Solutions · CMMC compliance

Subcontractor CMMC compliance for construction: every vendor’s CMMC status in hand before award.

Ask every vendor on a DoD job for its CMMC status from SPRS and its annual affirmation, with the rest of its documents. Your team approves each one before award, and every decision is on the record.

SOC 2 Type IIU.S. hostedAI optional
In one paragraph

Subcontractor CMMC compliance means every vendor that will handle federal contract information or controlled unclassified information on a DoD job has the CMMC status its subcontract requires before award, and keeps its affirmation current every year. Primes can’t see a vendor’s record in SPRS, so DoD tells them to ask for it. Contracts Connected collects that printout and the affirmation with the rest of each vendor’s documents, and your team approves or rejects them. It doesn’t assess anyone’s controls.

Where CMMC stands, October 2026

DoD suspended Phase 2 on July 13, 2026. Phase 1 continues: contracts can require Level 1 (Self) or Level 2 (Self), and primes still flow the requirement down and confirm each vendor’s status before award.

01Set up

Choose the CMMC documents once.

Pick what you ask vendors for on DoD jobs, like the CMMC status printout from SPRS and the annual affirmation, and when: before award, with the rest of their onboarding documents.

Subcontractor compliance software
02Collected

Asked for until it’s in.

Each vendor gets the request on its own link, next to its COI and W-9. The Monday and Wednesday reminders keep asking until it’s in, so nobody chases screenshots by email.

Compliance tracking
03Reviewed

Approve it, or send it back with the reason.

Your team checks the level, the status date and the CAGE code against the subcontract. To reject one, you write the reason: the rejected copy stays on the record, and the vendor gets your reason to fix it and send it again.

With the AIOn Done with you, the AI reads the documents you switch it on for and drafts the rejection message for you to send. On Done for you, your AI agent sends it on its own.

Approval workflow software
ThenOn the record

Every vendor’s CMMC status, on the record.

Who sent what, who approved or rejected it, and when, for every vendor on every job. Export it when a contracting officer or an auditor asks.

Construction compliance software Federal contractors All solutions

See a vendor’s CMMC documents come in on a sample project.

Book a demo
Compared

Most teams collect CMMC screenshots by email and hope they’re current.

  • With Contracts Connected
  • Today: We awarded before anyone checked CMMCWith Contracts Connected: Asked for before award, with the rest of their documents
  • Today: SPRS screenshots buried in emailWith Contracts Connected: Every vendor’s printout and affirmation on one screen
  • Today: Last year’s affirmation is the one on fileWith Contracts Connected: Asked for again on the schedule you set
  • Today: Nobody can say who checked itWith Contracts Connected: Who approved it, and when, on the record

See every vendor’s CMMC status, on one screen.

Book a demo
Proof

Built by a builder. Run by builders.

The record

Our co-founder ran a large federal general contracting firm for 15 years, about 100,000 documents a year.

Lars HermanCo-founder, Contracts Connected
Read the story
Customers
"What used to be a time-consuming and disorganized process is now streamlined and efficient. With automated workflows, easy document tracking, and seamless collaboration, we've saved countless hours and minimized errors."
Director of Construction OperationsCape Fox Construction Group
AI-first. AI optional.

The AI does as much as you let it. Or nothing at all.

It's one setting for the whole account, and you can change it any time. Work that restricts AI runs with it off.

Do it yourself · No AI

Your team runs it.

Requests, reminders, review and the record all work without the AI. No AI model touches your documents.

Done with you · The AI reads

The AI reads before you approve.

It reads the documents you switch it on for, tells you whether to approve or reject and why, and drafts the rejection message for you to send.

Done for you · The AI agent

Your AI agent chases it.

It asks each vendor for what’s missing, answers their questions and sends rejections back on its own. Human in the loop or Auto mode.

How the AI levels work Plans and pricing Security
Free templates

The hard way, if you must.

Made by builders and free. With a template you still ask, chase and check every vendor by hand. Here, it’s done for you.

CMMC

CMMC vendor / subcontractor questionnaire

The 12-field intake form federal-construction primes use to capture sub CMMC level + SPRS score before award.

PDFExcelWord
Download
CMMC

CMMC Level 1 self-assessment checklist (construction context)

All 17 CMMC 2.0 Level 1 controls translated from cybersecurity-speak into construction-firm reality.

PDFExcelWord
Download
Cybersecurity

Vendor cybersecurity questionnaire (non-CMMC)

17-field cybersecurity intake form commercial GCs send to subs before granting owner-data access, BEC + wire-fraud focused, construction-specific.

PDFExcelWord
Download
CMMC

CMMC documentation binder checklist

18 artifact categories every federal-construction firm needs in its CMMC evidence binder, Level 1 and Level 2.

PDFExcelWord
Download

Questions people ask about subcontractor CMMC compliance

Answered from DoD's own rules, as of October 2026.

Do subcontractors need CMMC?
Yes, when they’ll process, store or transmit federal contract information (FCI) or controlled unclassified information (CUI) on their own systems in performance of a DoD contract. The requirement reaches every tier. A vendor that never handles either has no CMMC requirement.
What CMMC level does a subcontractor need?
Level 1 (Self) when it handles only FCI, and at least Level 2 (Self) when it handles CUI. While Phase 2 is suspended, DoD is designating only those two self-assessment levels.
How do I verify a subcontractor’s CMMC status?
Ask the vendor for a printout or screenshot of its CMMC status from SPRS. Primes can’t see a vendor’s record in SPRS, and DoD’s guidance is to request that screenshot and confirm the level matches the subcontract.
What should a contractor collect from vendors for CMMC?
The CMMC status printout from SPRS, showing the level, the status date and the CAGE code, and the annual affirmation, checked against the level the subcontract requires. Collect both before award.
What is a CMMC affirmation?
A statement from the company’s affirming official that it continues to meet the requirements of its CMMC level. It’s entered in SPRS after each assessment and every year after, and primes must have their vendors keep it current.
How long does a CMMC status last?
A Final Level 1 (Self) status lasts one year and a Final Level 2 status three years, each with an affirmation every year. A conditional Level 2 status lasts 180 days.
Is CMMC Phase 2 delayed?
Yes. On July 13, 2026, DoD suspended Phase 2, which was set to start November 10, 2026. The Phase 1 self-assessment requirements stay in place while DoD reviews the program.
Does CMMC apply to non-DoD contracts?
No. CMMC covers DoD contracts and work paid for with DoD funds. Civilian federal contracts carry FAR 52.204-21, basic safeguarding, which also flows down to subcontractors, and any owner can ask its vendors for its own cybersecurity documents.
Can Contracts Connected check a vendor’s status in SPRS?
No. Primes can’t access a vendor’s SPRS record, so Contracts Connected collects what the vendor shares, the printout and the affirmation, for your team to review and keep on the record.
Does Contracts Connected do our own CMMC assessment?
No. It doesn’t assess controls or write an SSP or POA&M. For your own readiness, look at CMMC and GRC software or a consultant. Our comparison of CMMC compliance software covers the options.
Can I collect other cybersecurity documents the same way?
Yes. What you collect is set on your account, so a civilian agency’s or an owner’s cybersecurity questionnaire goes on the same list, with the same reminders and review.
How much does it cost?
Contracts Connected starts at $416 a month on Foundation, which covers collecting vendor documents with reminders, review and filing. Every plan has unlimited users and vendors, and the AI is optional. See plans and pricing.
CMMC compliance software, compared FAR flow-down clauses by subcontract tier

Every vendor’s CMMC status, in hand before award.

We’ll walk a vendor’s printout and affirmation from request to approval, on a sample project.

Book a demoContracts Connected for federal contractors