What to show a contracting officer about your suppliers' cybersecurity

The clauses give DoD specific rights: access to your systems and people for a Medium or High NIST SP 800-171 assessment, access to information and equipment for forensic analysis after an incident, and a duty on you to flow each clause down and to "ensure" a subcontractor's CMMC status before award. What shows you met those duties is a dated record: the clauses as inserted in each subcontract, each supplier's signed statement of its status and SPRS posting, a risk register with its history, and a timeline of what you asked, when, and what came back. No rule names a format, and no package is pre-approved by anyone.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What can DoD ask for or see?

Only what the clause texts say. Four of them matter here; the texts are in DFARS and FAR cybersecurity clauses, as of 2026.

• DFARS 252.240-7997 (c), from Class Deviation 2026-O0025: "The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, using the methodology described at 32 CFR 170.24, if necessary." Both are "conducted by Government personnel" (paragraph (a)), and when conducted by DCMA their results "will take precedence over any other assessment". Under (d), summary level scores are posted in SPRS; under (f)(1) they "are available to DoD personnel". Under (g) you insert "the substance of this clause" in all subcontracts other than COTS.
• DFARS 252.204-7012 (f): "Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis." Under (g), if DoD elects to conduct a damage assessment the contracting officer will request the damage assessment information. Under (e), after an incident you preserve images and monitoring data "for at least 90 days from the submission of the cyber incident report". Under (m)(1) you include the clause in covered subcontracts "without alteration, except to identify the parties", and under (m)(2)(ii) a subcontractor gives you the DoD incident report number "as soon as practicable".
• DFARS 252.204-7021 (d)(4): "Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation" of compliance at the level required for the subcontract. Under (f)(1) you insert the substance of the clause in subcontracts that will hold FCI or CUI, and under (f)(2), before award, "ensure that the subcontractor has a current CMMC certificate or current CMMC status" at the level 32 CFR 170.23 sets.
• 32 CFR 170.23(a): "Prime contractors shall comply and shall require subcontractors to comply with and to flow down CMMC requirements". Under 170.22(b), "The Department will verify submission of the affirmation in SPRS"; the verification of what a supplier posted is the Department's, from SPRS, not yours.

Two things the texts do not give. They do not let a prime see a subcontractor's score or affirmation in SPRS; see How primes check their suppliers' cybersecurity. And they do not say what a prime must keep to show it ensured anything. That is why the records below are a matter of judgement, and why dates matter more than volume.

What records show supplier cybersecurity oversight?

1. The flowdown itself. Each subcontract with the clauses in it: 7012 "without alteration", the substance of 7997 and 7021, and FAR 52.204-21 (52.240-93 under the FAR overhaul deviations) where the subcontractor holds federal contract information. Keep the clause pages, not a checklist saying they are there.
2. Your determination under 7012(m)(1) of whether the information a subcontractor will handle "retains its identity as covered defense information", and any consultation with the contracting officer about it.
3. The supplier's affirmation and status, as the supplier reported them. The CMMC level, Conditional or Final, the status date, the date of the latest affirmation and the SPRS posting date. Record these as the supplier's statements with the date you received them, because that is what they are.
4. Signed attestations. The supplier's answers over a named person's signature, dated, with a content hash so the copy you hold can be shown to be the one signed; what to ask is in A DFARS 7012 supplier questionnaire.
5. The risk register and its history. Each item with its source, owner, status and clock dates, and the dated history of changes, so a reader can see that a finding was acted on and when. Running one is covered in Running a supplier cyber risk register.
6. Incident records. For any incident a subcontractor reported, the DoD incident report number it passed up under (m)(2)(ii) and the date you received it.
7. A dated timeline. Award dates against the dates you asked and the dates suppliers answered. The 7021 duties are pre-award and annual; a record that cannot show which came first does not show the duty was met.

A timeline a reader can follow

What is in an audit package

An audit package is Tiermark's way of handing over items 4, 5 and 7 as one file, and items 3 and 6 as far as the signed answers carry them. It is one zip, built from the account as it stands, and held in storage that cannot be changed or deleted, so the copy handed over and the copy Tiermark holds are the same bytes. It contains:

A supplier's folder is named by its UEI, or by its Tiermark id when it has none. The attestations are every signed answer set the prime may read, including ones a supplier answered by sharing a signature it gave another customer. A package can cover all campaigns or one; the register is always the whole register. Not in it: controlled unclassified information, any signer's IP address, any email address (the ledger carries the contact's domain only), any token or code. Each supplier is told that its answers were "Copied into an audit package" by your organization, so the package is not a quiet copy.

What a package does not prove

• It does not prove a supplier's score, status or affirmation. Those live in SPRS, where DoD verifies them and you cannot. The package proves what the supplier told you, who signed it, and when.
• It does not prove the clauses were in the subcontract. The subcontract does. Keep both.
• It is not accepted or endorsed by DCMA, any contracting officer or anyone else. There is no rule under which a package of any format discharges the "ensure" duty. What a reader gets is a record whose dates and signatures can be checked; whether that is enough is the reader's judgement under the contract.

Where Tiermark fits

Tiermark's audit packages are built on the Audit screen by an admin or contracts manager on a paid prime plan, for all campaigns or one, up to 500 signed attestations per package. The attestations come from the attestation ledger, where every request's sent, opened and responded dates are recorded and every read of a supplier's answers is logged on the supplier's side. Downloads use a fifteen-minute link and are recorded, and before a link is made the stored file is checked against the hash recorded at build time.

Sources

• DPCAP class deviations: 252.240-7997 in Class Deviation 2026-O0025
• DFARS 252.204-7012 (MAY 2024)
• DFARS 252.204-7021 (NOV 2025)
• FAR 52.204-21
• 32 CFR 170.22 and 170.23