Handing Pre-Contract FCI and CUI

Contractors, subcontractors, and proposal consultants are often confused about their obligations regarding the safeguarding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) received from the government as part of a request for proposals (RFP) or from another contractor in order to generate a quote as a subcontractor during the solicitation phase before a contract is signed.

The rollout of CMMC in Department of Defense (DoD) contracts has created more confusion as contractors have been incorrectly requiring their potential subcontractors and other organizations to demonstrate CMMC compliance to handle FCI and CUI before a contract is signed.

This post will help government contractors, subcontractors, and other organizations understand their FCI and CUI safeguarding obligations (or lack thereof) during the pre-contract solicitation phase by exploring:

• The source of FCI and CUI protection obligations
• How to handle FCI and CUI before a contract is signed
• Common sources of confusion about pre-contract FCI and CUI
• Why CMMC does not apply to FCI and CUI handled before a contract is signed

TrustedSec has years of experience helping contractors implement and assess themselves against the FAR 52.204-21 and NIST SP 800-171 requirements for safeguarding FCI and CUI and is a CMMC Registered Practitioner Organization (RPO). If you have FCI, CUI, NIST SP 800-171, and CMMC concerns, we are available to help—get in touch with us!

Special thanks to Brent Paris at Bid Designs for sharing information on the pre-contract issues his team commonly encounters while helping clients bid on government contracts that involve the handling of FCI and CUI.

Overview

• The government’s standard contract clauses for safeguarding FCI and CUI do not apply during the solicitation phase.
  • The FAR 52.204-21, DFARS 252.204-7012, DFARS 252.204-7021 (CMMC), and other similar contract clauses never apply to FCI or CUI handled before a contract is signed or to FCI or CUI handled outside the specific contract that contains those clauses.
• Contractors have no compliance obligations to safeguard FCI and CUI during the solicitation phase unless they have entered into a separate pre-contract agreement to do so.
  • Some contractors may receive FCI and CUI without any agreement in place and, as a result, have no compliance obligations whatsoever with regard to FCI and CUI.
• Prime contractors that receive pre-contract agreements to safeguard FCI and CUI from the government must follow the requirements in those agreements.
  • Pre-contract agreements are not standardized the way the FAR and DFARS FCI and CUI safeguarding contract clauses are, so contractors will need to carefully review and understand the requirements of each individual agreement.
• It is common for contractors that do not understand their (lack of) pre-contract FCI and CUI protection obligations to incorrectly push requirements, including FAR and DFARS clauses that should not apply, down to potential subcontractors and other organizations during the solicitation phase, thereby causing further confusion.
  • Organizations that subcontract for or otherwise work with government contractors should be aware of common points of confusion and be prepared to ask questions and push back with accurate information about the scope and applicability of FCI and CUI compliance obligations.

While confusion about the FCI and CUI programs has existed for a long time, the attention the CMMC program rollout is getting has significantly amplified the problem. The CMMC program is very well defined, but its scope and applicability are poorly understood by many contractors, and it has become common for contractors to incorrectly attempt to impose CMMC obligations on potential subcontractors and other organizations.

The Subcontractor Problem

This post focuses on how the government’s program for contractors handling FCI and CUI is supposed to operate, but there is a major problem that must be addressed up front: many large prime contractors are pushing supposed FCI and CUI compliance requirements (including CMMC) on their potential subcontractors that go above and beyond what is actually required by the government. Many of these requirements fall into the categories described in the Common Sources of Confusion section of this post.

In some cases, this may result from the prime contractor misunderstanding how the FCI and CUI programs are supposed to work, but it may also be an intentional, if misguided, attempt at avoiding liability for subcontractor non-compliance or a shortcut to avoid keeping track of which compliance obligations apply to each subcontractor.

This topic is explored further in our previous post A Vault With No Treasure - CMMC Level 2 Compliance for Subcontractors With No CUI, but for the purposes of this post, contractors should keep in mind that their upstream contractors may attempt to enforce requirements that are not part of the official government FCI and CUI programs. Whether or not subcontractors agree to or violate these non-standard requirements imposed by upstream contractors is a private contractual issue that has nothing to do with government penalties.

FCI and CUI Safeguarding Obligations

Contractors often misunderstand the source of FCI and CUI safeguarding obligations. The tangled mess of laws, regulations, government contract clauses, pre-contract agreements, flow-down requirements, and private contracts and agreements can be confusing, especially when contractors try to incorrectly apply various requirements on their subcontractors.

The subsections below untangle the true source of FCI and CUI safeguarding obligations to help understand what should apply to contractors and subcontractors.

Laws and Regulations

There are no laws or regulations that directly apply FCI or CUI safeguarding requirements to anyone outside the Federal government. The CUI regulation at 32 CFR Part 2002, a common source of confusion, only applies directly to executive branch agencies within the government itself, not to private-sector entities including government contractors. This is different from other regulations like ITAR, EAR, and HIPAA that automatically apply directly to private-sector entities.

Contractors and subcontractors are only obligated to safeguard FCI and CUI if they have agreed to do so via a specific agreement with the government as per 32 CFR 2002.1(f). The agreement is usually a clause in a contract or subcontract, but contractors may receive pre-contract agreements for the safeguarding of CUI if they are expected to review CUI to generate a quote during the solicitation phase.

Agreements are also specific to each solicitation or contract. A contractor or subcontractor that does not have a safeguarding agreement in place that covers a specific solicitation has no safeguarding obligations for the FCI and CUI received as part of that solicitation. This is true even if the contractor or subcontractor has previous agreements that contain FCI and/or CUI safeguarding clauses related to other solicitations or contracts.

Each document containing CUI must be protected in accordance with the requirements of the specific agreement it was received under because there is no single universal set of rules for contractors to safeguard CUI. CUI safeguarding requirements vary because:

• Standard CUI protection clauses already in use by various agencies differ from each other.
• Agencies revise their contract clauses from time to time.
• Some contracts may require extra protection for certain categories of CUI.

Contract Clauses

The contract clauses for safeguarding FCI and CUI are standardized. The text of the clauses that the government inserts into contracts are contained in the Federal Acquisition Regulation (FAR) and agency-specific supplements, e.g., the DoD’s Defense Federal Acquisition Regulation Supplement (DFARS).

 There is currently no standard government-wide contract clause for safeguarding CUI, although one has been proposed. Contractors will only receive CUI safeguarding clauses in contracts if the agency they are working with has implemented the CUI program. More information on the proposed government-wide CUI clause is in our previous blog post CUI For the Rest of Us: The New Government-Wide CUI Protection Contract Clause.

 Common contract clauses related to FCI and CUI include:

• FAR 52.204-21: The government-wide clause for safeguarding FCI
• DFARS 252.204-7012: DoD’s clause for safeguarding CUI
• DFARS 252.204-7021: DoD’s clause for an assessment program (CMMC) to verify that contractors have implemented the FCI and CUI safeguards required by FAR 52.204-21 and DFARS 252.204-7012
• HSAR 3052.204-72: Department of Homeland Security’s clause for safeguarding CUI
• NFS 1852.204-76 (as amended by PCD 21-01B): NASA’s clause for safeguarding CUI

These clauses only apply to information handled under a contract that contains these clauses. As a result, none of the requirements in these contract clauses apply to a contractor during the solicitation phase or to any other information handled outside a specific contract that contains these clauses. These contract clauses may be provided during the solicitation phase so contractors can understand what their obligations will be once a contract is signed, but do not take effect until the contract is awarded and signed.

Pre-Contract Agreements

Every government agency is supposed to have an agreement in place with parties outside the executive branch of government (including contractors) before sharing CUI as per the regulations that define how the government itself must handle CUI at 32 CFR 2002.4(c) and 32 CFR 2002.16(a)(5). This should be a formal written agreement but may be simple click-to-accept agreements on procurement sites like sam.gov or PIEE. The regulations also allow the government to make informal agreements that encourage, rather than require, the recipient to protect CUI.

As an example, an RFP posted on sam.gov for C-130 Depot Maintenance Repair and Overhaul at the time this post was written contains the following text related to CUI:

• Solicitation documents may contain Controlled Unclassified Information (CUI)
• Each potential Offeror shall certify that no dissemination of any export-controlled solicitation attachments and technical documents containing CUI subject to this requirement will occur in a manner that would violate applicable export control laws and regulations via submittal of their approved DD Form 2345.
• Distribution of CUI by an Offeror to that Offeror’s team members, partners, subcontractors, suppliers and/or vendors shall be the responsibility of the Offeror and shall be limited to a “need to know” basis.
• All guidance contained herein with regard to handling, distribution and destruction of CUI data shall be flowed down to all subcontractors and team members.

Neither these terms nor DD form 2345 impose detailed safeguarding requirements (e.g., NIST SP 800-171 or CMMC) on CUI shared as part of the RFP. The terms simply tell bidders they must only share CUI on a need-to-know basis and pass these same instructions to the people and organizations CUI is shared with. Potential contractors and subcontractors reviewing the CUI associated with this RFP would be under no obligation to be compliant with NIST SP 800-171 or have a CMMC status at any level.

Keep in mind that each pre-contract agreement is potentially unique, and this RFP was only used as an example of how vague pre-contract CUI agreements can be. Each agreement must be reviewed carefully to understand how contractors must handle pre-contract CUI under a specific RFP.

How to Handle Pre-Contract FCI and CUI

Determining how to handle FCI and/or CUI before a contract is signed depends on a few things:

• Is CUI being handled?
• Is a pre-contract agreement to protect CUI in place?
• Are the pre-contract agreements official agreements flowed down from the government, or have they been created by other contractors?
• Do other requirements apply to the data, whether or not it is FCI and/or CUI?

Each of these scenarios is covered in more detail in the following subsections.

Handling FCI Outside a Contract

Contractors have no obligation to safeguard FCI during the solicitation phase because FCI does not exist during the solicitation phase.

The definition of FCI at FAR 52.204-21(a) tells us that FCI is information provided by or generated for the government under a contract. This means FCI cannot exist unless there is a contract for it to exist under. A contract is not yet in place during the solicitation phase, therefore none of the information handled during the solicitation phase can ever be FCI.

Contractors should not attempt to enforce any pre-contract FCI safeguarding obligations on subcontractors because neither FCI nor FCI safeguarding obligations exist during the solicitation phase.

Handling CUI Under Pre-Contract Agreements

Contractors with a formal pre-contract agreement must safeguard CUI in accordance with the terms of that agreement. The requirements of pre-contract agreements will vary between agencies and may vary from contract to contract within a single agency, so it is important to keep track of which CUI is associated with which agreement to apply the correct safeguards.

Just because a contractor complies with contractual CUI safeguarding agreements, e.g., DFARS 252.204-7012 or DFARS 252.204-7021 (CMMC), does not mean it is compliant with pre-contract agreements. This topic is covered in more detail in the section on Common Sources of Confusion - Treating Compliance With Previous Contracts as a Safe Harbor below.

Some pre-contract agreements may include a requirement that the agreements be flowed down to potential subcontractors (as shown in the example pre-contract agreement above) while others may not. Flow-down requirements must be followed if they are included in pre-contract agreements.

A contractor should only flow down an official government pre-contract agreement associated with the solicitation it is seeking to subcontract. A pre-contract agreement from a different solicitation should never be flowed down as it would potentially impose incorrect compliance obligations, cause confusion, and/or unnecessarily deter potential subcontractors.

Handling CUI Without Agreements

As described above, a potential contractor or subcontractor that has not agreed to safeguard CUI is under no obligation to do so and may handle any CUI they receive however they like with no repercussions.

Government agencies have been inconsistent about sending formal CUI safeguarding agreements during the solicitation phase, so prime contractors should not be surprised if they receive CUI from the government without an agreement in place.

Potential subcontractors may also receive CUI from upstream contractors without a safeguarding agreement in place. This may be because:

• The upstream contractor did not receive a CUI safeguarding agreement from the government so there’s nothing to flow down
• The upstream contractor received a pre-contract agreement that did not contain a flow-down requirement
• The upstream contractor didn’t understand that they were supposed to flow down the pre-contract agreement.

Contractors should never create their own pre-contract agreements for subcontractors as this will only cause confusion. Only legitimate pre-contract agreements from the government should be flowed down. If there is no legitimate agreement from the government, then CUI can be shared with potential subcontractors without an agreement in place.

Unofficial CUI Agreements

Contractors, especially large prime DoD contractors, have been causing much confusion by writing their own pre-contract CUI agreements and imposing requirements that do not align with the official government requirements for safeguarding CUI (sometimes even imposing CMMC certification requirements as a prerequisite to handle RFP material during the solicitation phase). These requirements are then sent to potential subcontractors as well as many other types of organizations that do not meet the government definition of subcontractor.

Ideally, a potential subcontractor (or any other organization besides a subcontractor) should be able to reach out to a contractor and inform them how their supposed pre-contract agreement does not align with the government’s requirements (link them to this blog post?). However, most subcontractors seem reluctant to push back on even the most nonsensical of requirements for fear of losing potential business to a competitor that will gladly say “yes” and will jump through the unnecessary extra hoops (or at least pretend to) just to win a deal.

Ultimately, it is up to each potential subcontractor to make their own decision as to whether they want to try to educate an upstream contractor on what sort of agreement would be appropriate, expend resources implementing compliance requirements that should not apply, or assume the risk of claiming to implement the supposed requirements without actually implementing them.

The next section of this post goes into more detail about the confusion that leads to and results from these nonsense clauses. More information on dubious CMMC requirements is also in our previous blog post The Proliferation of “Fake” CMMC Contract Clauses.

General Best Practices

Even if sharing information is allowed due to the lack of any formal agreements, some caution is advised to avoid unnecessary risks.

Basic principles to be considered include:

• Are there private contractual agreements outside the FCI and CUI programs that apply (e.g., a non-disclosure agreement)?
• Is there any implied confidentiality based on the context of a communication?
• Is information sensitive for reasons unrelated to the FCI and/or CUI programs (e.g., export-controlled information, personal information, proprietary data)?
• Is there a lawful government purpose for sharing information?

Organizations handling any potentially sensitive information should always do the following to protect themselves:

• Treat information cautiously
• Limit distribution and do not post potentially sensitive information publicly
• Ask senders about expectations
• Consider basic safeguarding even when it is not required

Common Sources of Confusion

Common sources of confusion related to pre-contract CUI (and sometimes CUI handling in general) include:

• Directly applying CUI regulations to organizations that are not federal agencies
• Applying contract clauses during the solicitation phase when no contract clauses should apply
• Applying clauses from previous contracts to information handled under new solicitations and/or contracts
• Treating compliance with previous contracts as a safe harbor instead of checking for compliance with new agreements
• Treating proprietary or solicitation information as CUI
• Incorrectly applying clauses to subcontracts that do not involve handling of CUI

Each of these is addressed in detail in the subsections below.

Directly Applying CUI Regulations

Contractors that come across the CUI regulations at 32 CFR Part 2002 often mistake it for a set of requirements that directly apply to contractors. Some contractors have incorrectly created their own CUI protection agreements based on these regulations and pushed them on potential subcontractors. Contractors have also confused subcontractors by incorrectly telling them that they must directly comply with 32 CFR Part 2002.

There is no such thing as 32 CFR Part 2002 compliance for any organization that is not a federal agency because 32 CFR 2002.1(f) explicitly tells us that:

• These CUI regulations only apply directly to executive branch agencies.
• Organizations outside the government (e.g., contractors) only become obligated to protect CUI via agreements with government agencies as described in 32 CFR 2002.4(c) and 32 CFR 2002.16(a).

Furthermore, CUI handling agreements do not impose a requirement to directly comply with the CUI regulations in 32 CFR 2002 but instead usually impose requirements related to NIST SP 800-171 as described in 32 CFR 2002.14(h)(2).

Effectively, the CUI regulations are almost irrelevant to contractors except as a source of information about what to expect from the government regarding CUI.

Contractors should never use the CUI regulations at 32 CFR Part 2002 as the foundation of their CUI protection program or CUI handling agreements, nor should contractors require their subcontractors or any other organizations such as proposal consultants to directly comply with these CUI regulations. Contractors should instead design their CUI compliance program around the requirements contained in their specific agreements with government agencies and flow only those same government agreements down to subcontractors.

Contractors have similarly attempted to incorrectly apply the CMMC regulation at 32 CFR Part 170 directly to subcontractors via their own home-made CUI protection agreements. This is explained in more detail in the CMMC Deep Dive below.

Applying Contract Clauses During the Solicitation Phase

Some contractors have attempted to incorrectly impose the requirements contained in the standard government FCI and CUI safeguarding contract clauses on subcontractors during the solicitation phase.

None of the standard FCI or CUI contract clauses apply before a contract is signed because that’s simply not how contracts work; contract clauses only come into effect once the contract that contains them is signed. FCI or CUI exchanged during the solicitation phase are not covered by potential future contract clauses. There are no FAR 52.204-21, DFARS 252.204-7012, or CMMC compliance obligations (just to pick a few examples) prior a contract or subcontract being signed.

Although contractors should inform potential subcontractors of the FCI and CUI safeguarding requirements that will be included in subcontracts, contractors should never try to impose the requirements contained in the safeguarding contract clauses on a subcontractor for CUI exchanged prior to a subcontract being signed. Only valid government pre-contract agreements should be applied to subcontractors during the solicitation phase.

Applying Clauses From Previous Contracts During the Solicitation Phase

Contractors may believe that they or their subcontractors are obligated to protect FCI and CUI received during the solicitation phase for a potential new contract because previous contracts contain FCI and/or CUI safeguarding clauses.

Once again, this is not how contracts work. The clauses in each contract only apply to the FCI and CUI received or created under that specific contract and create no safeguarding obligations for FCI or CUI outside of that specific contract, including CUI received as part of a solicitation for a new contract.

Contractors should never hold themselves or their subcontractors accountable for the safeguarding requirements in previous contracts when sharing information as part of a new solicitation. Only the pre-contract agreements related to the new solicitation apply to the potential contractor and subcontractors.

Treating Compliance With Previous Contracts as a Safe Harbor

Some contractors seem to be under the impression that subcontractors that have previously implemented contractual safeguards for the protection of FCI or CUI (e.g., DFARS 252.204-7012 or CMMC) are automatically compliant with any potential CUI safeguarding requirements in future pre-contract agreements. This results in contractors asking subcontractors if they are compliant with CUI safeguarding contract clauses and then flowing down CUI to potential subcontractors during the solicitation phase for a new contract without flowing down the pre-contract agreements for that specific solicitation.

There are many reasons why compliance with an existing CUI protection agreement, including the standard contract clauses, does not automatically indicate compliance with another CUI protection agreement:

• Any given pre-contract agreement may contain different requirements than any other agreement, including the standard contractual agreements (e.g., some pre-contract agreements contain U.S. data residency requirements for CUI, as shown in the example from sam.gov above, while DFARS 252.204-7012 and CMMC do not).
• Without flowing down the correct pre-contract agreement, subcontractor personnel will not be aware of the applicable requirements and may handle pre-contract CUI within systems that do not meet the safeguarding requirements.

This last point deserves some further explanation: Some contractors mistakenly believe that an entire contractor is either compliant or not compliant with CUI safeguarding requirements like CMMC. In reality, many contractors build isolated systems, e.g., a "CMMC Enclave", to exclusively handle information with specific safeguarding requirements to avoid applying these requirements to the rest of their environment. Subcontractors must be aware of pre-contract CUI agreements to understand which of their systems can effectively meet the requirements.

Contractors should never use compliance with prior CUI safeguarding agreements or contract clauses as an indication that subcontractors are compliant with the pre-contract or contract requirements of potential new contracts. Each government pre-contract agreement should be provided to potential subcontractors because each agreement is potentially unique.

Treating Proprietary or Solicitation Information as CUI

There are CUI categories for procurement and acquisition (PROCURE), source selection (SSEL), and proprietary business information (PROPIN). This causes some contractors to believe that information they create or share as part of a bid is CUI that must be marked and safeguarded by the contractor, and that any of this information provided to potential subcontractors must also be safeguarded by the subcontractor. This is not the case and is the result of a misunderstanding about how CUI is created and designated.

CUI is defined as information that the government itself is required to safeguard or control the dissemination of. The laws and regulations related to the CUI categories listed above only apply once the government receives the information from a contractor. Effectively, the CUI designation for these categories of information exists to protect the contractor from the government leaking their information to competitors and impose no obligations on the contractors that created the information as part of their bid.

Contractors are not obligated to safeguard their own proprietary or bid information as CUI simply because it will be provided to the government or a potential subcontractor. The contractor remains free to do whatever they want with their own information and share it with whomever they want.

Contractors should never attempt to impose CUI safeguarding requirements (including CMMC) on subcontractors simply because the subcontractor will be handling the contractor’s proprietary information or generating a bid. This information should instead be covered under normal non-disclosure agreements between private parties.

Subcontractors that are concerned that upstream contractors may be inappropriately marking information as CUI can review our previous post on Dealing With Unmarked and Mismarked CUI for more information and advice.

Incorrectly Applying Clauses

Some contractors have been warning subcontractors and other organizations of CUI safeguarding requirements during the solicitation phase when the recipient would never be subject to those requirements.

These supposed requirements often come in the form of screening questionnaires containing blanket demands for compliance with a long list of FAR and supplemental clauses in order to list the organization as an approved subcontractor or vendor. The blanket questionnaire approach overlooks a few facts:

• CUI safeguarding requirements only apply to organizations that will handle CUI, many contracts and subcontracts do not involve CUI.
• CUI safeguarding clauses from different government agencies often contain different requirements, for example:
  • Applying requirements to different scopes (only devices that directly handle CUI vs. devices that can connect to or provide security to devices that handle CUI)
  • Applying different requirements (NIST SP 800-171 revision 2 vs. revision 3)
  • Different compliance reporting requirements (third-party audit, self-assessment, or no reporting at all)
• The specifics of CUI safeguarding requirements are potentially unique to each contract and subcontract based on the type of CUI involved, e.g., CMMC level and assessment requirements vary depending on the categories and quantity of CUI that will be handled under a specific contract.

Unnecessarily including every possible FCI and CUI requirement in every subcontract may result in a smaller pool of bids with higher prices as a result of the overhead of the additional imaginary requirements or subcontractors determining it is not feasible to meet such a long list of requirements.

Contractors have been observed attempting to incorrectly apply the requirements contained in the clauses to:

Contractors should pay close attention to the requirements of each solicitation and never try to flow down FCI and CUI requirements that do not apply based on the information that will be handled under a specific subcontract or to organizations that are not subcontractors.

CMMC Deep Dive

CMMC only applies to DoD contracts, so this information will be irrelevant to contractors and subcontractors that do not work with DoD contracts. More information on which organizations should expect to receive CMMC requirements is in our previous blog post CMMC NOPE: Why You Don’t Need to be CMMC Compliant.

As mentioned at the start of this post, CMMC does not apply to FCI and CUI handled during the solicitation phase. CMMC is purely a contractual requirement that only comes into effect once a contract is signed.

During the public comment period for the CMMC regulation, a commenter directly asked whether contractors must meet CMMC requirements during the solicitation phase, or to view RFPs that contain CUI. The government response is that “There are no CMMC requirements for reviewing FCI or CUI solicitation material.”

Unfortunately, there still seems to be much confusion about this. Contractors often send agreements that require subcontractors and other organizations to have CMMC certifications just to view solicitation materials, so it is apparently necessary to describe exactly how and why CMMC does not apply during the solicitation phase.

Directly Applying the CMMC Regulation

Some contractors have created their own subcontract clauses requiring compliance with the CMMC regulation itself (32 CFR Part 170), just as contractors have mistakenly tried to apply the 32 CFR Part 2002 CUI regulation directly to subcontractors as described above.

While the CMMC regulation contains the CMMC scope and requirements, the DFARS 252.204.7021 contract clause is the mechanism by which the DoD applies the CMMC regulation to contractors and is also the mechanism by which contractors are required to apply CMMC to subcontractors as per DFARS 252.204-7021(f)(1).

The main problem with a direct reference to the CMMC regulation is that the regulation does not tell contractors what CMMC level they must implement. The specific level requirement for each contract is inserted into the DFARS 252.204-7021 clause by DoD and is adjusted by contractors when the clause is flowed down in subcontracts. There are other important definitions and requirements in DFARS 252.204-7021 that would also be omitted when using a direct reference to the CMMC regulation instead.

Contractors should never include their own direct references to the CMMC regulation (32 CFR Part 170) in pre-contract agreements or subcontracts. Instead, contractors should flow down the following to potential subcontractors:

• Any pre-contract agreements received from the government that contain flow-down requirements
• The entire DFARS 252.204-7021 clause with the CMMC level requirement in paragraph (d)(1)(i) adjusted appropriately for the information that will be flowed down to the subcontractor as per the instructions in 32 CFR 170.23 only if the contractor itself received this clause in its contract

While not required, the contractor should also flow down:

• All pre-contract agreements received from the government, even if they do not contain flow-down requirements
• The DFARS 252.204-7025 solicitation provision warning of a CMMC requirement with the CMMC level requirement adjusted to match the potential DFARS 252.204-7021 clause

CMMC Clauses in Solicitations

DoD contractors will encounter the DFARS 252.204.7021 CMMC contract clause in solicitations, however, this does not impose pre-contract CMMC requirements. The text of the CMMC requirement at DFARS 252.204-7021(d)(1)(i) states that the contractor must have and maintain the correct CMMC status “for the duration of the contract” and says nothing about applicability during the solicitation phase (which occurs prior to, not within the duration of, a contract).

Contractors will also encounter the DFARS 252.204-7025 CMMC provision in solicitations. This does not impose any requirements during the solicitation phase and is only a warning that CMMC requirements will be in the contract.

Impact of Prior CMMC Contracts

CMMC clauses in contracts signed by a contractor also do not impose any obligations regarding FCI and CUI received as part of a later solicitation or contract. In general, the terms of any contract only apply to the information handled under that individual contract regardless of past or future contracts.

DFARS 252.204-7021(d)(1)(i) also states that the CMMC requirement only applies to “information systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI”. Information systems that are not being used in the performance of a specific contract, task order, or delivery order are therefore not in scope for CMMC (e.g., systems that exclusively handle FCI and CUI during the solicitation phase).

CMMC Subcontractor Requirements

As with contractors, CMMC does not apply to subcontractors during the solicitation phase.

Contractors will need to include the DFARS 252.204-7021 CMMC clause in subcontracts that will involve the handling of FCI and/or CUI, and it is strongly recommended that contractors warn any potential subcontractors of a potential future CMMC requirement, but this does not impose any CMMC requirements on the subcontractor until the subcontract with the CMMC clause is signed.

CMMC External Service Provider Requirements

ESPs that handle CUI and/or Security Protection Data (SPD) will be in scope for a contractor’s CMMC assessment, and contractors should verify that ESPs will be able to meet the applicable CMMC requirements.

Note that an ESP being in scope for CMMC as per 32 CFR 170.19(c)(2)(i) is different from a requirement to flow down CMMC contract clauses under DFARS 252.204-7021(f). The CMMC clause itself flows-down exclusively to subcontractors while the CMMC compliance of an ESP is a private contractual matter between the ESP and contractor. ESP compliance impacts the contractor’s CMMC compliance status without directly transferring CMMC compliance obligations to the ESP. Effectively, the contractor or subcontractor that uses an ESP is responsible for the ESP’s compliance, and if the ESP is not compliant, the contractor or subcontractor cannot be compliant either.

More information on how CMMC applies to the relationships between contractors, subcontractors, and ESPs is in our previous blog post CMMC Subcontractors and Service Providers.

CMMC Requirements for Organizations Other Than Subcontractors and External Service Providers

Contractors often send CMMC requirements to organizations that are neither subcontractors nor ESPs, perhaps as a result of not understanding how narrowly defined these two (2) categories are:

• Subcontractors (formally defined at 48 CFR 3.502-1) directly support the creation of government prime contract deliverables by furnishing supplies, material, equipment, or services that are necessary to the performance of a government contract.
• ESPs (formally defined at 32 CFR 170.4(b)) support the contractor's IT and/or cybersecurity operations with external people, technology, or facilities.

Any organization that does not meet either of these definitions, e.g., a consultant helping an organization formulate a response to a government RFP, should never receive CMMC requirements in a contract. Even if an organization falls under these definitions, any CMMC-related information passed on during the solicitation phase should only be a warning that a future contract will contain the CMMC requirements rather than attempting to impose CMMC obligations during the solicitation phase.