CMMC 2.0 for Subcontractors: Flow-down Requirements and SPRS Verification

The Prime-Subcontractor Compliance Mandate

With the codification of the CMMC 2.0 final rule, the burden of cybersecurity compliance no longer rests solely on the prime contractor. Under DFARS 252.204-7021(f), prime contractors are explicitly required to flow down CMMC requirements to their subcontractors. This is not a mere administrative exercise; it is a prerequisite for award and performance. For capture managers and compliance leads, understanding the mechanics of this flow-down is critical to maintaining a viable supply chain.

Navigating DFARS 252.204-7021

The regulatory framework established in DFARS 252.204-7021 mandates that the CMMC level required by the solicitation—whether Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC)—must be met by every contractor information system that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

Primes must ensure that:

• Subcontractors possess the appropriate CMMC level prior to award.
• Subcontractors maintain a current self-assessment or certification in the Supplier Performance Risk System (SPRS).
• The CMMC Unique Identifier (UID) issued by SPRS is submitted to the Contracting Officer for all systems used in contract performance.

Verifying Subcontractor SPRS Scores

One of the most significant operational shifts is the requirement for primes to verify subcontractor compliance. As noted in CMMC Phase 1 guidance, prime contractors are increasingly asking for screenshots or direct evidence of a subcontractor’s SPRS score and status.

Practitioners should implement a three-step verification process:

1. CAGE Code Alignment: Ensure the subcontractor's CAGE code in SPRS matches the entity performing the work. Discrepancies here can lead to disqualification during the pre-award phase.
2. Score Validity: Verify that the NIST SP 800-171 assessment score is current (within the last three years) and that a plan of action and milestones (POA&M) exists for any unmet requirements.
3. Annual Affirmation: Under the final rule, subcontractors must complete an annual affirmation of continuous compliance in SPRS, signed by a senior official. Primes should include this affirmation as a required deliverable in their teaming agreements.

Strategic Teaming Considerations

When building a pursuit team, capture managers must evaluate the 'cyber-readiness' of potential partners. A subcontractor with a low SPRS score or an expired assessment represents a significant risk to the prime's eligibility.

• Pre-Qualification: Include CMMC compliance as a mandatory field in your subcontractor pre-qualification portal.
• Teaming Agreements: Insert clauses that require subcontractors to notify the prime within 72 hours of any change in their SPRS status or CMMC certification level.
• Cost of Compliance: Be prepared to discuss how the cost of CMMC Level 2 assessments—which may involve C3PAO third-party audits—will be factored into the overall price proposal.

By operationalizing these verification steps, prime contractors can mitigate the risk of non-compliance and ensure their supply chain remains a competitive advantage rather than a liability.