The Flow-Down That May Not Apply
Treeline Machine Works is a 35-person job shop that mills aluminium housings for a Tier 1 prime, Kestrel Systems. The purchase order includes a flow-down clause requiring Treeline to achieve CMMC Level 2 certification within 12 months and to provide a certificate to Kestrel. Treeline's work is build-to-print: it receives PDF drawings and a CAD model, all unmarked, and it ships parts; the only digital link to Kestrel is a supplier portal used to download drawings and upload certificates of conformance. Treeline's IT is a single Microsoft 365 tenant and a shared shop-floor PC. Its owner estimates certification would cost $85,000 plus 300 staff hours - roughly a third of annual profit. Kestrel's buyer says the requirement is corporate policy and refuses to discuss it. Treeline also has two commercial customers with no such requirement, and its SPRS entry, posted two years ago, shows 87.
1. Is CMMC actually required here? Distinguish the regulatory question from the contractual one, and say what Treeline must verify.
Read the worked answer
Separate two questions that the buyer is deliberately blending.
The regulatory question: DFARS 252.204-7021 flows down to subcontracts where the subcontractor will process, store, or transmit CUI, or where performance may involve CUI, and the prime is to require a level commensurate with the CUI involved - which can be lower than the prime's own level. If Treeline genuinely never handles CUI, the regulatory predicate for the flow-down is missing.
The contractual question: a prime can put almost anything it likes into a purchase order as a commercial term. Kestrel's 'corporate policy' line is a contract term, not a DFARS obligation - and Treeline's remedy is negotiation, not a citation.
The critical fact to verify is whether CUI is present. 'Unmarked' proves nothing. Technical data - drawings, CAD models, specifications - is frequently CUI and may separately be export-controlled. Treeline should check: the subcontract's 7012/7021 text; any CUI designation from Kestrel or the underlying DoD programme; the CUI Registry categories covering the data; whether the supplier portal or email ever carries marked files; and whether the shop-floor PC ever received a controlled drawing. Get the answer in writing from Kestrel's contracts or security office, not from the buyer.
2. The buyer refuses to discuss it. What options does Treeline have, and how should it weigh them?
Read the worked answer
Escalate, document, then price or decline.
- Escalate above the buyer to Kestrel's contracts or security leadership. Ask one written question: does this subcontract involve CUI, and if so, which data and what level does Kestrel require? A written answer either removes the requirement or converts a vague demand into a scoped project.
- Offer a proportionate middle path. If CUI is absent or minimal, propose Level 1 (the 17 FAR 52.204-21 practices) with an annual self-assessment and senior affirmation - affordable for a 35-person shop - plus a written undertaking to notify Kestrel if CUI ever arrives. Primes often accept this because it satisfies their supplier-risk process.
- Model the decision honestly. $85,000 plus 300 hours against the margin on Kestrel's work and against the strategic value of the relationship. If Kestrel is 20% of revenue, certification may be a rational market-access investment; if it is 4%, it is not.
- Do not sign an affirmation or produce a certificate you do not hold to keep the order. That converts a commercial dispute into a fraud exposure.
- Decline if the numbers do not work. Two commercial customers remain, and a shop that cannot afford Level 2 is not obligated to buy it for a customer that will not explain why it is needed.
3. The owner asks whether the SPRS score of 87 can substitute for the certificate, or at least buy time. What is the answer?
Read the worked answer
No. The SPRS score and a CMMC certificate are different instruments and are not interchangeable, although both can be required at once.
- SPRS carries a NIST SP 800-171 self-assessment score plus the senior official's affirmation, submitted under DFARS 252.204-7019/7020. It tells a reader how complete the company's 800-171 implementation claims to be. It is not a certification, and nobody audits it before it is posted.
- A CMMC certificate is issued only after a C3PAO assessment against the Level 2 requirements, with a defined scope and a three-year validity. It is what DFARS 252.204-7021 requires when the clause specifies Level 2 certification.
Two cautions for Treeline specifically. First, an 87 posted two years ago is stale for 7019 purposes and would need refreshing with a current affirmation - and any affirmation has to be truthful, so the owner should not update the number reflexively. Second, a prime's supplier portal that collects SPRS scores is not evidence that a certificate exists; Kestrel's clause asks for a certificate, and an 87 does not satisfy it.
The honest framing for the owner: the SPRS score is a disclosure, the certificate is an attestation by an independent third party. Only one of them closes out Kestrel's clause.