DFARS & Legal5 min read

Flow-Down Requirements: Prime to Subcontractor Obligations

Under 32 CFR 170.23, primes must flow CMMC requirements to every subcontractor who touches FCI or CUI — and verify compliance before sharing sensitive data.

CMMC does not stop at the prime contractor. Under 32 CFR Section 170.23, prime contractors are legally required to flow CMMC requirements to their subcontractors at every tier.

The flow-down rule at a glance

✓FCI only → Level 1 required for the subcontractor
✓CUI → Level 2 required for the subcontractor (or Level 3 if specified)
✓The prime bears responsibility for verifying the subcontractor's compliance status before sharing CUI
✓This verification obligation cascades: Tier 2 primes must verify Tier 3 subs, and so on

What major primes are doing in 2026

Major defense primes are enforcing flow-down requirements independently of the government timeline. Multiple large primes have issued formal supplier notices requiring CMMC Level 2 compliance with deadlines that predate the government's own Phase 2 enforcement dates.

The tier problem

Many Tier 3 and Tier 4 suppliers believe CMMC does not apply to them because they have no direct relationship with DoD. This is wrong. If a Tier 1 sub shares CUI with a Tier 2 machine shop, that machine shop needs Level 2 certification. The data determines the obligation, not the tier.

Read the full analysis: How Primes Are Enforcing CMMC Compliance Across Their Supply Chains.

Ready to start your CMMC journey?

Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.

Book a Call with Rick Get a Gap Assessment