Ask what information will flow to your company, which contractual CMMC requirement applies, and which systems will handle the work. Being a small subcontractor does not answer those questions by itself.
1. What requirement is included in the subcontract?
Request the relevant clause and the required assessment level or path in writing. Distinguish a prime contractor's supplier questionnaire from the obligations in the actual subcontract. If the language is unclear, obtain clarification through the appropriate contract channel before committing to an unsupported compliance statement.
2. What information will we receive or create?
Discuss deliverables, working files, instructions, and customer exchanges. Ask the information owner to resolve classification questions. Your company’s role in the supply chain does not, on its own, determine whether the workflow concerns public information, FCI, or CUI.
3. Which systems and service providers support the work?
Trace email, shared storage, endpoints, remote access, and outside support. Confirm that the proposed technical workflow matches the boundary used for assessment. If an employee plans to use a different application for the new subcontract, identify that change before the information arrives.
4. What must be current before award and during performance?
DFARS 252.204-7021 addresses required CMMC status, affirmations, and subcontract flowdown. Determine the applicable obligation from your contract and the current rule. Do not substitute a generic readiness letter or an invoice for the specific status or record the requirement calls for.
5. What proof is requested, and how will we share it?
Agree on the purpose and minimum information needed. Differentiate a status confirmation from a request for detailed technical artifacts. Use an approved channel and the right access restrictions before sharing architecture, configurations, or sensitive contract material. A supplier-onboarding request is not automatic permission to disclose every internal record.
6. How will our own subcontractors be handled?
Identify any downstream party that will handle the relevant information. Confirm applicable flowdown and status obligations before assigning the work. Include the procurement owner and the person managing technical access so the contractual and operational plans stay aligned.
7. Who owns changes after onboarding?
Assign responsibility for system changes, new information flows, new subcontractors, ongoing status, and required affirmations. Establish a contact path with the prime contractor for questions. A successful onboarding review is the start of a maintained relationship, not a reason to stop reviewing the environment.
Create a one-page subcontract readiness brief
Record the clause, required level, information categories, system boundary, open questions, accountable owners, requested proof, and key dates. Mark each question resolved only when you have a reliable answer. This brief gives procurement, IT, and leadership a common starting point.
Bring a sanitized version of the brief to Federal Bid Partners (FBP) when discussing readiness support. Explore CMMC Pulsar for organizing the resulting work. Keep the contract interpretation, implementation decisions, and authorized company statements accountable to the people responsible for them.
Common questions
Do small subcontractors automatically qualify for Level 1?
No. Confirm the information and the requirement in the subcontract; company size alone does not decide the level.
Does a readiness letter replace required CMMC status?
No. Match the evidence you provide to the specific contractual requirement and verify the relevant system-of-record information.
Sources and further reading
Check the current source, applicable contract, and official process before relying on a requirement. Suggested workflows are practical working methods and do not replace official instructions.