The 12-field intake form federal-construction primes send to subs to capture CMMC self-assessment level, SPRS score, CUI handling posture, and DFARS 7012 flow-down acknowledgment. Before the subcontract is awarded.
Why federal primes need a CMMC subcontractor questionnaire under the 2024 final rule
Under the DoD’s October 2024 CMMC final rule, every federal-construction prime is now responsible for verifying that its subcontractors are at the right CMMC level for the information they’ll handle. DFARS 252.204-7021 makes this explicit: primes must flow down the appropriate CMMC requirement and confirm sub eligibility before sharing FCI or CUI. The 2025 phase-in started in November and DoD solicitations now name the required level on the contract.
The practical problem: most subs in the federal-construction supply chain are small firms without dedicated cybersecurity programs. They might have a CMMC Level 1 self-attestation in SPRS, or they might have nothing on file. They might handle CUI on past projects, or they might think CUI doesn’t apply to them at all. Until you ask, you don’t know. And under the 2025 final rule, “I didn’t ask” is now False Claims Act exposure for the prime.
This questionnaire is the practitioner’s intake form. It’s the document a federal-prime contracts admin sends to every sub during the prequalification cycle, before subcontract award and before any FCI or CUI is shared. The 12 fields cover what the sub knows about its own CMMC posture, what kind of federal information it expects to receive on this project, and the contractual acknowledgment that DFARS 7012 flow-down obligations attach.
What this is NOT: it’s not a CMMC assessment, it’s not a substitute for SPRS verification, and it’s not legal advice on whether the sub is compliant. It’s a structured intake. The prime takes the responses, verifies them independently against SPRS and any C3PAO certificates, and uses the answers to decide whether the sub needs to be carved out of CUI scope, escorted to a higher CMMC level, or accepted as-is at L1 self-attestation.
Send this form during prequalification. Refresh responses annually. Refresh on every new federal subcontract award. Keep the completed forms in the prime’s contracts file alongside the SPRS verification screenshots and any C3PAO certificate copies. That’s the evidence trail that satisfies a DCMA audit when it eventually shows up.
Who this questionnaire is for
- Federal general contractors prequalifying subs for any DoD project that involves FCI or CUI
- Prime contractors under DFARS 252.204-7021 flow-down obligations
- Contracts administrators running the federal prequal cycle
- Compliance officers building the DCMA-audit-ready evidence trail
- Risk managers evaluating sub-tier CMMC exposure before award
If you’re the sub being asked to fill this out, work through the CMMC Level 1 self-assessment checklist (construction context) first to confirm your own posture before you respond.
The 12 fields the questionnaire captures
The questionnaire captures 12 fields the prime needs from every sub before award:
- Sub’s current CMMC level and assessment date. The sub states their current CMMC self-attestation or C3PAO-certified level (None, L1, L2-Self, L2-C3PAO, L3) and the date of the most recent self-assessment or third-party certification. Required for any sub touching DoD-project FCI or CUI.
- Whether sub will receive CUI or FCI from you. The sub indicates which type of federal information they expect to handle on this project. CUI requires Level 2; FCI-only allows Level 1. Asking ensures the sub understands what they’re agreeing to before the subcontract attaches the obligation.
- SPRS score and last submission date. The Supplier Performance Risk System score (typically -203 to 110 for NIST SP 800-171 self-assessments) and the date the score was last updated. Required for L2 self-assessment subs. Verify independently in SPRS. Don’t rely on sub’s stated number.
- C3PAO name and certificate ID if L2. If the sub is L2-C3PAO certified, capture the C3PAO assessor name and the certificate ID. Verify against the official CyberAB Marketplace (cyberab.org) before relying on the certification. Expired certificates appear identical to active ones until verified.
- How sub stores and transmits project drawings. Free-text response describing where project drawings live (cloud platform name, on-prem server, Procore project, etc.) and how they’re shared with the sub’s team. This is the operational reality check. Sub may say they handle CUI properly but transmit drawings via personal Gmail.
- Field device controls for tablets and laptops. Free-text response on how field devices that touch project data are managed: MDM solution, password policy, encryption-at-rest, remote-wipe capability. Subs without basic field-device controls can’t credibly handle CUI.
- Cloud platforms touching DoD project data. List of all cloud platforms (Procore, Microsoft 365, Google Workspace, Autodesk Construction Cloud, etc.) that will touch project data. Each platform has its own CMMC compliance posture; sub must confirm each is L2-eligible before CUI sharing.
- Incident reporting commitment within 72 hours. Yes/No: sub commits to reporting any cyber incident affecting project data to the prime within 72 hours of discovery. Required by DFARS 252.204-7012; flow-down to subs makes the prime’s obligation enforceable downstream.
- Lower-tier sub flow-down acknowledgment signature. Yes/No + signature: sub acknowledges they will flow down equivalent CMMC requirements to their tier-2 subs. Required when sub plans to use their own subs on this project. Without flow-down, the chain breaks at sub’s tier.
- POA&M items still open and target dates. Free-text response listing any open Plan-of-Action-and-Milestones items from the sub’s last assessment, with target close dates. Some POA&M items are conditionally allowed at L2 self-assessment under the 2025 final rule; understanding what’s open lets the prime gauge risk.
- Training records for personnel on the project. Free-text response describing how sub’s personnel are trained on CMMC handling of project data: cadence, content, evidence retention. CMMC practice AT.L1-3.2.1 (Level 1) and equivalents at L2 require documented training.
- Authorized signature acknowledging DFARS flow-down. Senior official’s name, title, and signature acknowledging that DFARS 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021 all flow down to the sub via the subcontract. Senior official only. Junior IT person can prepare the form but senior official signs.
How to send and review the questionnaire on every prequal
- Email the form (PDF or DOCX version) to the sub’s main point-of-contact during prequal. 7-day SLA for return.
- When the response comes back, verify items 3 and 4 (SPRS score and C3PAO certificate) independently against SPRS and the CyberAB Marketplace. Don’t rely on sub-stated numbers.
- Cross-reference items 1 and 2. If the sub claims L1 but item 2 indicates CUI handling, that’s a mismatch. Either escort the sub to L2 readiness or carve them out of CUI scope on this project.
- Save the completed questionnaire in the project contracts file with: response date, reviewer name, and links to the SPRS and CyberAB verification screenshots.
- Refresh annually and on every new federal subcontract award.
Stop chasing CMMC answers from subs
The 12 fields above take a contracts admin 30 minutes per sub when responses are clean, and 3-4 hours when answers are missing, contradictory, or require back-and-forth verification. Multiply by 30+ subs on a federal project and you’ve built a part-time job out of CMMC vendor management. Contracts Connected’s Subcontractor Prequal feature pre-fills the questionnaire from sub data already on file, requests responses automatically with a 7-day SLA, verifies SPRS scores against the live API, and flags any sub whose answers don’t match independent verification, before subcontract award.
For educational purposes. These templates, checklists, and trackers are operator-built starting points designed to help you move faster on the kind of work that usually drowns construction admins in email chains. They are not legal, insurance, accounting, or tax advice. Each project, jurisdiction, and contract has its own quirks. Review the document, refine the language, and consult your attorney, broker, CPA, or compliance officer before relying on it for a live project decision.
Frequently asked questions about CMMC vendor questionnaires
When do I send this questionnaire?
Send during prequalification. Before subcontract award and before any FCI or CUI is shared. Sending after award creates a problem: the sub has already accepted the work and may resist a finding that they’re not at the right CMMC level. Pre-award, both parties can adjust scope or timeline without contractual exposure.
What if a sub has no CMMC level yet?
Two options. Option 1: have them self-attest Level 1 immediately by performing the 17-practice self-assessment and submitting to SPRS. L1 self-attestation is achievable in 30-60 days for most construction subs. Option 2: carve them out of the CUI/FCI scope on this project. Restructure the subcontract scope so the sub doesn’t receive any federal information that triggers CMMC requirements.
Can I rely on the sub’s questionnaire answers?
Treat the questionnaire as starting evidence. Always verify SPRS score independently at sprs.dla.mil, and verify any L2-C3PAO certificate against the CyberAB Marketplace at cyberab.org. Don’t rely solely on sub-stated numbers. The 2025 DoD final rule introduced False Claims Act exposure for both subs and primes who materially misrepresent CMMC posture.
Do material suppliers need to fill this out?
Only if they receive FCI or CUI from your project. Most material vendors (lumber, ready-mix concrete, fasteners, etc.) don’t receive any federal information. They receive a purchase order with quantities and a delivery address. Those vendors can be excluded from the CMMC questionnaire requirement. Vendors that receive specifications, drawings, or schedules with non-public agency-provided detail need to fill this out.
How often should I refresh CMMC questionnaire responses?
At minimum annually, on the questionnaire’s response date anniversary. Refresh additionally on every new federal subcontract award (a sub might be at L1 today but need to be at L2 for a new project that involves CUI). Refresh whenever the sub changes carriers, key personnel, or cloud platforms. These all change CMMC posture.
What happens if a sub fails to comply mid-project?
Report under DFARS 252.204-7012 if CUI is involved (72-hour incident report to the contracting agency). Execute whatever remediation clauses your subcontract contains. Typically the sub gets a 30-day cure period to either come into compliance or remove themselves from the CUI scope. Persistent non-compliance becomes a subcontract termination event.