Flow-Down Clause

A flow-down clause is a contract requirement that obligates the prime contractor to pass certain contract terms — particularly cybersecurity and compliance requirements — down to its subcontractors when those subcontractors will handle the same regulated information.

DFARS 252.204-7012 and the CMMC requirements at DFARS 252.204-7021 are flow-down clauses. If a prime contractor handling CUI awards a subcontract to a smaller firm and CUI flows to that subcontractor, the prime is required to flow down the same NIST SP 800-171 implementation and CMMC certification requirements. The subcontractor is then independently obligated to comply.

Flow-down is the primary reason CMMC requirements are reaching small defense contractors. A 50-person machine shop that has never directly held a DoD contract may suddenly be subject to CMMC Level 2 because a prime is preparing to flow the requirement down on the next subcontract.