall under each clause, because the prime makes the first call on scope and the contracting officer resolves disputes. Read the full clause text in the eCFR copy of DFARS 252.204-7012.

Who decides whether information a subcontractor receives is covered defense information?

The prime decides first, and it must consult the contracting officer when it is unsure. Under DFARS 252.204-7012(m)(1), the prime determines whether information needed for subcontract performance keeps its identity as covered defense information. Subcontractors should not assume that every drawing, specification or data set is covered. Ask the prime in writing which files, data types or markings carry covered defense information, and record that answer in the subcontract or its statement of work. If the prime's answer is unclear or the marking is missing, raise it before work starts, since the contracting officer can settle the question. A written determination also helps both parties show later which information the subcontractor was required to protect.

Does a subcontractor need its own NIST SP 800-171 assessment?

A subcontractor that handles covered information must have its own assessment record, and the prime must check it before award. Under DFARS 252.204-7020, a subcontract subject to NIST SP 800-171 cannot be awarded unless the subcontractor has completed at least a Basic Assessment within the last 3 years. Under 32 CFR 170.23(a), a subcontractor handling only federal contract information needs Level 1 (Self), and one handling CUI needs at least Level 2 (Self). Confirm with the prime which level it needs for each subcontract, and whether it must also hold a Basic Assessment record. The eCFR copy of DFARS 252.204-7020 sets out the pre-award check.

What must a prime collect from a subcontractor before award?

The prime needs proof that the subcontractor has completed at least a Basic Assessment within the last 3 years, plus the information it needs to manage reporting. Under DFARS 252.204-7020, the Basic Assessment check is a precondition for award of subject subcontracts. Under DFARS 252.204-7012(m)(2), the subcontractor must also tell the prime when it asks the contracting officer to vary from a NIST SP 800-171 requirement, and must give the prime the DoD incident report number after reporting a cyber incident. Practical items to collect include:

The date the Basic Assessment was completed and the record the prime will check
A named contact for notices of variance requests and incident reports
Confirmation of the CMMC level the subcontractor holds or needs for the work

Ask the contracting officer how the prime should verify the assessment record.

How long is a Basic Assessment valid for a subcontract?

The rule in DFARS 252.204-7020 uses a three-year lookback: the subcontractor must have completed at least a Basic Assessment within the last 3 years at the time of award. The clause does not describe a separate renewal cycle for every subcontract, so the key date is when the subcontract is awarded. A Basic Assessment completed earlier than three years before award will not satisfy the check, and a new one will be needed before the subcontract can be awarded. Ask the contracting officer whether the prime must recheck the record at option exercise, modification or when a system changes during performance. Those points are set by the contract and the prime's practice, so confirm them in writing.

What effort and cost fall on the prime and on each subcontractor?

The prime carries the flow-down, the covered defense information determination and the pre-award check. The subcontractor carries the work of meeting the requirements in its own systems, completing its assessment and reporting incidents to the prime. No supplied figure sets these costs, and the amounts depend on system scope, the size of any enclave that holds covered information, and whether a third-party assessor is used. Ask the prime for a written split of responsibilities in the subcontract, and ask the subcontractor for a quote built from its written system scope. DeployOpen plans and prepares systems and evidence under a fixed-scope written agreement. It does not issue assessments or affirmations, which remain the job of independent parties.

What primes should check before they award

Before a prime issues a subcontract that touches covered defense information, several facts need to be settled and recorded in the file. The cards below cover the checks that connect the flow-down clause, the subcontractor's assessment record, the incident-reporting path and any variance requests.

Confirm the clause version in the contract

Check which version of DFARS 252.204-7012 and which SP 800-171 revision the prime's own contract names, because the DoW class deviation changes the text that contracting officers use. Flow the clause down without alteration, changing only the party names. The contracts team owns this check and should file the contract clause list with the subcontract package.

Record the covered defense information decision

The prime must decide whether information needed for subcontract performance still counts as covered defense information, and consult the contracting officer if the answer is unclear. Write the decision down with the specific data sets, the reasoning and the date. The program or contracts lead owns the decision, and the subcontract file should carry the record.

Collect the Basic Assessment date and score

Before award, confirm that each subcontractor handling covered information has completed at least a Basic Assessment within the last 3 years and has posted the result in SPRS. Check the date, the score and the assessed scope against the work the subcontractor will perform. The supplier quality or cybersecurity team owns the check, and the subcontractor owns the accuracy of its posted score.

Confirm the incident-reporting contact

Ask each subcontractor to name the person and channel it will use to tell the prime about a cyber incident, and confirm that it can provide the DoD-assigned incident report number as soon as practicable after it reports to DoD. Test the path with a named contact before performance starts. The subcontractor owns the reporting process, and the prime's security office should keep the contact on file.

Log variance requests raised

Require each subcontractor to tell the prime when it asks the contracting officer to accept an alternative or a non-applicable NIST SP 800-171 requirement. Record the requirement, the request date, the outcome and where the adjudication sits in the system security plan. The prime's contracts office owns the log, and the subcontractor owns the request and its supporting evidence.

Who owns each flow-down duty

The prime holds the contract with the government and decides what reaches each subcontract. Under DFARS 252.204-7012(m), the prime must flow the clause down without alteration, except to identify the parties, in any subcontract for operationally critical support or whose performance involves covered defense information. The prime must also decide whether information needed for subcontract performance keeps its identity as covered defense information, and consult the contracting officer when that is unclear. The prime owns its own system and its own SPRS posture, and it cannot delegate those to a subcontractor.

Flow-down decision: Determine, for each subcontract, whether the clause applies and document the reasoning.
Scope call: Decide which technical data leaves the prime's boundary and whether it still carries covered defense information.
Contracting officer questions: Raise unclear cases before award, not after a dispute.
Subcontractor reports: Receive variance notices and DoD incident report numbers from subcontractors, and track them.
Own assessment: Keep the prime's Basic Assessment and SPRS entry current, since it is the prime's score that the government reads.

Check that every subcontract file shows a flow-down decision and that a named person owns the follow-up on subcontractor reports.

When outside help fits the flow-down work

Bring in an implementation partner when the flow-down work outruns the team's capacity to document it. The usual trigger is a prime or subcontractor that must produce a system security plan covering the CUI environment, assemble evidence for a Basic Assessment before the next award, and write down the subcontract decisions that the clause now requires. A partner can prepare the system security plan drafts, map each NIST SP 800-171 requirement to the configuration, logs and records that show it, and organize the evidence so the organization's own staff can review and sign it. The organization still owns its controls, its representations and the decision on what counts as covered defense information in each subcontract.

Engagements of this kind are fixed-scope. Before work starts, the parties agree in writing on which systems and subcontracts are in scope, the deliverables (for example, a draft plan, an evidence index and a subcontract decision record), who reviews each one, and the timeline. Ask any prospective partner to name each deliverable and the acceptance step for it. Costs come from the scope, so the main drivers are the number of systems that handle CUI, how many subcontracts need review, and how much of the evidence already exists. Confirm with your contracting officer and counsel which records they expect to see before you define the scope.

DeployOpen prepares systems, controls and evidence for assessments, but it does not perform or issue assessments, attestations or certifications. A Basic Assessment is self-reported by the organization in the Supplier Performance Risk System, and any Medium or High assessment is conducted by DoD. Use a partner for preparation and keep the scoring and submission decisions with your own leadership. Before you commit, confirm the current assessment requirements against the eCFR text of DFARS 252.204-7020 and with the contracting officer on each active contract.

How DeployOpen prepares subcontractors and primes for flow-down

DeployOpen helps primes and subcontractors prepare the systems, controls and evidence that flow-down expects, while the organization keeps ownership of its own controls and its contract decisions. Engagements are fixed-scope, with the scope, deliverables and timeline agreed in writing before work starts.

How we scope

Written scope lists which subcontracts and information flows are in review for covered defense information.
Scope records the prime's decisions on what remains covered defense information and who made them.
Scope names the systems, enclaves and supplier connections that need a Basic Assessment readiness check.

How we build

We configure the clause requirements into flow-down templates, subcontract checklists and supplier onboarding steps.
We implement NIST SP 800-171 controls in the client's own environment, including reporting paths for subcontractors to the prime.
We test the reporting workflow so incident numbers and variance notices reach the prime within the required window.

How we hand over

Deliverables include the system security plan, flow-down records, and a documented evidence map for each requirement in scope.
Each deliverable is documented so the organization's own staff can explain the decisions to the contracting officer or an assessor.
Handover covers an operating runbook for incident notification and a record of which subcontractors received the clause.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover periodic review of subcontract terms when the DFARS or FAR text changes.
Assessments are run by DCMA or independent assessors, and DeployOpen prepares evidence for them without issuing any report or score.

DFARS 7012 flow-down: what primes and subcontractors must do