Every sub signed the flow-down. Which of them are actually exposed?
Your most exposed CUI lives two tiers down, on a flat network, behind a shared admin password. MacTech builds the sub-tier register an auditor asks for first, flows the clause so it holds, and replaces attestations with posture you can watch.
Your subs can start today: the readiness check and MSP grader are free and need no account. Try what they would use.
Three uncomfortable facts about supply-chain cyber today
- When a sub has a cyber incident, it reports to DoD itself within 72 hours. What the clause owes you is the incident report number, as soon as practicable (DFARS 252.204-7012(m)(2)(ii)).
- A sub's SPRS assessment can be up to three years old and still pass the check before award (DFARS 252.204-7020(g)(2)).
- Where CMMC applies, the rule has you check a sub at award and see that it affirms each year. Nothing in it asks you to watch the months in between (DFARS 252.204-7021(f)(2), (d)(4)).
01 - Obligations
What a prime contractor actually owes, clause by clause
Flow DFARS 252.204-7012 to every sub that touches CDI
Put the clause in every subcontract whose performance involves covered defense information or operationally critical support, commercial ones included, without alteration except to identify the parties.
DFARS 252.204-7012(m)(1) · in the subcontract, at every tier
Check the sub's SPRS assessment before award
Do not award a subcontract that requires NIST SP 800-171 unless the sub has completed at least a Basic assessment within the last three years.
DFARS 252.204-7020(g)(2) · prior to award
MacTech recommends
Record each sub's score and assessment date in one sub-tier register, so the check before the next award is a lookup, not an email chain.
Require every sub to pass you its incident report number
Require each sub to give you the DoD incident report number as soon as practicable; the sub reports its own cyber incident to DoD, within 72 hours of discovery.
Confirm CMMC status before award, and the affirmation every year
Where your contract carries 252.204-7021, confirm before award that each sub handling FCI or CUI holds a current CMMC status at the level that information requires, and ensure it renews its affirmation of continuous compliance every year.
DFARS 252.204-7021(f)(2), (d)(4) · prior to award, then annually
MacTech recommends
Monitor each sub's posture continuously between those dates. A SAM registration about to lapse, or a Conditional status near the end of its 180 days, shows up long before the next affirmation would catch it.
The clause, from the source
What 252.204-7012 makes your subs do, and how it must flow down
Every sub that touches covered defense information inherits this clause unaltered. Here it is read back by the CMMC MCP server, with the deadlines primes are most often surprised by. Your subs' managed service providers inherit it too: the MSP grader at /esp-grader gives them the thirteen questions to ask.
What this proves: The clause flows down without alteration whenever a sub touches covered defense information, carries a 72-hour incident clock and a 90-day preservation duty, and makes 800-171 Rev 2 contractually binding by class deviation.
$ lookup_clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting · contract clause applies when: CDI (which includes CUI) is processed, stored or transmitted on a contractor system requires: implement NIST SP 800-171 — pinned to Rev 2 by class deviation 2024-O0013 R1 until rescinded requires: report cyber incidents to DoD at dibnet.dod.mil (medium-assurance certificate needed first) requires: preserve affected images and monitoring data ≥ 90 days from the report deadline: cyber incident report within 72 hours of discovery flowdown: to subcontractors WITHOUT ALTERATION except to identify the parties, whenever performance involves CDI primes commonly get this wrong by editing the clause or omitting it from commercial-item subcontracts triggers: 252.204-7019 / 7020 — a current SPRS score becomes a condition of award
02 - The MacTech model
The sub-tier register, built for you in an engagement
What you receive
A spreadsheet (.xlsx) with one row per sub that handles FCI or CUI: CAGE code, SAM.gov registration status and expiry, the clauses in its subcontract, SPRS score and assessment date, CMMC status, level and UID, and the date of its last affirmation. Every entry carries its date and source; a missing answer is marked missing, not guessed.
What it is built from
Your subcontract list and the clauses in each subcontract, each sub's public SAM.gov registration, and the SPRS score, CMMC UID and affirmation date each sub reports to you.
Shared CUI enclave for critical subs
For the suppliers you cannot afford to lose to compliance cost, MacTech's shared enclave gives the prime a defined CUI boundary that the sub inherits. Each side keeps its own assessment, but the technical controls and the evidence library are platform-provided.
The incident hand-off, rehearsed
Each sub reports its own cyber incident to DoD within 72 hours and owes you the DoD report number (DFARS 252.204-7012(m)(2)(ii)). MacTech's IR tabletop kit rehearses that hand-off, so the number reaches the right person at the prime.
04 - Questions
Supply-chain cyber compliance - frequently asked
Why is the supply chain the new attack surface?
Adversaries do not target the prime contractor with the SOC and the 24/7 incident response team. They target the small machine-shop sub two tiers down with a flat network and a shared admin password. That is why DFARS 252.204-7012 does not stop at the prime: it flows, unaltered, into every subcontract whose work involves covered defense information, at every tier (252.204-7012(m)(1)).
What does DFARS 252.204-7012 require primes to flow down?
The clause requires primes to flow DFARS 252.204-7012 (and therefore NIST 800-171 implementation) to all subcontractors that handle CUI. The clause survives the entire subcontract chain - Tier 1 to Tier 2 to Tier 3 - wherever CUI flows. The prime is responsible for ensuring the flowdown is in every subcontract.
How does a prime verify a sub is actually compliant?
The clauses name what to check before award: a Basic NIST SP 800-171 assessment completed in the last three years (DFARS 252.204-7020(g)(2)) and, where the subcontract carries 252.204-7021, a current CMMC status at the right level plus an annual affirmation of continuous compliance (252.204-7021(f)(2) and (d)(4)). The challenge is freshness: a PDF attestation from 18 months ago says little about today. In an engagement, MacTech collects each sub's answers into a sub-tier register for you, with every entry dated.
What happens when a sub fails to meet flowdown requirements?
The clauses put three duties on the prime: flow them down, check the sub before award, and ensure the sub keeps its annual CMMC affirmation current (DFARS 252.204-7012(m), 252.204-7020(g), 252.204-7021(f) and (d)(4)). Beyond those, the sub answers for its own systems under the clause it signed. MacTech recommends going further: monitor sub posture continuously between awards and act on a slipping score before it becomes an incident.
How do small subs respond to flowdown demands?
Three patterns: (1) the sub already runs a compliant program and shares evidence on request, (2) the sub asks the prime for technology or process help to get there, or (3) the sub disengages because the cost is too high. The third pattern is the most dangerous to the prime - it shrinks the supplier pool and pushes work to less-prepared suppliers downstream. Primes that pair flowdown with platform support keep more of their supplier base.
Can primes share a compliance platform with their subs?
Yes - and the math is compelling. A prime that gives selected critical subs access to a shared CUI enclave gets a documented, inheritable control set across the relationships that matter most. Each sub still owns its own SSP and assessment, but the boundary, the technical controls, and the evidence library are shared infrastructure. This is exactly what MacTech's prime-sub deployment model supports.
How do I prove supply-chain compliance to the contracting officer?
No clause prescribes a format. What the clauses ask you to be able to show is that each sub carried the clause, had a current assessment before award, and keeps its CMMC affirmation current. In an engagement, MacTech builds that as a sub-tier register: a spreadsheet you keep, with one row per sub that handles FCI or CUI and the date and source of every entry. How a sub hands you its DoD incident report number is rehearsed in the IR tabletop kit.
How does the new CMMC rule change primes' obligations?
It adds a check before award. Where your contract carries DFARS 252.204-7021, each sub that will handle FCI or CUI must hold a current CMMC status at the level appropriate to that information, and must affirm continuous compliance every year (252.204-7021(f)(2) and (d)(4)). Status since 13 Jul 2026: CMMC Phase II suspended: no C3PAO assessments can be designated. DFARS 7012 and Rev 2 still apply.
From MacZine
What the flow-down looks like downstream
Written for the people on the receiving end of the clause you are about to send.
Show me a defensible sub-tier program
A 30-minute working session with MacTech: walk your current sub-tier register, identify the gaps an IG would find, and leave with a sequenced plan to close them.