Does CMMC Flow Down to Lower-Tier Subcontractors?

CMMC is not limited to the prime contractor. The current rule applies through the DoD supply chain when subcontractors at any tier will use contractor information systems to process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) in performing the contract or subcontract.

The important qualifier is the information being flowed down. A prime should not assign the same CMMC requirement to every supplier without looking at what that supplier actually needs to receive or generate.

32 CFR 170.23 sets the lower-tier framework

The regulation maps the required subcontractor status to the information and associated prime requirement:

• FCI only: Level 1 (Self).
• CUI with a Level 2 (Self) prime requirement: Level 2 (Self) minimum.
• CUI with a Level 2 (C3PAO) prime requirement: Level 2 (C3PAO) minimum.
• CUI under a Level 3 prime requirement: Level 2 (C3PAO) is generally the minimum lower-tier requirement, unless DoD provides specific guidance.

That last point is easy to miss: a Level 3 prime contract does not automatically mean every CUI-handling lower-tier supplier needs Level 3.

Regulatory source: 32 CFR 170.23, Application to subcontractors.

The DFARS clause requires the right flowdown before award

DFARS 252.204-7021 requires the contractor to consult 32 CFR 170.23 and flow the correct CMMC level into subcontracts and other contractual instruments. The current clause also requires the contractor, before subcontract award, to ensure that the subcontractor has the current CMMC certificate or status appropriate for the information being flowed down.

The clause further requires annual affirmations of continuous compliance for relevant subcontractor systems and requires the substance of the CMMC clause to be inserted in subcontracts and other contractual instruments that will require processing, storing, or transmitting FCI or CUI. The clause excludes commercially available off-the-shelf items from that specific subcontract insertion requirement.

Official source: DFARS 252.204-7021.

A lower-tier supplier does not need every piece of prime-contract data

The best compliance decision may be to reduce the information shared. If a supplier can perform its scope without CUI, do not automatically send CUI merely because the prime contract contains it. Separating work packages and data flows can reduce unnecessary compliance scope while still meeting the contract.

The same logic works one tier lower. A first-tier subcontractor that hires a supplier or another subcontractor should decide what information that lower tier actually needs, then flow the appropriate CMMC requirement for that information.

What to verify before issuing a lower-tier subcontract

1. Will this supplier receive or generate FCI, CUI, both, or neither?
2. Which contractor information systems will the lower tier use?
3. What CMMC level and assessment type does 32 CFR 170.23 require for that information?
4. Does the supplier have current status before award?
5. Is the required affirmation current for the relevant systems?
6. Does the subcontract contain the required CMMC substance and clear data-handling expectations?
7. If the supplier will use another lower tier, what must flow down again?

Start with FCI vs. CUI, then use CMMC Level 1 vs. Level 2 to understand the level-selection logic. For the overall rollout, see CMMC requirements for DoD subcontractors in 2026.