Defence supply chain flow-down and cyber checklist: DFARS 7012, CMMC, DEFCON 658, DPAS and qualifying sub-contracts

Supplier flow-down and cyber checklist

For counsel at primes and at suppliers. A supplier is often bound by rules in a contract it has never seen; this checklist sets out which ones travel down the chain and what each tier must do. The first section is free; the rest, and the PDF, unlock with a free sign-up.

Randeep Bubbra | Lawyer | Making defence financeable

1Which cyber rules apply

Will the supplier hold Federal Contract Information or Controlled Unclassified Information?
That decides the CMMC level, and whether NIST SP 800-171 applies in full.
eCFR: 32 CFR 170.1 (CMMC Program)
Does the supplier have a current NIST SP 800-171 assessment posted in the Supplier Performance Risk System?
A current assessment, no more than three years old, is a condition of award where the rules apply.
Acquisition.gov: DFARS 252.204-7019 (NIST SP 800-171 assessment requirements)
Key term: Cyber
For UK MOD work, what Cyber Risk Profile has been set, and does the contract require Def Stan 05-138 or a Cyber Implementation Plan?
DEFCON 658 sets the standard by risk profile, and the supplier must meet it for the life of the contract.
GOV.UK: DEFCON 658 (cyber), edition 10/22

2Flowing requirements down · 6 questions
3Incidents and reporting · 4 questions
4Contract and financing points · 3 questions

Subscriber tool

The rest of this tool covers the other three sections: flowing requirements down, incidents and reporting, and the contract and financing points, with the rule quoted for each point. It is free with a work email, with a PDF copy to keep, along with the full guides.

Unlock the full tool

Free. Work emails only. Unsubscribe at any time.

General information on public documents and law as at 28 Oct 2026, not legal advice on any transaction. Filed wording is quoted from the public document linked to it.