Updated September 30, 2026
This one is for the shop that sends work down the chain. If your subcontractor's CMMC status doesn't cover the building that will machine your part, hold the drawing. A packet that covers their engineering office tells you nothing about their plant across town. It comes up more often than you'd expect, and it's easy to miss because both locations sit under one company name.
CMMC is the Defense Department's cybersecurity program for suppliers. When you hand a sub a controlled drawing, the government holds you responsible for having checked, before the award, that the sub has a current CMMC status. Skip the check and a leak at your sub becomes your problem with your own customer. During the pause, the level you check for is the one the rules give your sub: Level 1 (Self) for order data, Level 2 (Self) for CUI, and a certificate only if your own DoD contract still names Level 2 (C3PAO) (32 CFR 170.23). Anything beyond that is a term you negotiate and write into the subcontract. What a prime can require during the pause →
Each status is tied to a CMMC UID (unique identifier), a 10-character code the government's SPRS system (Supplier Performance Risk System) issues when a company posts an assessment. The UID belongs to the specific set of systems that was assessed, not to the company as a whole. The question is always whether the machines doing your job are inside the systems that UID describes. A shared letterhead doesn't settle that, and the sub's outside programmers and IT providers land in or out of scope on their own terms.
The usual version
You issue subcontract SC-017 to Entity B. Its engineers at Site A write the program for the CNC machine, and its machinists at Site B cut the part. The drawing and setup sheet are CUI (controlled unclassified information: technical data the government marks as sensitive). Entity B's packet shows Level 2 (Self), a self-scored assessment against 110 security requirements, for "Site A engineering." Site B isn't mentioned.
Four facts decide it, and you can get them without reading anyone's system security plan:
| What you collect | Entity B | Result |
|---|---|---|
| CMMC UID for the systems doing your job | Site A engineering only | Fails: Site B not covered |
| Status level and date | Level 2 (Self), four months old | Passes |
| Latest yearly affirmation (an executive's signed statement in SPRS that they still comply) | Four months ago | Passes; due again in eight |
| Older-style NIST assessment on file, if your contract still requires one | Within three years | Passes |
One failed row is enough to hold the release. If you release anyway, your customer's drawing sits on systems with no CMMC status, and you're the company the contract made responsible for checking.
The email
If you're the sub reading this, answering a prime's CMMC letter covers your side. Entity B's first answer will probably be "both sites are ours." That's true, but it isn't what you asked. Send this instead:
For SC-017, please send the CMMC UID, status level and status date for the information system that will receive our drawing and setup sheet at Site B, plus your latest SPRS affirmation date for that UID. The packet we have covers Site A engineering only, so we're holding the file transfer until Site B is confirmed. If you'd rather perform the work at Site A, let us know and we'll amend SC-017 first. Please also tell us if an outside programmer will see the model; they'd need the same flowdown.
There are three ways this ends. The sub sends a UID that covers Site B: record it, the date you checked it, and your name, then release. The sub moves the work to Site A: amend SC-017 to name Site A, then release. Or the sub can't answer within ten business days: escalate to the buyer and move the job to your second source. Whichever happens, keep the record. When your own assessor asks how you checked your subs, that record is the answer.
One more column belongs on your supplier sheet, kept separate from the pass/fail above. A sub can pass every check and still be the only shop that can make your long-lead bracket. Ask them to restore last month's job files from backup while you watch. Write down "recovery proven" or "recovery unproven." It doesn't change whether they're eligible. It tells you how exposed your delivery date is.
Where the rules come from
For whoever manages your contracts. DFARS 252.204-7021 is the clause that matters here. Before award, you must make sure the sub holds a current CMMC status at the level you're flowing down, and the sub keeps a yearly affirmation in SPRS (entered through PIEE, the DoD's procurement portal) for each UID that covers a system handling your CUI (7021).
Whether you also check an older-style score depends on your prime contract. If it still contains DFARS 252.204-7020, paragraph (g) bars you from awarding the subcontract unless the sub has completed at least a Basic NIST SP 800-171 assessment within the last three years (7020). Contracts written since February 1, 2026, under DoD's class deviation 2026-O0025, drop 7020 for 252.240-7997, which covers DoD-run Medium and High assessments and has no pre-award score check (deviation 2026-O0025, Revision 3).
The DFARS 7012 paragraph (m) flowdown also means the sub reports its own cyber incidents to DoD within 72 hours and passes you the incident report number (7012). Put a named contact for that in the subcontract. If all you have is a sales rep's cell number, you'll be hunting for it during an incident.
Download the filled-in assurance decision, and use the security exhibit guide to write whatever you agree into the subcontract.