Prime contractors must meet CMMC themselves and require subcontractors at every tier to do the same. A subcontractor's level depends on what information it touches and what the prime contract requires: Level 1 (Self) for federal contract information only, and at least Level 2 (Self) when CUI is involved.
The rule
32 CFR 170.23 says primes "shall comply and shall require subcontractors to comply with and to flow down CMMC requirements." Flow-down covers every tier, not just your direct suppliers.
How the required level is set
- FCI only, no CUI: Level 1 (Self).
- CUI involved: Level 2 (Self) at minimum.
- CUI, and the prime contract requires Level 2 (C3PAO): Level 2 (C3PAO) is the minimum for the subcontractor.
- CUI, and the prime contract requires Level 3 (DIBCAC): the subcontractor's minimum is still Level 2 (C3PAO), not Level 3.
DoD may issue its own flow-down instructions for a specific solicitation or contract, so check for those.
What primes should do
- Map which suppliers touch FCI or CUI. Many do not touch either, and need nothing.
- Give each supplier the minimum level in writing, with the contract language.
- Ask for their status in SPRS or the equivalent record before sharing CUI.
- Build the check into onboarding, not into a yearly review.
- Keep CUI out of suppliers that cannot meet the level. Sharing less is a legitimate answer.
What subcontractors should do
Ask the prime what information you will receive and whether CUI is involved. Get the required level in writing. If your level is Self, still run the assessment as if it will be reviewed, since the affirmation is a formal statement by a senior official.
Software vendors who are subcontractors should also watch for related clauses. Our post on flowing down CMMC and CRA clauses covers contract wording.
Common mistakes
Applying Level 2 to every supplier by default. It adds cost without reducing risk where no CUI flows.
Assuming a carve-out applies without checking. The exclusion in 170.3 covers acquisitions made exclusively for COTS items, so confirm it against the actual contract.
Forgetting lower tiers. The prime remains responsible for requiring flow-down.
Where Safeguard fits
Safeguard's compliance and evidence automation can hold supplier records and artifacts in one place. It does not assess suppliers against CMMC.
Quick check
If the prime needs Level 3, does the sub need Level 3?
Not by that rule alone. The text sets the subcontractor minimum at Level 2 (C3PAO) when CUI is involved.
Does a sub with only FCI need Level 2?
No. Level 1 (Self) is the stated requirement for FCI only.
Sources
Last reviewed: 19 October 2026.
