Defense Subcontractor Flow-Down Tracker Worksheet
Your prime contract usually obliges you to push cybersecurity and export clauses down to subcontractors that touch CUI. This worksheet shows at a glance who has received what, who has acknowledged, and where risk is concentrated.
| Subcontractor | PO or subcontract | Handles CUI | DFARS 7012 flowed | Export clause flowed | Required CMMC level | Supplier status | Acknowledged on | PO value | Risk weight (0-3) | Weighted exposure | |
|---|---|---|---|---|---|---|---|---|---|---|---|
$16,000 | |||||||||||
$215,000 | |||||||||||
$132,000 | |||||||||||
$0 |
Clause flow-down requirements depend on your prime contract, so confirm what applies. DFARS 252.204-7012 must generally be included in subcontracts for operationally critical support or involving covered defense information, and subcontractors must report incidents. Required CMMC levels depend on the data the subcontractor handles and on program rules. Not legal advice.
Feed compliance tracking from ERP vendor data
Optional discussion of linking supplier master and PO data to flow-down status.
Optional. The tool and every export work without this. No spam.
How to use the tracker
Add one row per subcontract that could involve CUI or controlled technical data. Mark whether CUI is handled, which clauses were flowed, the CMMC level you require and the supplier's current status. Record the date the supplier acknowledged the terms. Sort by weighted exposure to decide which suppliers to chase first, then export to Excel for the compliance review.
- Start with suppliers that receive drawings
- Do not leave CUI as Unknown for long
- Chase acknowledgement dates
- Review quarterly with procurement
Why exposure weighting
A risk weight from 0 to 3 captures how sensitive the data is, with 3 meaning controlled technical data in volume. Multiplying the order value by weight over three gives a comparable exposure number. It is a prioritization aid, not a risk model, so use your own judgment to override it.
What to flow down
Common flow-downs include DFARS 252.204-7012 for covered defense information, related assessment and CMMC clauses as they apply to the contract, and ITAR and EAR terms for exported data. Include incident reporting expectations, the right to review evidence and a requirement to flow terms to lower tiers.
Common mistakes
Sending the same blanket terms to every supplier, ignoring lower-tier suppliers, and treating a signed purchase order as proof that the supplier is actually compliant. Verify, do not just collect signatures.
Frequently Asked Questions
Which clauses must I flow down?
It depends on your prime contract. DFARS 252.204-7012 generally flows to subcontracts involving covered defense information or operationally critical support. Read the flow-down paragraphs in your prime and have counsel confirm the list for each subcontract.
Do I need to verify supplier compliance?
You are responsible for what you flow down and for not sharing CUI with a supplier who cannot protect it. Practices vary from questionnaires to evidence review. At minimum, record the supplier's status and the date of your last check.
What about lower-tier suppliers?
Your flow-down should require subcontractors to push the same clauses to their own suppliers that handle covered information. Ask for a list of those lower-tier suppliers during onboarding and track them here.
Can I use this for non-defense work?
Yes. The structure works for any set of contract clauses that must be pushed down, such as quality or customer-specific cybersecurity terms. Change the dropdown values to match your terms.
If your supplier master lives in an ERP, Netray can discuss feeding this tracker from vendor and purchase order data, on-prem. The worksheet is free regardless.
Related Tools
NIST SP 800-171 System Security Plan (SSP) Template
A fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine.
Compliance & ContractsCMMC POA&M (Plan of Action and Milestones) Worksheet
An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
Compliance & ContractsDFARS 252.204-7012 Cyber Incident Report Template
An internal worksheet document that gathers the facts needed to file a cyber incident report on a covered defense information system within the required window.
Aerospace & DefenseAerospace Supplier Scorecard
Rate a supplier across 10 criteria - OTD, quality escapes, AS9100 status, FAI performance, CAPA responsiveness, compliance flowdown, and financial health - for an instant risk rating.
More Compliance & Contracts tools
See all- EAR ECCN Self-Classification Worksheet
- Technology Control Plan (TCP) Template
- Export License Tracking Worksheet
- DFARS 252.204-7012 Cyber Incident Report Template
- ITAR USML Categories Reference Table
- Foreign Person Visitor Access Request Template
- ITAR Technical Data Transfer Log Worksheet
- Export Classification Matrix Worksheet (USML and ECCN)
- End-Use and End-User Statement Template