# Defense Subcontractor Flow-Down Tracker Worksheet > Source: https://netray.co/tools/defense-subcontractor-flowdown-tracker-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A supplier-by-supplier register of flowed-down clauses, CUI access, certification status and acknowledgement dates. ## Category compliance-legal ## Industry Defense Contracting ## Region United States ## Audience - Procurement manager - Compliance manager - Supplier quality ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Subcontractor **Key:** supplier **Type:** text #### PO or subcontract **Key:** po **Type:** text #### Handles CUI **Key:** cui **Type:** select **Options:** - Yes - No - Unknown #### DFARS 7012 flowed **Key:** d7012 **Type:** select **Options:** - Yes - No - N/A #### Export clause flowed **Key:** export **Type:** select **Options:** - Yes - No - N/A #### Required CMMC level **Key:** level **Type:** select **Options:** - None - Level 1 - Level 2 - Level 3 #### Supplier status **Key:** status **Type:** select **Options:** - Not assessed - Self-assessed - Certified - Overdue #### Acknowledged on **Key:** signed **Type:** date #### PO value **Key:** po_value **Type:** number **Format:** currency #### Risk weight (0-3) **Key:** risk_weight **Type:** number **Format:** integer #### Weighted exposure **Key:** exposure **Type:** number **Expr:** po_value * risk_weight / 3 **Format:** currency **Rows:** **Supplier:** Midwest Plating Co. **Po:** PO-30112 **Cui:** No **D7012:** N/A **Export:** Yes **Level:** Level 1 **Status:** Self-assessed **Signed:** 2026-08-14 **Po value:** 48000 **Risk weight:** 1 **Supplier:** Lone Star Machining **Po:** PO-30145 **Cui:** Yes **D7012:** Yes **Export:** Yes **Level:** Level 2 **Status:** Not assessed **Signed:** 2026-09-02 **Po value:** 215000 **Risk weight:** 3 **Supplier:** Northern Cable Works **Po:** PO-30160 **Cui:** Yes **D7012:** No **Export:** Yes **Level:** Level 2 **Status:** Overdue **Po value:** 132000 **Risk weight:** 3 **Supplier:** Packaging Partners **Po:** PO-30171 **Cui:** No **D7012:** N/A **Export:** N/A **Level:** None **Status:** Not assessed **Signed:** 2026-07-10 **Po value:** 9000 **Risk weight:** 0 **Totals:** #### Total subcontract value **Key:** po_value **Agg:** sum **Format:** currency #### Total weighted exposure **Key:** exposure **Agg:** sum **Format:** currency #### Subcontractors tracked **Key:** supplier **Agg:** count **Format:** integer **Summary:** #### Exposure as percent of spend **Key:** exposure_pct **Expr:** sum_exposure / sum_po_value * 100 **Format:** percent **Notes:** Clause flow-down requirements depend on your prime contract, so confirm what applies. DFARS 252.204-7012 must generally be included in subcontracts for operationally critical support or involving covered defense information, and subcontractors must report incidents. Required CMMC levels depend on the data the subcontractor handles and on program rules. Not legal advice. ## Content **Intro:** Your prime contract usually obliges you to push cybersecurity and export clauses down to subcontractors that touch CUI. This worksheet shows at a glance who has received what, who has acknowledged, and where risk is concentrated. **Sections:** #### How to use the tracker **Body:** Add one row per subcontract that could involve CUI or controlled technical data. Mark whether CUI is handled, which clauses were flowed, the CMMC level you require and the supplier's current status. Record the date the supplier acknowledged the terms. Sort by weighted exposure to decide which suppliers to chase first, then export to Excel for the compliance review. **Bullets:** - Start with suppliers that receive drawings - Do not leave CUI as Unknown for long - Chase acknowledgement dates - Review quarterly with procurement #### Why exposure weighting **Body:** A risk weight from 0 to 3 captures how sensitive the data is, with 3 meaning controlled technical data in volume. Multiplying the order value by weight over three gives a comparable exposure number. It is a prioritization aid, not a risk model, so use your own judgment to override it. #### What to flow down **Body:** Common flow-downs include DFARS 252.204-7012 for covered defense information, related assessment and CMMC clauses as they apply to the contract, and ITAR and EAR terms for exported data. Include incident reporting expectations, the right to review evidence and a requirement to flow terms to lower tiers. #### Common mistakes **Body:** Sending the same blanket terms to every supplier, ignoring lower-tier suppliers, and treating a signed purchase order as proof that the supplier is actually compliant. Verify, do not just collect signatures. **Cta:** If your supplier master lives in an ERP, Netray can discuss feeding this tracker from vendor and purchase order data, on-prem. The worksheet is free regardless. **Faq:** #### Which clauses must I flow down? **Answer:** It depends on your prime contract. DFARS 252.204-7012 generally flows to subcontracts involving covered defense information or operationally critical support. Read the flow-down paragraphs in your prime and have counsel confirm the list for each subcontract. #### Do I need to verify supplier compliance? **Answer:** You are responsible for what you flow down and for not sharing CUI with a supplier who cannot protect it. Practices vary from questionnaires to evidence review. At minimum, record the supplier's status and the date of your last check. #### What about lower-tier suppliers? **Answer:** Your flow-down should require subcontractors to push the same clauses to their own suppliers that handle covered information. Ask for a list of those lower-tier suppliers during onboarding and track them here. #### Can I use this for non-defense work? **Answer:** Yes. The structure works for any set of contract clauses that must be pushed down, such as quality or customer-specific cybersecurity terms. Change the dropdown values to match your terms. ## Search terms dfars flow down tracker, subcontractor flowdown clauses excel, dfars 7012 flowdown checklist subcontractor, cmmc subcontractor tracking spreadsheet, defense supplier compliance tracker, flow down clause matrix --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json