Subcontractors get the messiest version of CMMC. The prime sends a supplier questionnaire written for every possible supplier, the form asks for a "SPRS score," and the sub is left wondering whether it needs Level 1, Level 2, a C3PAO, a consultant, or a nap.
For FCI-only work, the answer is narrower: Level 1 flows down when the subcontractor will handle FCI. The evidence you owe the prime is a current Level 1 status and enough supporting context for the prime to document supplier risk.
The short answer
- If your subcontract involves FCI but not CUI, the natural CMMC level is Level 1.
- The prime is responsible for ensuring subcontractors have the appropriate current CMMC status before award.
- Level 1 does not create a 0-110 SPRS score. It creates a Level 1 self-assessment and annual affirmation status in SPRS.
- If the prime is flowing down CUI, pause. That may be Level 2, and you need to scope it before accepting the work.
When Level 1 flows down
Level 1 is tied to information, not company size. The key question is whether your systems will process, store, or transmit FCI. The DoD Level 1 Scoping Guide says Level 1 in-scope assets are the assets that process, store, or transmit FCI.
| Subcontract scenario | Likely CMMC result | Why |
|---|---|---|
| Prime sends you a non-public task order, schedule, and site instructions. | Level 1 | That is FCI-only unless marked or identified as CUI. |
| Prime sends drawings marked CUI or CONTROLLED. | Potential Level 2 | CUI changes the obligation. Ask what clause and data are being flowed down. |
| You sell only commercially available off-the-shelf items and do not receive non-public contract info. | Often excluded | The DFARS rule excludes awards solely for COTS items. |
| You work inside the prime's system and never store FCI on your own systems. | Clarify in writing | The prime may still require user hygiene, but the scoped contractor information system may be theirs. |
| The prime asks for a Level 2 SPRS score even though only FAR 52.204-21 flows down. | Push back politely | Level 1 has an affirmation status, not a 0-110 NIST 800-171 score. |
What the prime needs from you
The prime's job is to document that its supply chain is eligible for the level of information it is flowing down. The 2025 DFARS final rule says there is not an automated process for primes to view subcontractor CMMC status directly, but subcontractors can print or screenshot their own status and affirmation information in SPRS and share it.
For Level 1, send a small packet:
- CAGE code or entity identifier.
- Current CMMC Level 1 status in SPRS.
- Affirmation date.
- Affirming official name and title.
- Scope summary: what systems/processes touch FCI.
- Optional SSP or 15-control evidence summary if requested.
Do not inherit Level 2 by accident
The most expensive mistake is answering a Level 2 question as if it applies to Level 1. If a prime asks for a 0-110 SPRS score, ask which clause and information type are flowing down. If the answer is FCI only, your Level 1 affirmation is the right deliverable.
That sentence does two useful things: it shows competence, and it prevents the supplier form from silently expanding your scope.
Email template for the prime
Primary sources
- 2025 DFARS CMMC final rule: effective November 10, 2025; contractor and subcontractor status requirements; SPRS status sharing discussion.
- DoD CMMC Scoping Guide - Level 1: Level 1 scope is assets that process, store, or transmit FCI.
- FAR 52.204-21: the FCI safeguarding clause and 15 requirements.
FAQ
Does CMMC Level 1 apply to subcontractors?
Yes, when the subcontractor will process, store, or transmit Federal Contract Information for DoD work and the appropriate CMMC requirement flows down. The prime must ensure the subcontractor has a current CMMC status at the level appropriate for the information being flowed down.
Can a prime require a subcontractor to show CMMC Level 1 status before award?
Yes. The DFARS CMMC rule requires CMMC status at the time of award when the contract requires it. Primes also have to ensure subcontractors have current CMMC status at the appropriate level before awarding the subcontract or other contractual instrument.
What should a Level 1 subcontractor give its prime?
A Level 1 subcontractor should provide the CAGE code or entity information, the current Level 1 self-assessment/affirmation status, affirmation date, affirming official name and title, and a short Level 1 evidence summary or SSP if the prime asks for support.
Can a prime see my Level 1 SPRS status directly?
The 2025 DFARS final rule says there is not an automated process for primes to view subcontractor CMMC status. Subcontractors can print or screenshot their own CMMC status and affirmation information in SPRS and share it as appropriate.
Do subcontractors need Level 2 if the prime has Level 2?
Not automatically. The subcontractor's level should match the information flowed down. FCI-only work is Level 1. If CUI flows down, or DFARS 252.204-7012 flows down because the subcontractor will handle CUI, then Level 2 may apply.