The checklist
| Check | Why | Where to look | Keep |
|---|---|---|---|
| 1. The right company | Every later check is only as good as this one | UEI and CAGE code | The identifier, and how you matched it |
| 2. SAM.gov status | Tells you what the public record can say about the sub, and any expiry | SAM.gov entity record | Status and expiry date, with the date you read them |
| 3. Exclusions | FAR 52.209-6 | SAM.gov exclusions | The search, its date, and every result you decided on |
| 4. Written disclosure | 52.209-6(c), for the sub and its principals | The sub | The signed disclosure |
| 5. Integrity records | Responsibility: yours, and the agency's view of yours | SAM.gov integrity records | Any record, and what you did about it |
| 6. Sanctions and export lists | OFAC and export rules, whatever the contract says | Consolidated Screening List | Each possible match and the decision on it |
| 7. Section 889 | The telecom prohibition | The sub, after a reasonable inquiry | The sub's signed answer |
| 8. Cybersecurity status | CMMC flow-down | The sub, for DoD work with FCI or CUI | The sub's level, status date and SPRS score |
For grant money the rules differ: see 2 CFR 180 and 200 for subrecipients.
Which checks depend on the award
- Value. The 52.209-6 prohibition, disclosure and flow-down apply to subcontracts over the threshold in FAR 9.405-2(b), $45,000 when this guide was checked. Many primes screen below it anyway, because the check costs little and an exclusion is a poor thing to find later.
- What is being bought. Subcontracts for commercially available off-the-shelf items are outside 52.209-6. Section 889 has no such carve-out: its clause goes in all subcontracts, commercial ones included.
- What the sub will touch. CMMC flow-down depends on whether the sub will process, store or transmit FCI or CUI.
- Where the money comes from. A contract, a grant and a commercial sale each bring their own rules. The prime contract decides, not a checklist.
When to run it
Run it when you onboard a sub, and again close to each award. 52.209-6 asks for the disclosure "as of the time of award", so a check from onboarding isn't the same as a check before award. In our count, exclusions took effect in every month of 2026, in uneven batches, so a quiet month says little about the next one.
Options and modifications deserve a look too: new work is a natural moment to check again, even when no new subcontract is being signed.
What the file should show
A contractor's compliance with 52.209-6 is reviewed during Contractor Purchasing System Reviews (FAR 9.405-2(c)), so someone may ask for this years later. A reviewer wants to see, for each sub:
- Which registration you checked, and why you knew it was the right one
- The date of each check, and the data date of the list behind it
- What came back, including possible matches, and who decided them
- What you did about anything you found
How Watch helps
Watch runs checks 1 to 3, 5 and 6 from public records once you confirm a supplier's registration, and collects 7 and 8 from the supplier through its portal, with a Section 889 questionnaire and a CUI handling and CMMC status questionnaire. Type a deadline into a watch ("before the Nov 14 award") and the day before it re-checks each confirmed supplier and freezes a dated snapshot.
Check 4 stays yours: Watch's sanctions declaration isn't worded as the 52.209-6 disclosure, so use your own form and keep the signed copy on the supplier. Per supplier, the record comes out as a PDF evidence package.