Guides Supply chain rules

How primes check their suppliers' cybersecurity

How a prime verifies subcontractor cybersecurity: what DFARS 7012 and 7021 flow down, who can see a SPRS score, what to ask for, why a signed record matters.

By Chris Edwards, Edwards Consulting Group · Updated October 22, 2026

A prime cannot look up a subcontractor's SPRS score. SPRS shows a company its own data, and DoD personnel see the rest. So a prime verifies suppliers by flowing the clauses down, asking each supplier for its CMMC status, self-assessment score, affirmation and DFARS 252.204-7012 posture, and keeping a signed record of the answer. DFARS 252.204-7021 and 32 CFR 170.23 require the prime to ensure the right CMMC level before awarding a subcontract.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What does a prime have to flow down?

Four clauses put cybersecurity duties on subcontractors, and each tells the prime to pass it on. The clause texts are in DFARS and FAR cybersecurity clauses, as of 2026.

Clause	Flow down to	What the subcontractor then owes
FAR 52.204-21 (52.240-93 under the FAR overhaul deviations)	Subcontractors that may hold federal contract information	The 15 basic safeguards
DFARS 252.204-7012	Subcontracts for operationally critical support or involving covered defense information, "without alteration"	NIST SP 800-171 Rev 2, 72-hour reporting to DIBNet, a medium assurance certificate, FedRAMP Moderate equivalent cloud
DFARS 252.240-7997	All subcontracts other than COTS	Access for a Medium or High DoD assessment
DFARS 252.204-7021	Subcontracts that process, store or transmit FCI or CUI	A current CMMC status at the level 32 CFR 170.23 sets, and an affirmation before award and annually

7012's (m)(1) also tells the prime to "determine if the information required for subcontractor performance retains its identity as covered defense information", and to consult the contracting officer if needed. The decision about what a supplier will touch is the prime's.

What CMMC level does a subcontractor need?

32 CFR 170.23 says CMMC requirements "apply to prime contractors and subcontractors throughout the supply chain at all tiers" that handle FCI or CUI, and that "Prime contractors shall comply and shall require subcontractors to comply with and to flow down CMMC requirements". The level follows the information:

FCI only: Level 1 (Self).
CUI: Level 2 (Self) at minimum.
CUI, and the prime contract requires Level 2 (C3PAO): Level 2 (C3PAO).
CUI, and the prime contract requires Level 3 (DIBCAC): Level 2 (C3PAO) at minimum.

Since July 13, 2026 only Level 1 (Self) and Level 2 (Self) may be named in new Department of War requirements, so in practice the third and fourth cases are on hold; see CMMC Phase II is suspended: what still applies.

DFARS 252.204-7021 puts two duties on the prime. Under (d)(4) it must "Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation" of compliance at the level required for the subcontract. Under (f)(2), "Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down". The clause says "ensure"; it does not say how, which is why the next question matters.

Can a prime see a subcontractor's SPRS score?

Not in SPRS itself, as far as the public rules go. Three primary sources describe who sees what:

DFARS 252.240-7997, paragraph (f): "Assessment summary level scores posted in SPRS are available to DoD personnel" and are protected under DoD Instruction 5000.79, and "Authorized representatives of the Contractor for which the assessment was conducted may access SPRS to view their own summary level scores". The codified 252.204-7020 and the 252.204-7019 provision said the same.
The SPRS Software User's Guide for Awardees/Contractors, version 4.1.5 (May 2026): "Suppliers/Vendors may view their own company information in SPRS" and "Vendors can view, maintain, download and distribute their own data." The Contractor/Vendor (Support Role) gives "view-only CMMC and NIST SP 800-171 Assessments for the CAGE authorized in PIEE and any CAGE(s) below (subsidiaries)". The SPRS Cyber Vendor User role reaches the CAGE authorized in PIEE "and any additional CAGE(s) that share the same Highest Level Owner (HLO) hierarchy".
The SPRS access page says vendor access is to "access only their own company data".

So a prime's SPRS account shows the prime's own CAGE hierarchy. A supplier outside that hierarchy is not visible. Neither the clause nor the guide describes a prime-to-subcontractor view, and we found no primary source that grants one. What the guide does say is that a vendor may "download and distribute" its own data, which is how a score reaches a prime: the supplier gives it.

Under 32 CFR 170.22, it is "The Department" that "will verify submission of the affirmation in SPRS". A prime's "ensure" duty under 7021 is met by what it obtains from the supplier and records.

What can a prime ask a supplier for?

The clauses name the facts, so a questionnaire can be short and specific:

CMMC status and date. Which level (Level 1 (Self) or Level 2 (Self)), Final or Conditional, and the CMMC status date, since the three-year and 180-day clocks run from it (32 CFR 170.16).
The self-assessment score. The overall Level 2 score out of 110 as entered in SPRS, and whether a POA&M is in use (32 CFR 170.16(a)(1)(i)). How the number is built is in The SPRS score explained.
The affirmation. That an Affirming Official has affirmed in SPRS after the assessment and within the last year (32 CFR 170.22); 7021(d)(4) requires one before subcontract award.
A system security plan. 3.12.4 cannot be on a POA&M (32 CFR 170.21), so its absence means no valid Level 2 status.
7012 readiness. Whether the supplier can discover, report through DIBNet within 72 hours and preserve evidence for 90 days; whether it holds a DoD-approved medium assurance certificate; whether any cloud holding covered defense information meets FedRAMP Moderate or equivalent; and whether it flows 7012 down to its own subcontractors.
Incidents. Whether it has reported a cyber incident affecting covered defense information; 7012(m)(2)(ii) requires a subcontractor to pass the DoD incident report number up to the prime.

Ask for a signature from someone with authority. 32 CFR 170.22 makes the Affirming Official "responsible for ensuring the OSA's compliance"; a supplier answer signed at that level is the nearest thing to the affirmation itself that a prime can hold.

A supplier asked for these can start from For suppliers: the free SPRS score calculator, the 110 requirements with how to meet each, and the guides for its side.

Why a signed attestation and a record matter

7021(f)(2) and 170.23 are written as duties on the prime: "ensure", "shall require subcontractors to comply". The only way to show later that a duty was met is a record of what was asked, what was answered, who signed it and when. Three features make the record useful:

It is signed by the supplier. The supplier's own statement, not the prime's summary of a phone call.
It cannot be edited afterwards. A content hash computed at signing lets a reader check that the document they hold is the one that was signed.
It is dated. The affirmation is annual and the self-assessment is triennial, so the record needs the date to show whether it was current at subcontract award.

A questionnaire answer is the supplier's attestation, not a determination by the Department or by the prime. It does not replace the supplier's SPRS entry; it is the prime's evidence that it checked.

What changed in 2026 for primes

Until the 2026 class deviations, DFARS 252.204-7020(g)(2) said a prime "shall not award a subcontract ... unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171 DoD Assessment". Its replacement, 252.240-7997, keeps the flowdown but not that sentence. The pre-award check now comes from 7021(f)(2) and 170.23 instead, and it is framed as CMMC status rather than a Basic Assessment. The practical check is the same: a current Level 2 (Self) status with a score and affirmation in SPRS.

Where Tiermark fits

Tiermark builds a prime's supplier map from USAspending subawards and SAM.gov registrations and grades each supplier from passive observation of its public DNS, mail authentication, certificates and TLS; the grade is an observation, not a compliance determination. Campaigns send each chosen supplier a DFARS 252.204-7012 baseline questionnaire; answers come back signed, with a SHA-256 content hash, and a supplier can share the same signed answers with other primes that ask. The supplier's record shows what it attested about SPRS, as its own answer, not checked against SPRS. The risk register derives items from the signed answers, and an audit package puts every attestation, the request ledger and the register in one hashed file to hand to a contracting officer.

Sources

Still have a question?

Write to help@tiermark.io and a person will answer.