Back to Knowledge HubCybersecurity & CMMC

CMMC Supplier Questionnaires: What a DoD Subcontractor Should Verify Before Answering

A supplier questionnaire can become a written representation about systems, certifications, and security practices. Answer the contract question first: what information will this subcontract actually require you to handle?

Primes increasingly use supplier questionnaires to determine whether a lower-tier company can receive work involving FCI or CUI. The questionnaire may ask about CMMC status, SPRS records, NIST implementation, cloud providers, incident response, and subcontractor controls.

The safest process is to reconcile the questionnaire with the actual solicitation or subcontract. A company should not represent that every system, site, or product line meets a requirement when only a defined enclave or information system is intended for the work.

CMMC status is tied to systems and information

DFARS 252.204-7021 requires the contractor to maintain the required CMMC status for information systems used in performance that process, store, or transmit FCI or CUI. It also requires the correct level to be flowed to qualifying lower-tier subcontracts.

Official source: DFARS 252.204-7021 — CMMC Level Requirements.

Questions to resolve before submitting the form

  • Will this subcontract involve FCI, CUI, both, or neither?
  • Which company information system or enclave will perform the work?
  • What CMMC level and assessment type is required for that system?
  • Is the CMMC status and annual affirmation current for the applicable UID?
  • Are any questionnaire questions asking for broader enterprise-wide representations than the subcontract requires?
  • Will any lower-tier supplier process, store, or transmit the same information?

Do not let a questionnaire silently expand the subcontract

A questionnaire should support qualification, not become an uncontrolled source of new obligations. Check whether the subcontract incorporates the completed form, requires continuing accuracy, allows unilateral questionnaire updates, or treats an answer as a warranty. Material representations about cybersecurity should be reviewed for accuracy before submission.

Keep the evidence behind each answer

Maintain a short evidence file for material questionnaire responses: the applicable CMMC UID or status, assessment date, system boundary, relevant policy or procedure, and the person responsible for the response. That makes later annual updates and prime audits more reliable and reduces inconsistent answers across customers.

Related SubPreCheck Guides

Explore the full topic

CMMC & DoD Cybersecurity Hub