The Criticality of DFARS Flow-Down
For defense contractors, compliance doesn’t stop at your own network perimeter. DFARS 252.204-7012 mandates that prime contractors must “flow down” safeguarding requirements to all subcontractors who will process, store, or transmit Controlled Unclassified Information (CUI).
This means if you are sharing CUI with a supplier – whether it’s engineering drawings, technical specs, or contract data – you are responsible for ensuring they are compliant with NIST SP 800-171.
What is “Flow-Down”?
Flow-down is the legal mechanism of including the requirements of the prime contract in subcontracts. Specifically, you must include the substance of the DFARS 252.204-7012 clause in all subcontracts, including those for commercial items, if they involve CUI.
Key Obligations for Subcontractors
- Implement NIST 800-171: Subcontractors must implement all 110 security controls.
- Incident Reporting: They must report cyber incidents affecting CUI to the DoD (via DIBNet) and to you (the prime contractor) within 72 hours.
- Cloud Security: If using cloud services for CUI, those services must meet FedRAMP Moderate equivalency. Per DoD’s December 2023 memo, contractors must provide documented evidence of equivalency – self-attestation is insufficient.
Handling CUI Correctly
Proper CUI handling is the trigger for these requirements.
- Identify: Know exactly what data constitutes CUI. Not everything is CUI.
- Mark: Ensure all CUI is correctly marked before sharing with suppliers.
- Limit: Only share the minimum CUI necessary for the subcontractor to perform their job.
Supplier Verification Strategies
You cannot simply assume your suppliers are compliant.
- Questionnaires: Use standardized questionnaires (like the NIST 800-171 assessment) to gauge maturity.
- SPRS Scores: Request their Supplier Performance Risk System (SPRS) score.
- Shared Responsibility Matrix: Clearly define which controls you handle (if providing GFE) and which they handle.
Preparing for CMMC
The upcoming Cybersecurity Maturity Model Certification (CMMC) will enforce these flow-down requirements with third-party assessments. If your suppliers fail their CMMC assessment, you may be unable to award them contracts involving CUI.
Conclusion
Supply chain security is national security. By strictly enforcing DFARS flow-down and assisting your subcontractors with NIST 800-171 compliance, you protect the warfighter and your business.
Need help assessing your supply chain? Contact our GRC team for a gap analysis.
