Why Primes Pick Suppliers by Cybersecurity Posture | CGA

Prime contractors no longer choose subcontractors on capability and past performance alone. Under the CMMC rules now written into defense contracts, a prime has to confirm that any supplier handling federal contract information (FCI) or controlled unclassified information (CUI) holds the right CMMC status before the subcontract is placed. That means your cybersecurity posture now decides whether you get the call in the first place.

Phase 2 of the CMMC rollout begins on November 10, 2026, and the check gets tougher. This post covers what primes look at, why they look at it, and what a small supplier can do about it.

Why are primes choosing suppliers by cybersecurity posture now?

The short answer is that the requirement flows down. DFARS clause 252.204-7021 requires a prime to put CMMC requirements into its subcontracts at every tier where FCI or CUI will be shared, and to confirm that the subcontractor has a current CMMC status at the required level. If a supplier can't show that status, the prime can't bring it onto that work without risking its own contract.

An older duty sits underneath this one. For years DFARS 252.204-7012 has required contractors that handle covered defense information to protect it under NIST SP 800-171 and to report cyber incidents to the Department of Defense within 72 hours. That clause also flows down. CMMC adds verification. A prime no longer has to take a supplier at its word, because it can look for a posted assessment result and a signed affirmation from a senior official.

Primes also carry their own exposure. Through its Civil Cyber-Fraud Initiative, the Department of Justice uses the False Claims Act to pursue contractors that misrepresent their cybersecurity. When a capture team picks partners, posture now sits on the list next to capability. Which list do you think your company is on right now?

A two-column comparison: the old supplier checklist (capability, past performance) versus today's checklist, which adds CMMC status, SPRS affirmation and incident reporting readiness.

What does a prime actually check before bringing a supplier on?

Each prime runs its own process, but most of what they ask for traces back to the regulations:

Your CMMC status and level as recorded in the Supplier Performance Risk System (SPRS). Depending on the contract, that is a Level 1 self-assessment, a Level 2 self-assessment, or a Level 2 certification from an authorized third-party assessor (C3PAO).
The affirmation of continuing compliance from your affirming official, which is required at each assessment and every year after.
For CUI work, how you stand against the 110 requirements in NIST SP 800-171 Revision 2, including any open items on a Plan of Action and Milestones. Conditional status is temporary, and open items have to be closed within 180 days.
Whether you can meet the 72-hour incident reporting duty under DFARS 252.204-7012.
A plain human question: who owns security at your company, and can they answer questions about it?

Many primes also send suppliers their own questionnaires. These aren't standardized and they differ from prime to prime, so read each one as a sign of what that prime is worried about. If your prime emailed you tomorrow asking for your SPRS status and your system security plan, how long would it take you to reply?

What changes on November 10, 2026?

Phase 1 started on November 10, 2025, when the DFARS rule implementing CMMC took effect. It brought Level 1 and Level 2 self-assessment requirements into applicable new solicitations. Phase 2 starts on November 10, 2026 and adds Level 2 certification by a C3PAO for applicable contracts. Phases 3 and 4 follow in the next two years, and Phase 4 brings full implementation.

Some things are still unsettled. Program offices have discretion during the phase-in, so it isn't yet clear how quickly individual solicitations will require Level 2 certification. It also isn't clear whether assessor capacity will keep up with demand. Primes know about both uncertainties, which is why many are asking suppliers about their status now instead of waiting for a specific solicitation to force the issue. Getting ready for a third-party assessment is rarely quick, and most of the work happens before an assessor ever arrives.

Is this really a compliance problem, or a business one?

An article published this week on OT Today made the case directly: CMMC is a business decision, because it affects whether contractors and subcontractors can win or keep defense work involving FCI or CUI. That matches what small suppliers report hearing from their primes.

There is also a security reason behind the paperwork. Federal agencies have warned publicly that state-sponsored actors target cleared defense contractors of every size to get at sensitive defense information. A small, specialized supplier can be the easiest route into a larger program. A prime that asks hard questions about your posture is protecting its program, and it is protecting your company too.

The benefit reaches past the prime. A strong posture protects your employees' data, your customers' information and the local partners who depend on you. It tells everyone you work with that you take their trust seriously. What would change for your team if your prime started treating you as a low-risk supplier instead of an open question?

How does an in-kind grant change where you stand with your prime?

Cyber Grants Alliance grants are in-kind. The grant is the work itself: people with cybersecurity and compliance expertise working alongside your team, at no cost to you. It is built for small businesses and small defense contractors who can't keep a full-time security leader on staff.

In practice, that support helps you understand which CMMC level your work calls for, where you stand against it today, and which gaps to close first. It also helps you build the documentation and evidence that an assessment, and your prime, will expect to see. It doesn't replace the assessment. A self-assessment still has to be honest and an affirmation still has to be true, and a certification still comes from an independent C3PAO.

What changes is your standing. With your prime, you can answer the questionnaire with evidence instead of promises. With your customers, you can show how their information is protected. With your community, you are a local employer and partner that others can rely on. Which of those would matter most to your business this year?

Want help with the first steps? Learn how Cyber Grants Alliance in-kind cybersecurity grants work, at no cost to you, or apply for in-kind support.

Frequently asked questions

Why do prime contractors care about a subcontractor's cybersecurity?

Under DFARS 252.204-7021, primes have to flow CMMC requirements down to subcontractors that handle FCI or CUI and confirm those subcontractors hold the required CMMC status. A weak supplier puts the prime's own contract and reputation at risk. That is why cybersecurity posture now sits next to capability and past performance when primes choose partners.

What is the CMMC flow-down requirement?

The flow-down requirement means a prime must include CMMC requirements in subcontracts at every tier where FCI or CUI will be shared. The prime must also confirm the subcontractor has a current CMMC status at the required level before the subcontract is placed. The obligation follows the information, not the size of the company.

When does CMMC Phase 2 begin and what does it add?

Phase 2 begins on November 10, 2026, one year after Phase 1 started on November 10, 2025. It adds Level 2 certification by an authorized third-party assessor (C3PAO) for applicable contracts. How quickly individual solicitations will include that requirement is not yet settled.

Where do primes look to confirm a supplier's CMMC status?

CMMC assessment results and affirmations are recorded in the Supplier Performance Risk System (SPRS). Primes check it and often send their own supplier questionnaires as well. A supplier that can quickly share its status and a current system security plan is easier to bring onto a program.

Can a small business get CMMC help without a dedicated security team?

Yes. Cyber Grants Alliance offers in-kind grants, meaning cybersecurity and compliance work and expertise delivered at no cost to you, for small businesses and small defense contractors. The support focuses on understanding your required level, closing gaps and preparing evidence, while the assessment itself stays independent.

Why Primes Now Choose Suppliers by Cybersecurity Posture