CMMC flow-down to subcontractors (DFARS 252.204-7021)

The CMMC clause asks contractors to hold the CMMC status a contract requires and to flow that requirement down to subcontractors that handle FCI or CUI. The dates have moved, so here is where things stood when this guide was checked, with the sources.

Checked against the official sources on October 22, 2026. General information, not legal advice.

Where things stand (checked October 22, 2026)

The program rule, 32 CFR part 170, sets out the CMMC levels and assessments.
The contract rule, DFARS Case 2019-D041, was published in the Federal Register on September 10, 2025 and took effect November 10, 2025. It added the clause at DFARS 252.204-7021 and the provision at 252.204-7025, and began Phase 1: Level 1 and Level 2 self-assessments in applicable solicitations and contracts.
Phase 2, which would make a Level 2 certification by a C3PAO a condition of award in applicable contracts, was due November 10, 2026. On July 13, 2026 the Department suspended Phase 2 and later milestones while a reform review runs. Phase 1 self-assessment requirements stay in place, as do DFARS 252.204-7012 and SPRS postings. When this guide was checked, no new Phase 2 date had been announced.

This is general information, not legal advice. Read the clauses in your contract, and check the DoD CIO's CMMC pages for changes after the date above.

What flow-down asks of a prime

Paragraph (f) of 252.204-7021 (NOV 2025) has the prime put the substance of the clause in subcontracts that will process, store or transmit FCI or CUI (commercial ones included, commercially available off-the-shelf items excluded) and, before awarding one, make sure the sub has a current CMMC certificate or status at the level appropriate for the information flowed down to it. In practice that means, for each sub that touches FCI or CUI:

Which CMMC level the work needs, and the sub's current status at that level, with its date
The sub's SPRS score for NIST SP 800-171, with the date it was posted
A current SAM.gov registration and no exclusions, since none of the rest matters otherwise

How Watch helps

The "DoD subcontract with CUI" requirement template measures each sub against an active registration, no exclusions or screening hits, CMMC Level 2 (Self) at least, an SPRS score and a certificate of insurance; the FCI-only template asks for Level 1 (Self). When your prime contract names Level 2 (C3PAO) or Level 3, the "CMMC Level 2 (C3PAO)" and "CMMC Level 3 (DIBCAC)" templates hold subs to that level, and a Level 2 self-assessment is flagged as not enough
Each sub's CMMC status is kept with its level, assessment type (self, C3PAO or DIBCAC), final or conditional status, status date, CMMC UID and the latest annual affirmation with its affirming official. You're warned before it expires, before a conditional status reaches its 180-day POA&M closeout, before the affirmation is a year old, and when the SPRS score is missing or over three years old
The CMMC readiness report lists the subs that handle CUI against the CMMC status they need
The supplier portal asks a sub for exactly what's missing, with a CUI handling and CMMC status questionnaire
A one-page flow-down status per contract tag for the contracting officer, and a per-supplier evidence package

Watch doesn't assess anyone and isn't a CUI system: it keeps the status your subs give you next to their public record. Don't upload CUI to it.

Sources

Try it on your own suppliers

The first 5 suppliers are included. No card to start. Paste UEIs, upload a list or type one sentence.

Check my suppliers or see pricing

Questions

When did the CMMC contract clause take effect?

The DFARS rule adding 252.204-7021 was published September 10, 2025 and took effect November 10, 2025, starting Phase 1 (self-assessments).

Is CMMC Phase 2 still starting November 10, 2026?

Not as planned. On July 13, 2026 the Department suspended Phase 2 and later milestones pending a review. Phase 1 self-assessments, DFARS 252.204-7012 and SPRS postings still apply. As of October 22, 2026 no new Phase 2 date had been announced.

Does the prime have to flow CMMC down to subcontractors?

Yes, where the subcontract will involve processing, storing or transmitting FCI or CUI (COTS items excluded). Before awarding it, the prime makes sure the sub has a current CMMC certificate or status at the level appropriate for the information flowed down. Read the clause in your contract for the exact terms.

Does Watch assess CMMC?

No. Watch keeps the certificate and SPRS score your subs give you, with dates and expiry warnings, next to their SAM.gov status. It isn't a CUI system.