Aerospace & DefenseFree worksheetPDF, Excel, Word exportDefenseUnited States

DFARS Flowdown Subcontractor Risk Tracker

Primes and sub-tier suppliers are expected to pass cyber duties down the chain. This worksheet keeps one row per subcontractor so you can see who handles controlled information and whom you have not yet checked.

Free, optional. Reopen it on any device.

Download:

Subcontractor	Handles CDI/CUI	7012 flowed down	Assessment evidence received	CUI volume (1 low to 5 high)	Cyber maturity (0 low to 5 high)	Annual spend	Risk score	Spend-weighted risk	Next review
							15	63
							12	10.2
							0	0
							4	12.4
							6	1.44

Total spend tracked

$899,000

Total spend-weighted risk

87.04

Average risk score

7.4

Highest risk score

Average risk score

7.4

Highest risk score

Subcontractors tracked

Flowdown of DFARS 252.204-7012 applies where subcontract performance involves covered defense information, so set Unknown to a decision quickly. Scores are a prioritization aid only. Confirm clause applicability with your contracts team and keep the evidence you receive.

Optional supplier flag setup

We can show how to carry CUI and flowdown flags on the supplier record and purchase order in your ERP.

Optional. The tool and every export work without this. No spam.

Was this tool useful?

How to use it

List each subcontractor, mark whether they handle covered defense information or CUI, and record whether the cyber incident reporting and safeguarding clause was flowed down. Rate CUI volume from one to five and rate the supplier's cyber maturity from zero to five using whatever evidence you have, such as an assessment score, certification or questionnaire. The sheet computes a risk score and a spend-weighted score so you can sort by exposure.

Resolve every Unknown within one review cycle.
Keep the evidence file name or link in your records.
Sort by weighted risk to plan outreach.

The scoring logic

Risk score equals CUI volume times the maturity gap, which is five minus maturity. A supplier that handles heavy CUI with weak controls scores high; one that handles none scores zero regardless of maturity. The spend-weighted figure divides by 100,000 to keep numbers readable and surfaces large vendors with moderate risk. DFARS 252.204-7012 also expects subcontractors to report cyber incidents to the prime and to DoD, so confirm that route is known.

Common mistakes

Teams flow clauses down to every vendor out of caution, then cannot track the volume, or they skip distributors who in fact pass drawings to a third party. Another mistake is accepting a verbal statement of compliance. Request evidence that matches the level required by your contract and review it on a schedule, especially after ownership or IT changes at the supplier.

Frequently Asked Questions

Which clause covers cyber incident reporting?

DFARS 252.204-7012 covers safeguarding covered defense information and cyber incident reporting, and it is flowed down to subcontractors whose performance involves such information. Confirm applicability for each subcontract.

How do I rate cyber maturity?

Use evidence you hold: a posted assessment score, a third-party certification where required, a completed questionnaire or an audit. No evidence means a low rating until proven otherwise.

Does a zero CUI volume mean no action?

You still keep a record of why the clause was not needed and recheck if the scope of work changes, for example if you start sending drawings.

Can I import this into my ERP?

Export to Excel or CSV and load the fields into supplier user-defined fields or a custom table. Mapping depends on your ERP, so test in a non-production environment.

If supplier approval, purchase order clauses and CUI flags are scattered across ERP and email, we can help consolidate them so buyers see flowdown status at order entry.

Talk to an Expert Explore More Free Tools