What typically arrives
A supplier questionnaire. A DFARS flow-down. A representation about CMMC status. A request for your SPRS score. A question about CUI handling. Incident-reporting language. A demand for supporting policy and evidence. Sometimes all at once.
What a questionnaire is checking
The prime wants to know whether someone owns the problem, whether you know where FCI or CUI is handled, and whether you can back up your answers with current evidence. A confident yes with no boundary or evidence behind it signals unmanaged risk.
What a flow-down clause changes
A flow-down clause can carry safeguarding and reporting obligations into the subcontract. The exact effect depends on the clause, the information exchanged, and the rules in force at the time of award. Contract review should be connected to technical reality — not sitting in legal while IT waits.
What an SPRS request is checking
The prime wants to know whether you have assessed your NIST SP 800-171 posture under the applicable methodology and recorded the result. The score should be current and traceable to evidence, not to a spreadsheet from two years ago.
What a weak answer signals
Conflicting answers, unsupported claims, stale policy, and uncertainty about where CUI actually goes. To a prime evaluating supply-chain risk, that is the sound of a problem they do not want to inherit.
What to establish before responding
Know the contract requirement. Know your information types. Know your boundary. Have current control evidence. Know who is accountable. Know your remediation status. Then answer.
Frequently asked questions
Should we answer a questionnaire before confirming scope?
Avoid unsupported answers. Confirm the contract, information flow, boundary, evidence, and responsible owner before making representations.
Does a prime contractor decide what is CUI?
The prime can convey government requirements and information markings, but status should be grounded in the contract, applicable authority, and direction from the government information owner.
Is an SPRS score the same as CMMC certification?
No. An SPRS score records an assessment result under the applicable methodology; it is not CMMC certification.