RELIABLE INTEGRATIONReliable Integration / Resources / Flow-Down Letters
How to read a flow-down letter
It arrived from a customer you have supplied for eleven years, it names a deadline, and it explains almost nothing. Here is what to check before you spend a dollar.
The short answer
Read it for four things: which CMMC level it names, whether it says self-assessment or certification, the date it demands, and — most important — whether you actually receive CUI or only Federal Contract Information.
That last question is the whole budget. FCI is Level 1, a self-assessment, and nothing like a CUI enclave project. A meaningful share of suppliers who receive these letters turn out to hold only FCI and never needed the expensive version.
Why you got this letter
Primes are not being difficult. They carry the obligation to flow requirements down their supply chain, and their own eligibility depends on it. Several are moving faster than the government's schedule, because a supplier who cannot meet the requirement when it lands is a supplier they have to replace — and replacing a qualified source takes longer than warning you now.
Read the letter as what it usually is: your customer trying to keep you.
The question that changes everything: FCI or CUI?
These are different categories with wildly different obligations, and letters routinely blur them.
| Category | What it means for you |
|---|---|
| FCI | Information provided by or generated for the government under a contract, not intended for public release. Purchase orders, delivery schedules, basic contract correspondence. Level 1: 15 basic safeguarding requirements, annual self-assessment, no POA&Ms allowed, results in SPRS. |
| CUI | Controlled Unclassified Information — technical drawings, specifications, controlled research, export-controlled data. Level 2: all 110 NIST SP 800-171 requirements, SPRS scoring, System Security Plan, POA&M, annual affirmation. |
If you make a part to a drawing the prime sent you, and that drawing is marked CUI, you have CUI. If you receive purchase orders and ship to a spec you developed yourself, you may well not. Do not assume either way, and do not let the prime's letter decide it for you.
Which clause is actually cited?
The DFARS clause referenced tells you more than the letter's prose does.
- 252.204-7012 — safeguarding covered defense information and cyber incident reporting. This one has been in contracts for years and includes a 72-hour incident reporting obligation to DoD.
- 252.204-7019 / -7020 — NIST SP 800-171 assessment requirements and the obligation to have a current score in SPRS.
- 252.204-7021 — the CMMC requirement itself.
If the letter cites no clause at all, that is worth asking about. Some flow-down letters are precautionary blanket mailings sent to an entire vendor list rather than a considered assessment of what you specifically receive.
What to ask your prime, in writing
Email, not a phone call. You want the answers on record, and the person who wrote the letter often has to go find out.
- Which specific CUI categories do you send us, if any?
- How is that data marked when it reaches us?
- Which contract or PO number carries the requirement?
- Which DFARS clauses are flowed down to us specifically?
- Is a self-assessment acceptable, or are you requiring third-party certification?
- What is the actual date, and is it your deadline or the government's?
That last one matters more than it looks. Prime deadlines and government phase dates are different things and are frequently conflated in these letters. Knowing which one you are facing changes how much runway you have.
Three things not to do
- Do not affirm anything you have not implemented. The SPRS affirmation is a representation to the federal government, and DoD has pursued False Claims Act cases over misrepresented 800-171 compliance. A low honest score beats a high false one, every time.
- Do not buy licensing first. Scope the boundary, then license it. Buying GCC High for the whole company before anyone has mapped where CUI actually goes is the most expensive mistake available in this process.
- Do not panic-hire the first firm that quotes $150,000. Get the FCI-versus-CUI question answered before you buy anything at all.
A sensible first month
- Week 1 — send the questions above to your prime. Meanwhile, walk your own business and list every place a government-supplied drawing or specification lands: email, the shared drive, the ERP, the engineer's desktop, the vendor you send files to.
- Week 2 — with the prime's answers, determine FCI or CUI. If FCI only, you are looking at 15 requirements and a self-assessment, and you can likely handle it in-house.
- Weeks 3–4 — if CUI, scope the enclave before choosing any platform. See the GCC High decision and what Level 2 requires.
Reply to your prime in the meantime. A supplier who answers within a week with "we are scoping this now, here is our timeline" is in a materially different position from one who goes quiet.
Common questions
What is the difference between FCI and CUI?
Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release, such as purchase orders and delivery schedules. It maps to CMMC Level 1: 15 basic safeguarding requirements and an annual self-assessment. Controlled Unclassified Information is more sensitive material such as technical drawings, specifications, and export-controlled data, and maps to CMMC Level 2: all 110 NIST SP 800-171 requirements, SPRS scoring, an SSP, a POA&M, and annual affirmation.
Does a flow-down letter from a prime mean I definitely need CMMC Level 2?
Not necessarily. Some flow-down letters are precautionary and sent to an entire vendor list rather than tailored to what a specific supplier receives. A meaningful share of recipients hold only Federal Contract Information, which is Level 1. Confirm in writing with the prime which CUI categories they send you and how that data is marked before assuming Level 2 applies.
What should I ask my prime contractor after receiving a CMMC letter?
Ask in writing: which specific CUI categories they send you, how that data is marked on receipt, which contract or purchase order carries the requirement, which DFARS clauses flow down to you specifically, whether a self-assessment is acceptable or third-party certification is required, and whether the stated deadline is the prime's own or the government's.
Which DFARS clauses relate to CMMC?
DFARS 252.204-7012 covers safeguarding covered defense information and includes a 72-hour cyber incident reporting obligation. DFARS 252.204-7019 and 252.204-7020 cover NIST SP 800-171 assessment requirements and maintaining a current score in SPRS. DFARS 252.204-7021 is the CMMC requirement itself. The clause cited in a flow-down letter tells you more about your actual obligation than the letter's narrative does.
What if I miss my prime's deadline?
Prime deadlines are contractual relationships rather than government enforcement dates, and the two are often conflated in flow-down letters. Clarify which you are facing. In most cases a supplier who responds promptly with a credible scope and timeline is in a far better position than one who goes silent, even if full implementation takes longer than the stated date.
Bring the letter to the call.
Twenty minutes to work out whether you have a CUI problem, an FCI problem, or no problem at all. If it is the third one, you will hear that and we will both get on with our day.
Book a 20-minute scoping call See pricingOr call 1-919-717-2707.