When you're the prime: flowing FAR 52.204-21 down to your subcontractors

Most CMMC content assumes you're the subcontractor - that the requirement reaches you as a flow-down from some prime up the chain. But if you hold the contract directly with the government and you sub work out to other companies, the arrow points the other way. Now you're the prime, and one piece of the clause becomes your job to pass along. It's not a security control and it's not scored on your self-assessment. It's a contract-administration duty, and it's easy to miss precisely because it doesn't look like the other 15 things.

Who this is for

You hold a DoD contract directly - the government is your customer, not a prime above you - and some portion of the work goes to outside companies: a finishing shop, a specialty fabricator, an installer, a testing lab. If that describes you, paragraph (c) of the clause is yours to deal with. If you only ever work as a subcontractor, this guide isn't your problem - your prime handles the flow-down to you, and you can stop here.

What paragraph (c) actually says

The clause is FAR 52.204-21, and paragraph (c) - the subcontracts paragraph - reads, in substance:

The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

Read it twice, because there are three moving parts: you include the substance of the clause (not necessarily a verbatim copy), you include paragraph (c) itself (so the duty keeps flowing down the chain), and it only applies where the subcontractor may have FCI on its systems. That last part is the test that decides whether the duty attaches at all.

The test: does the sub receive government-provided information on their systems?

The flow-down isn't automatic on every subcontract. It attaches when the subcontractor may have FCI residing in or transiting through its information system. So the practical question for each sub relationship is simple: are you sending them government-provided information - drawings, specifications, scopes of work, site details, schedules - that will land on their computers, email, or phones?

Consider Acme Precision Machining, holding a build-to-print contract directly with the government. Acme sends its customer's controlled drawings to an outside heat-treat shop so the parts can be finished. Those drawings are FCI, and they're now sitting in the heat-treat shop's email and job system. The flow-down attaches. But when Acme buys standard cutting fluid from a distributor, no government information goes anywhere near the distributor's systems - no flow-down. The test is the information, not the dollar value or the formality of the relationship.

The COTS carve-out

There's one clean exception written into the clause: commercially available off-the-shelf (COTS) items. A subcontract that's purely for COTS - standard tooling, off-the-shelf hardware, catalog supplies - is carved out, even though the clause otherwise reaches commercial products and services. The logic is sensible: a company selling you the same drill bits it sells everyone isn't handling your government job information. If a subcontract is COTS-only, you don't flow the clause down to it. If it's anything more - custom work where your government-provided information goes to the sub - the carve-out doesn't apply.

What "include the substance" means in practice

You don't need a lawyer to draft something exotic. "Include the substance" means your subcontract obligates the sub to the same basic safeguarding the clause obligates you to, and it passes paragraph (c) along so the sub does the same with their subs. In practice, three steps:

• Identify the relationships. List which subcontractors receive government-provided information on their systems. That list is usually short, and it's the whole scope of the duty.
• Get the language into your template. Add the substance of FAR 52.204-21, including paragraph (c), to your standard subcontract terms so it's there by default going forward, rather than something you remember to bolt on.
• Have counsel look once. A single review of the subcontract language before it goes into circulation is cheap insurance. This is contract paperwork, so it's a contracts question, not an IT one.

What you are - and aren't - responsible for

This is the part that causes the most worry, usually more than it should. Your duty is to include the clause substance in the qualifying subcontracts. You are not required to audit your sub's network, run their self-assessment for them, or certify their posture to the government. The clause makes safeguarding the sub's own obligation once it's flowed down; you're passing the requirement along, not guaranteeing their compliance.

That said, there's a practical middle ground worth knowing. Because you carry the contract, a sub who mishandles FCI on a job you flowed the clause into is a problem that can land back on you commercially - so the sensible primes don't just paste the clause and forget it. They keep the flow-down in the subcontract and confirm their key subs can at least articulate how they handle FCI. That's judgment, not a regulatory line, but it's the difference between checking a box and actually managing the risk.

The evidence: your executed subcontracts

Like everything at Level 1, the flow-down is only as good as what you can show. The artifact here isn't a screenshot - it's the paperwork. Keep the executed subcontracts that carry the clause substance, or keep your subcontract template plus a list of which agreements use it. Whoever holds your contracts owns this record. It sits alongside your other Level 1 evidence, but note it's a contract-administration record, not one of the 15 scored requirements - it doesn't add a sixteenth row to your scorecard.

When a sub says they can't comply

Sometimes you flow the clause down and a subcontractor pushes back - they don't have individual logins, they've never heard of FCI, they don't want the hassle. A few honest options: help them get there (the safeguarding requirements are basic and mostly free - point them at the 15 requirements and the common gaps), restructure the work so the sub never receives government-provided information on their systems (which removes the trigger entirely), or find a different sub. What you can't do is quietly drop the flow-down because it's inconvenient - the duty is in your prime contract, and skipping it is your exposure, not theirs.

If part of your own setup runs through an outside IT provider, it's worth knowing what they can and can't own here too - an MSP can't write clause language into your subcontracts, because that's your contract paperwork, not their console.