# Contractors Assess CMMC Flow-Down Requirements

A procurement discussion about CMMC requirements for vendors and subcontractors on contracts issued before DFARS clause 252.204-7021 rejects using project start date alone to determine whether certification is required. Participants emphasize reviewing each contract’s applicable clauses and whether a subcontractor receives Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). They also distinguish CMMC assessment or certification from other security flow-down obligations. For contracting teams, the key issue is how contract terms and data access affect subcontractor requirements; keeping CUI within a prime contractor’s assessed environment may address some access scenarios, but does not itself establish that a flow-down is unnecessary.

- Review the applicable prime contract clauses and the information each subcontractor will access before setting CMMC assessment or certification requirements.
- Distinguish FCI, CUI, and situations where neither is shared; apply only the flow-down obligations supported by the contract and applicable requirements.
- A blanket certification policy may raise subcontractor costs and narrow the supplier pool. Where CUI is contained within the prime’s environment, assess that arrangement against the contract’s terms rather than assuming it removes subcontractor obligations.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 12, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Key Quotes
> If a sub only touches FCI, Level 1 self-assessment is the most you'd flow down. If they receive CUI, they need whatever level the prime contract specifies for that work, and if they never see FCI or CUI, nothing flows down at all.
> — Commenter

> I'm adding a CMMC specific exhibit to our subcontracts when the prime contract includes 7021. We also require a signed self-certification and copy of their SPRS certificate.
> — Original poster (Contract Manager)

### Sources
- [Is a CMMC Cert Required by vendors/subcontractors for access to contract material released prior to 252.204-7021.](https://www.reddit.com/r/CMMC/comments/1xuqx6r/is_a_cmmc_cert_required_by_vendorssubcontractors) - reddit-cmmc