CMMC for DoD Subcontractors: Obligations, Timelines, and What to Do When Your Prime Demands Compliance

Last reviewed June 2026

In short: DoD subcontractors are fully subject to CMMC when a prime flows the requirement down under 32 CFR Part 170 and DFARS 252.204-7021 and you process, store, or transmit CUI. FCI-only work maps to Level 1; CUI work maps to Level 2 — self-assessed or C3PAO-assessed as your subcontract specifies.

DoD subcontractors — companies that receive work from prime contractors rather than directly from DoD — are fully subject to CMMC requirements when the prime flows down the obligation. That flow-down is required under 32 CFR Part 170 and DFARS 252.204-7021 whenever the subcontractor will process, store, or transmit CUI or provide security protection for CUI systems. The most common shock for subcontractors: finding out their prime is requiring CMMC certification with a 90- to 120-day deadline.

How CMMC Flow-Down Works for Subcontractors

Under 32 CFR Part 170, prime contractors must flow CMMC requirements to subcontractors when CUI will be shared. The flow-down clause is DFARS 252.204-7021. When the prime includes this clause in your subcontract — with a specified CMMC level — you have the same compliance obligation as the prime for that information type.

Important: if your prime has not yet included the clause in your subcontract, that does not mean you are exempt. It may mean the prime is behind on their own compliance obligations. If your prime sends you CUI — even informally, through email, through shared drives, or in meeting materials — and you store or process it, your handling of that data likely carries an obligation regardless of whether the contractual clause has been updated.

Determining Your Level as a Subcontractor

Your required CMMC level is determined by the information type you handle under the subcontract — not by your company size or role:

The Friction Subcontractors Face

• Short timelines imposed by primes. Primes are under their own DFARS and CMMC obligations and are increasingly passing tight timelines downstream. A 90-day demand from a prime is not an unusual opening position. Achieving Level 2 from zero in 90 days is not realistic for most companies — but an honest scope conversation with the prime and a documented plan of action may preserve the relationship while managing the timeline realistically.
• No budget allocation. Many subcontractors were not pricing CMMC compliance into contract estimates 2–3 years ago. Retroactively absorbing $100K+ in compliance costs on existing subcontracts is a business problem, not just a technical one. Scope reduction is the most important cost lever.
• Multiple primes, different requirements. If you subcontract to multiple primes, each may flow down different CMMC levels or assessment paths. The most stringent active requirement governs your practical posture. Maintaining a single documented CMMC program that satisfies all active flow-downs is more efficient than managing them separately.
• SPRS score not yet posted.Before you can satisfy a DFARS 252.204-7019/7020 clause, you need a current NIST SP 800-171 score in SPRS. If you don’t have one, that is the first deliverable — a gap assessment produces the evidence you need to calculate and post a defensible score.

What to Do When Your Prime Demands Compliance

1. Get the clause language in writing. Request the specific DFARS clause(s) and CMMC level being required. Do not act on a verbal demand without confirming the contractual basis.
2. Assess whether your data actually includes CUI. Before assuming Level 2, confirm whether the data your prime shares is actually CUI-designated. If it is not, the Level 2 requirement may not apply.
3. Commission a gap assessment. A gap assessment from an RPO gives you a defensible SPRS score posture, a remediation roadmap, and the evidence you need to have a realistic conversation with your prime about timeline.
4. Evaluate scope reduction. Before committing to full environment remediation, evaluate whether a managed CUI enclave or GCC High migration can limit your scope — and cost.
5. Set realistic expectations with the prime. A documented plan of action demonstrating your gap, your remediation plan, and your target date is more credible than promising 90-day compliance you cannot deliver.

Which provider category fits your situation

• RPO/RP (Registered Provider Organization / Registered Practitioner) — when you need a gap assessment, a defensible SPRS score posture, an SSP, and a remediation roadmap before any assessment.
• MSSP (Managed Security Service Provider) — when you have no internal IT or security staff to implement and maintain the controls your flow-down requires.
• CUI enclave — when only a narrow set of workflows touches CUI and a managed enclave or GCC High can limit your scope and cost.
• C3PAO (Certified Third-Party Assessment Organization) — when your prime requires a Level 2 (C3PAO) assessment and you are assessment-ready. You don’t need a C3PAO yet if your flow-down only requires a self-assessment, or you are still scoping and remediating.

Related Guides

• CMMC Level 1 vs Level 2: Which One Applies to Your Contract?
• CMMC Gap Assessment: Scope, Cost, and What to Expect
• SPRS Score for CMMC: What Contractors Need Before Award
• CMMC Level 2 Cost: DoD Estimate vs Real Budget
• CMMC for Small Defense Contractors
• CMMC Managed Enclaves: Scope Reduction Guide
• Best CMMC Consultants for Defense Contractors (2026)
• CMMC MSPs and MSSPs: How to Choose
• C3PAO Directory: Authorized CMMC Level 2 Assessors

Sources

• 32 CFR Part 170 — CMMC Program Final Rule (2024), including flow-down requirements
• DFARS 252.204-7021 — CMMC Requirements
• DFARS 252.204-7019/7020 — NIST SP 800-171 DoD Assessment Requirements
• NIST SP 800-171 Revision 2
• 89 Fed. Reg. 66924 — CMMC Cost Analysis

Provider-matching forms on this site may generate referral or lead-routing compensation. This page does not currently contain named provider rankings, endorsements, or "best provider" awards. If named provider reviews are published later, sponsored, affiliate, partner, or referral relationships will be labeled on the relevant provider card or review. See our Methodology and Editorial & Advertising Policy for details.