The Subcontractor with ISO 27001 and No CMMC
Titan Prime has a CMMC Level 2 certification and a DoD contract. It awards a subcontract to Micro Lens, a 30-person optics supplier that will receive technical drawings containing CUI and will connect to Titan's collaboration portal. Micro Lens is not CMMC certified but holds ISO 27001 certification and says its controls are 'equivalent.' Micro Lens will store the drawings on its own server and email them internally. Titan's contracts manager wants to skip flow-down because Micro Lens is small and the subcontracted value is only $450,000. Titan's security lead warns that the prime's certification could be at risk. The subcontract award is in 10 days, and Micro Lens says it cannot complete a CMMC assessment for at least 12 months. Titan asks you how to proceed.
1. Does Titan need to flow down CMMC requirements to Micro Lens? Explain the reasoning.
Read the worked answer
Yes, if Micro Lens will store, process, or transmit CUI, Titan must flow down the applicable CMMC requirements. The prime's Level 2 certification depends on protecting CUI across its entire contract performance, including subcontractors. A $450,000 value and 30 employees do not create an exemption. If Micro Lens receives technical drawings containing CUI and emails them internally, it is handling CUI on its own server, so flow-down is required. Titan should not treat ISO 27001 as a substitute. ISO 27001 certifies a management system, not implementation of the 110 CMMC Level 2 practices, and it is not a C3PAO assessment. It may provide some evidence, but it does not satisfy the flow-down. Titan needs a clause requiring compliance, a right to verify, incident notification, and data handling rules.
2. Evaluate Micro Lens's ISO 27001 certification as a substitute for CMMC Level 2. What evidence would you require?
Read the worked answer
ISO 27001 is useful but not equivalent. It can show that Micro Lens has a risk process, documented policies, and internal audit, which may reduce due diligence effort. It does not show that the specific CMMC practices are implemented, nor does it test the CUI boundary. Titan should require a gap assessment against the Level 2 practices, evidence for the controls that apply to the subcontracted CUI, and a credible plan. If Micro Lens cannot meet the requirements for 12 months, Titan should restructure the work so Micro Lens never stores or processes CUI. For example, Titan can provide a controlled viewer, prohibit local storage and email of drawings, and require work in Titan's enclave. That may limit the flow-down scope, but it must be real, not paper-only.
3. Recommend options and contract actions for Titan with only 10 days before award.
Read the worked answer
With 10 days to award, Titan has three defensible options. First, restructure: no CUI at Micro Lens, using Titan's controlled environment and contractual data-handling restrictions. Second, delay or split the award until Micro Lens can meet the requirements; 12 months may be acceptable only if no CUI is involved before certification. Third, choose another subcontractor. If Titan proceeds with CUI at Micro Lens, the contract should include the CMMC flow-down, a requirement to complete a gap assessment and POA&M, audit and evidence rights, incident notification, flow-down to lower tiers, and termination for noncompliance. Titan's security lead should document the risk decision; the contracts manager cannot simply skip flow-down because the subcontract is small. Titan should not represent Micro Lens as compliant before evidence exists.