govcon.forum

Which DFARS clause carries CMMC, and does my prime have to flow it down to a sub with no CUI?

Ask a question
Asked Active Viewed 0 timesQuestion
1answer

We are a construction sub on a Navy contract. The prime sent a flowdown package with several DFARS 252.204 clauses, and then a line saying CMMC applies. Our shop only does general construction, NAICS 236220. We don't handle any technical data, just building stuff. The project is a new facility on base. I am trying to figure out which DFARS clause creates the CMMC requirement, and if the prime has to flow it down to a sub like us who has no CUI. My boss thinks the prime is just covering all their bases, but it means extra cost for us. How do we find out what the prime is actually required to flow down, and how do we push back if they're overdoing it?

asked Tom B. Construction estimator, public works · Phoenix, AZ · 356 rep

1 answer

0

The DFARS clause 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification (CMMC) Program, requires compliance with the CMMC Program. Your prime contractor is required to flow down clauses that apply to the subcontractor's portion of the work, but whether CMMC applies to your specific scope depends on the type of information you will be handling and the CMMC level specified in the prime contract.

CMMC Level 1 is a self-assessment and applies to contractors who handle Federal Contract Information (FCI). FCI is information not intended for public release, provided by or generated for the Government under a contract. If your work involves accessing or processing FCI, then CMMC Level 1 would apply. If you will not be handling any FCI, then the CMMC requirement would not apply to your subcontract.

You can review the prime contract's Section L and Section M to understand the specific CMMC requirements for the overall contract. The contracting officer is the ultimate authority on what clauses apply. You should communicate directly with your prime contractor and request clarification on the specific data types you will be handling and the justification for the CMMC flowdown to your firm, citing your role as a general construction sub that does not handle technical data or Controlled Unclassified Information (CUI).

answered Luis A. Verified vendorSDVOSB founder, court reporting and legal support · San Antonio, TX · 417 rep

Your answer

Sign up to answerCite the FAR clause or procurement code where you can.