CMMC Level 1 for Subcontractors: What Your Prime May Ask For

Subcontractors should start with their actual agreement, not a generic checklist. FAR 52.204-21(c) directs a contractor to include the substance of that clause in covered subcontracts (with the clause's stated COTS exception) when the subcontractor may have FCI residing in or transiting its information system. Separately, a contract or solicitation may specify a CMMC status. The clause flow-down and any CMMC status requirement are related but distinct questions; confirm both against the actual documents.

Prepare a clear, bounded response

Review the contract and prime's written request, then identify which systems handle the relevant FCI and how your boundary is defined. Ask the prime or contracting officer to clarify any unclear data designation, flow-down, required status, due date, or scope. Do not assume that every subcontractor has the same CMMC level or that all company systems belong in the same assessment scope.

Depending on the contract and request, a prime may ask you to confirm or provide information such as:

• The applicable CMMC level/status requirement and the scope you assessed.
• The assessment status date, result, and industry CAGE code(s) associated with the in-scope system.
• Whether the required self-assessment result is in SPRS and the Affirming Official's affirmation has been submitted.
• How your team handles FCI and which systems, people, or external services are included in the agreed boundary.
• Relevant contract flow-down language, points of contact, and evidence that supports your statements.

For Level 1, 32 CFR 170.15 identifies the minimum result information submitted in SPRS, including CMMC Level, CMMC Status Date, assessment scope, associated CAGE codes, and compliance result. 32 CFR 170.22 covers the Affirming Official's separate attestation. Only share material that the contract and recipient require, using an approved channel; do not email passwords or unnecessarily broad system records.

Use CyberSure's free Readiness Check to organize an initial review of the 15 FAR safeguards, and see the Level 1 preparation kit for scoping and documentation materials. Neither tool decides contractual applicability or sends evidence to a prime or SPRS.

Important limits: CyberSure is a private company, not affiliated with or endorsed by DoD/DoW, the U.S. Army, or any government agency. This guide is general information, not legal advice, certification, or an official assessment. Contract and data applicability depend on the specific contract and scope; confirm requirements with your prime or contracting officer.