# DFARS Flowdown Subcontractor Risk Tracker

> Source: https://netray.co/tools/dfars-flowdown-subcontractor-risk-tracker
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

An editable worksheet that records CUI exposure, flowdown status and cyber maturity per subcontractor and scores risk so you know whom to chase first.

## Category

aerospace-defense

## Industry

Defense

## Region

United States

## Audience

- Supplier quality
- Contracts manager
- Buyer
- Compliance officer

## Tool

**Kind:** worksheet

**Mode:** editable

**Currency:** $

**Columns:**

#### Subcontractor

**Key:** sub

**Type:** text

#### Handles CDI/CUI

**Key:** cui

**Type:** select

**Options:**

- Yes
- No
- Unknown

#### 7012 flowed down

**Key:** flow

**Type:** select

**Options:**

- Yes
- No
- Not required

#### Assessment evidence received

**Key:** sprs

**Type:** select

**Options:**

- Yes
- Pending
- No

#### CUI volume (1 low to 5 high)

**Key:** volume

**Type:** number

#### Cyber maturity (0 low to 5 high)

**Key:** maturity

**Type:** number

#### Annual spend

**Key:** spend

**Type:** number

**Format:** currency

#### Risk score

**Key:** risk

**Type:** number

**Expr:** volume * (5 - maturity)

**Format:** integer

**Help:** Volume times the maturity gap. Range 0 to 25.

#### Spend-weighted risk

**Key:** weighted

**Type:** number

**Expr:** volume * (5 - maturity) * spend / 100000

**Format:** number

#### Next review

**Key:** review

**Type:** date

**Rows:**

**Sub:** Precision Machining Co

**Cui:** Yes

**Flow:** Yes

**Sprs:** Pending

**Volume:** 5

**Maturity:** 2

**Spend:** 420000

**Review:** 2026-12-01

**Sub:** Anodize and Finish LLC

**Cui:** Yes

**Flow:** No

**Sprs:** No

**Volume:** 3

**Maturity:** 1

**Spend:** 85000

**Review:** 2026-11-15

**Sub:** Fastener Distributor Inc

**Cui:** No

**Flow:** Not required

**Sprs:** No

**Volume:** 0

**Maturity:** 3

**Spend:** 60000

**Review:** 2027-03-01

**Sub:** PCB Assembly Partner

**Cui:** Yes

**Flow:** Yes

**Sprs:** Yes

**Volume:** 4

**Maturity:** 4

**Spend:** 310000

**Review:** 2027-01-10

**Sub:** Calibration Lab

**Cui:** Unknown

**Flow:** No

**Sprs:** No

**Volume:** 2

**Maturity:** 2

**Spend:** 24000

**Review:** 2026-11-30

**Totals:**

#### Total spend tracked

**Key:** spend

**Agg:** sum

**Format:** currency

#### Total spend-weighted risk

**Key:** weighted

**Agg:** sum

**Format:** number

#### Average risk score

**Key:** risk

**Agg:** avg

**Format:** decimal

#### Highest risk score

**Key:** risk

**Agg:** max

**Format:** integer

**Summary:**

#### Average risk score

**Key:** avg_score

**Expr:** avg_risk

**Format:** decimal

#### Highest risk score

**Key:** top_score

**Expr:** max_risk

**Format:** integer

#### Subcontractors tracked

**Key:** subs

**Expr:** count

**Format:** integer

**Notes:** Flowdown of DFARS 252.204-7012 applies where subcontract performance involves covered defense information, so set Unknown to a decision quickly. Scores are a prioritization aid only. Confirm clause applicability with your contracts team and keep the evidence you receive.

## Content

**Intro:** Primes and sub-tier suppliers are expected to pass cyber duties down the chain. This worksheet keeps one row per subcontractor so you can see who handles controlled information and whom you have not yet checked.

**Sections:**

#### How to use it

**Body:** List each subcontractor, mark whether they handle covered defense information or CUI, and record whether the cyber incident reporting and safeguarding clause was flowed down. Rate CUI volume from one to five and rate the supplier's cyber maturity from zero to five using whatever evidence you have, such as an assessment score, certification or questionnaire. The sheet computes a risk score and a spend-weighted score so you can sort by exposure.

**Bullets:**

- Resolve every Unknown within one review cycle.
- Keep the evidence file name or link in your records.
- Sort by weighted risk to plan outreach.

#### The scoring logic

**Body:** Risk score equals CUI volume times the maturity gap, which is five minus maturity. A supplier that handles heavy CUI with weak controls scores high; one that handles none scores zero regardless of maturity. The spend-weighted figure divides by 100,000 to keep numbers readable and surfaces large vendors with moderate risk. DFARS 252.204-7012 also expects subcontractors to report cyber incidents to the prime and to DoD, so confirm that route is known.

#### Common mistakes

**Body:** Teams flow clauses down to every vendor out of caution, then cannot track the volume, or they skip distributors who in fact pass drawings to a third party. Another mistake is accepting a verbal statement of compliance. Request evidence that matches the level required by your contract and review it on a schedule, especially after ownership or IT changes at the supplier.

**Cta:** If supplier approval, purchase order clauses and CUI flags are scattered across ERP and email, we can help consolidate them so buyers see flowdown status at order entry.

**Faq:**

#### Which clause covers cyber incident reporting?

**Answer:** DFARS 252.204-7012 covers safeguarding covered defense information and cyber incident reporting, and it is flowed down to subcontractors whose performance involves such information. Confirm applicability for each subcontract.

#### How do I rate cyber maturity?

**Answer:** Use evidence you hold: a posted assessment score, a third-party certification where required, a completed questionnaire or an audit. No evidence means a low rating until proven otherwise.

#### Does a zero CUI volume mean no action?

**Answer:** You still keep a record of why the clause was not needed and recheck if the scope of work changes, for example if you start sending drawings.

#### Can I import this into my ERP?

**Answer:** Export to Excel or CSV and load the fields into supplier user-defined fields or a custom table. Mapping depends on your ERP, so test in a non-production environment.

## Search terms

dfars flowdown tracker, subcontractor cybersecurity tracker, dfars 252.204-7012 flowdown, supplier cmmc tracking, flowdown clause checklist excel, supply chain cui tracking, subcontractor risk register, defense supplier compliance tracker

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json