# Primes Vary Subcontractor Security Reviews

Reports from small subcontractors with 10–50 employees show inconsistent prime-contractor oversight of supplier cybersecurity. Some primes collect an SPRS score or 800-171 questionnaire without substantive follow-up; others review SSPs and POA&Ms through third parties, gate CUI transfers based on security status, and tie future orders to CMMC certification timing and evidence of auditor engagement. At least one reported customer security assessment affected eligibility to work.

- Prime contractors and subcontractors should not assume an SPRS score or checkbox questionnaire will be sufficient beyond initial onboarding; some customers later request detailed evidence and third-party assessments.
- Subcontractors can clarify what security artifacts a prime expects, how SSP and POA&M findings will be reviewed, and whether CUI transmission or future orders depend on security status or certification evidence.
- Primes’ differing approaches create inconsistent supplier expectations, including around cyber insurance; procurement teams can make review steps and order conditions explicit to reduce uncertainty across their supply chains.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity
**Published:** October 20, 2026

### Key Quotes
> We ... outsourced us to a 3rd party they use to go over the SSP and stay up on the POAM items until they were complete to their satisfaction. ... They are now asking for when the cert will be done and will hold future orders until date and proof of auditor engagement.
> — Commenter (small subcontractor, 2–4 tiers downstream)

> They mark you down as able to receive CUI or not able. ... Feeds into our automated system that allows or disallows transmitting CUI.
> — Commenter

### Sources
- [Small subs (10–50 people): after you sent your prime the SPRS score or the 800-171 spreadsheet, what did they actually do with it? "Nothing, ever" counts as an answer.](https://www.reddit.com/r/CMMC/comments/1xauulh/small_subs_1050_people_after_you_sent_your_prime) - reddit-cmmc