Subcontractor CUI Obligations on a Civilian Prime Contract

If you are a prime on a civilian agency contract and you are about to hand Controlled Unclassified Information to a subcontractor, the obligations that follow that data come from your contract and your subcontract, not from a government-wide CUI clause. No such clause exists yet. The FAR CUI rule remains a proposed rule, so the flowdown you write this month has to be built from what is actually in force.

That gap is the whole problem. Primes keep reaching for familiar language, usually Department of War language, and end up imposing terms that do not match the civilian contract they are performing.

What Does a Subcontractor Actually Owe When CUI Moves Down the Chain?

Three sources, in this order.

1. 1

   Your prime contract

   Whatever safeguarding, marking, training and incident reporting terms the agency put in your contract are the ceiling and the floor. If the agency incorporated a supplement clause, for example the DHS Homeland Security Acquisition Regulation clause on safeguarding CUI, that clause carries its own flowdown instruction. Read the flowdown paragraph itself rather than assuming.

2. 2

   FAR 52.204-21

   The fifteen basic safeguarding requirements apply to covered contractor information systems that process, store or transmit Federal contract information, and the clause directs flowdown to subcontracts at all tiers where the subcontractor may have FCI on its systems. Most CUI on a civilian contract is also FCI, so in practice this baseline is already running underneath your CUI question.

3. 3

   The subcontract you write

   Everything beyond the two items above is a private contract term. The government has privity with you, not with your sub. If you do not write it down, it does not bind anyone.

Does the Proposed FAR CUI Rule Change What I Put in a Subcontract Today?

Not yet. The FAR Council’s CUI case, FAR Case 2017-016, was published as a proposed rule in January 2024 and has not been finalized. Nothing in it is enforceable against you or your subcontractors right now, and the final text can differ from the proposal.

It is still worth reading, because the proposal sketches the shape of what is likely coming: a standard form identifying the CUI involved in a given contract, a safeguarding clause tied to a NIST standard, a separate clause for identifying and reporting information that may be CUI, a short incident reporting window and training obligations. If you draft subcontract language that can absorb those elements without a renegotiation, you save yourself a modification cycle later.

What you should not do is tell a subcontractor that the FAR CUI rule requires something today. It does not, and a sub who later reads the Federal Register will lose confidence in everything else you told them.

Why Is DoD Flowdown Language the Wrong Template Here?

Because it imports obligations your civilian agency never imposed and your subcontractor cannot meaningfully perform.

DFARS 252.204-7012 is a defense clause. It carries cloud service requirements, a specific cyber incident reporting mechanism to a defense portal, media preservation and malicious software submission duties, all tied to covered defense information. Dropping that clause into a subcontract under a GSA, DHS or HHS prime creates duties pointed at systems and reporting channels that have nothing to do with the contract being performed. When something goes wrong, the sub reports to the wrong place and the agency’s actual reporting window passes.

CMMC is the sharper version of the same error. CMMC is a Department of War program with its own assessment ecosystem. Reporting this week from contracts counsel indicates the phased rollout has been paused while other cybersecurity enforcement continues unchanged. Whatever the rollout schedule ends up being, it does not create a civilian-side certification. There is no equivalent certification a civilian subcontractor can obtain, and asking one to produce a CMMC status for a civilian subcontract is asking for a document that does not apply to the work.

What Did This Week’s ISOO Guidance Change?

New guidance from the Information Security Oversight Office, covered in client alerts this week, directs federal agencies to give contractors specific CUI guidance on contracts that involve CUI access. It is aimed at agencies, not at you, and it does not create a new contractor requirement on its own.

The practical effect is upstream. If your contracting officer has been vague about which CUI categories are in play, this is the moment to ask, in writing, and to ask for the agency’s handling guidance. You cannot flow down a category you were never told about. A request that references the agency’s own obligation to supply CUI guidance tends to get answered faster than a generic question about markings.

How Do I Write a Subcontract CUI Clause That Holds Up?

Keep it specific and keep it sourced.

1. 1

   Name the data

   Identify the CUI categories from the National Archives CUI Registry that will actually reach the sub. If none will, say so and skip the rest.

2. 2

   Point at the prime contract

   Incorporate the agency’s safeguarding clause by reference and attach it. Do not paraphrase it.

3. 3

   State the standard

   If your prime contract requires NIST SP 800-171, say which revision and require the sub to maintain a system security plan and a plan of action covering the systems that touch the data.

4. 4

   Set the reporting clock to yours, minus a margin

   Incident reporting windows vary by agency and some are measured in hours. Your sub needs to notify you fast enough that you can still meet your own deadline.

5. 5

   Handle marking and return

   Say who marks, who decommissions and what happens to the data at closeout.

6. 6

   Reserve the right to update

   Add a clause allowing an equitable adjustment and a modification if the FAR CUI rule is finalized and the agency modifies your prime contract. This is the single most useful sentence you can add right now.

Who Is Liable if the Subcontractor Loses the Data?

You are, to the government. The agency’s remedy runs against the prime, and non-performance by a lower tier is generally not a defense. The subcontract determines whether you can recover from the sub, which is exactly why the indemnity, insurance and cooperation provisions matter as much as the technical ones.

There is a second exposure worth naming plainly. The Department of Justice has pursued cybersecurity misrepresentation under the False Claims Act, including cases involving contractor security representations. If you certified something about your supply chain that your subcontract never actually required, that gap is the risk, not the breach itself.

Frequently Asked Questions

Does the FAR CUI rule require subcontractor flowdown today?

No. FAR Case 2017-016 is a proposed rule and has not been finalized, so it imposes no obligation on primes or subcontractors at present. Subcontractor CUI obligations on a civilian contract currently come from FAR 52.204-21, any agency supplement clause in the prime contract, and the subcontract terms themselves. The proposal is worth tracking, but it is not a present requirement.

Do I need my civilian subcontractor to be CMMC certified?

No. CMMC is a Department of War program and does not apply to civilian agency contracts. There is no civilian-side CUI certification a subcontractor can hold. If your civilian prime contract requires NIST SP 800-171 alignment, require that directly and ask for the system security plan, rather than asking for a certification that does not exist for this work.

Does FAR 52.204-21 flow down to subcontractors?

Yes. The clause directs inclusion in subcontracts at all tiers where the subcontractor may have Federal contract information residing in or transiting through its information system, excluding subcontracts solely for commercially available off-the-shelf items. Because CUI on a civilian contract is usually also FCI, those fifteen basic safeguarding requirements typically already apply below you.

What if my contracting officer never told me which CUI categories apply?

Ask in writing. Agencies are responsible for identifying CUI and providing handling guidance, and recent ISOO guidance directs agencies to give contractors contract-specific CUI guidance. Until you have that answer you cannot accurately scope a subcontract clause, and guessing at categories creates its own problems.

Can I just reuse my DoD subcontract CUI language on a civilian job?

It is a common shortcut and a poor one. DFARS 252.204-7012 points at defense-specific reporting channels, cloud requirements and data handling duties that do not match a civilian agency contract. Reusing it can leave your subcontractor reporting an incident to the wrong place while your actual agency deadline runs out.

If the FAR CUI rule is finalized, what happens to subcontracts I sign now?

Nothing automatic. A final rule would apply through your prime contract, most likely by modification, and you would then need to push corresponding terms down. Including a modification and equitable adjustment provision in today’s subcontracts makes that transition a paperwork exercise instead of a negotiation.