Flow-Down Requirements: How Primes Are Enforcing CMMC Compliance Across Their Supply Chains

What Flow-Down Requirements Are and Why They Matter

CMMC flow-down requirements refer to the obligation for prime contractors to pass CMMC compliance requirements down to their subcontractors at every tier. If a prime handles CUI and holds a CMMC Level 2 certification, any subcontractor that touches CUI in the performance of that contract must also meet Level 2 standards.

This is not a future concern. It is happening right now, and it is being driven not just by the government, but by the primes themselves. Major defense contractors including Lockheed Martin, Raytheon, Boeing, Northrop Grumman, and General Dynamics have all issued formal requirements to their supply chains, many ahead of the government's Phase 2 enforcement date of November 10, 2026.

A 2025 Redspin survey found that 47% of subcontractors had already received a formal CMMC flow-down request from a prime by September 2025. That number has grown significantly since then.

What the Major Primes Are Actually Requiring

Each prime has its own specific requirements, but the pattern is consistent:

• ✓Lockheed Martin has issued direct outreach to suppliers with low SPRS scores and requires all subcontractors handling CUI to submit updated SPRS scores. They have stated they expect a perfect 110 score from their suppliers.
• ✓Raytheon (RTX) updated supplier certification requirements in early 2025 and requires all suppliers supporting DoD contracts with DFARS 252.204-7021 to have an active CMMC certification.
• ✓Boeing has issued multiple formal notices requiring suppliers handling FCI and CUI to have the specified CMMC level as a condition of contract award.
• ✓L3Harris issued a supplier letter in April 2026 expecting their suppliers to be certified by July 30, 2026, nearly four months ahead of the government's Phase 2 deadline.
• ✓Elbit Systems has made it explicit: buyers will not issue purchase orders to suppliers who fail to meet contractual CMMC flow-down requirements.

The message from the primes is clear. Waiting for government enforcement is not a strategy. Primes are making contract decisions based on CMMC readiness today.

The Legal Obligation Under 32 CFR 170.23

Beyond prime contractor preferences, flow-down is a legal requirement. Under 32 CFR Section 170.23, primes are required to flow down CMMC requirements to subcontractors at every tier based on the type of data being shared:

• ✓If a subcontractor receives only Federal Contract Information (FCI), they must meet CMMC Level 1.
• ✓If a subcontractor receives Controlled Unclassified Information (CUI), they must meet CMMC Level 2.

The prime bears responsibility for verifying subcontractor compliance status before sharing sensitive information or awarding subcontracts. This means primes are now actively auditing their supply chains as part of their own compliance obligations.

What Subcontractors Must Do Right Now

If you are a subcontractor in the defense supply chain, here is what you need to do immediately:

• ✓Identify what type of data you handle. FCI requires Level 1; CUI almost certainly requires Level 2.
• ✓Check your prime's supplier portal and any direct communications for their specific CMMC requirements and timelines.
• ✓Conduct a gap assessment against the 110 NIST SP 800-171 controls and calculate your current SPRS score. Small subcontractors can apply for a free assessment through the CMMC Grants program.
• ✓Submit an updated SPRS entry. An outdated or missing SPRS score is a red flag that primes are actively screening for.
• ✓Book a C3PAO engagement now. Assessment slots are filling rapidly and lead times are stretching beyond six months.

Tier 2 and Tier 3 Suppliers Are Not Exempt

One of the most common misconceptions in the defense supply chain is that flow-down only applies to direct subcontractors. Under CMMC, the obligation flows to every tier. A machining shop that receives technical drawings containing CUI from a Tier 1 subcontractor has the same compliance obligations as the Tier 1 firm itself.

Small businesses and single-person shops are not exempt. Company size does not factor into CMMC scope. What matters is whether your systems process, store, or transmit CUI.