Securing CUI Across Sub-Tier Suppliers: What Primes Must Do

When Your Tier 2 Supplier Mishandles CUI, Is the Prime Contractor Liable?

A prime contractor passes its CMMC Level 2 assessment. Assessors verify encryption at rest and in transit, access controls, audit logs, incident response procedures — the full 110-control picture. The assessment closes, the certificate is issued, and a week later a program manager emails ITAR technical drawings to a Tier 2 precision machining shop using a shared network drive and a personal Gmail account.

The question is not whether the machining shop will be audited. The question is what happens to the prime when the drawings surface somewhere they shouldn't. Under DFARS clause 252.204-7012, the answer is unambiguous: the prime is responsible for ensuring that all covered defense information flowing through its supply chain is handled in accordance with NIST SP 800-171. That obligation does not pause at the edge of the prime's network. It travels with the file.

Why Does a Prime's CMMC Certification Not Cover Sub-Tier Suppliers?

CMMC assesses a defined organizational boundary. When a prime contractor earns a CMMC Level 2 certification, it demonstrates that the people, processes, and technology within that boundary meet NIST SP 800-171 requirements. Sub-tier suppliers are not inside that boundary. They have their own networks, their own IT teams, their own security postures, and the prime has no legal authority to mandate controls on a separate legal entity unless the contract explicitly requires it.

This creates a structural gap. NIST SP 800-171 control AC.1.001 requires that access to CUI be limited to authorized users and processes. "Authorized" in this context means defined and enforced by the data owner, which is the prime. Trusting a Tier 2 supplier's IT team to enforce the prime's authorization policy is not a control. It is an assumption — and in a regulatory environment where the prime bears the liability, assumptions are audit findings waiting to happen.

CMMC 2.0 Phase 4, with enforcement ramping through 2026 and 2027, will extend formal requirements further down the supply chain tier structure. That ramp does not reduce prime liability in the interim. It increases scrutiny on whether primes have taken reasonable steps to govern the CUI they distribute.

What Does the DFARS Flowdown Actually Require at the Sub-Tier Level?

DFARS 252.204-7012 includes an explicit flowdown provision. Primes must include the clause in all subcontracts where subcontractors will process, store, or transmit covered defense information — which, in a manufacturing supply chain, means essentially every precision machining shop, materials supplier, or testing lab that receives technical data packages.

The clause requires those subcontractors to implement adequate security measures equivalent to the NIST SP 800-171 standard. But requiring something contractually and verifying it technically are different problems. Primes can write the clause into every subcontract. They cannot audit every Tier 2 and Tier 3 supplier's infrastructure on a recurring basis. And they cannot force a 12-person machine shop in the Midwest to stand up a compliant IT environment before Monday's shipment.

Per Ponemon and IBM research, third-party supply chain breaches cost organizations an average of $4.29 million and take materially longer to detect than breaches originating inside the enterprise. The longer detection window matters in a defense context: by the time a CUI exposure is discovered, the data has often moved through multiple hands.

What Controls Actually Fail When CUI Crosses Organizational Boundaries?

The instinct among compliance teams is to reach for perimeter controls: VPNs, managed-device policies, secure file transfer portals. These work well inside a single organizational boundary. At the edge of that boundary, they break.

The common failure mode across all four controls is the same: they protect the infrastructure, not the file. When the file leaves the infrastructure, the protection stops. A Tier 2 supplier receiving a technical drawing download has a plaintext file on a local drive that no prime administrator can touch.

Why Is File-Level Encryption the Only Control That Works Across Boundaries You Don't Own?

The logic follows directly from the problem. If the failure point is that protection stops at the file download, the only control that survives the download is one that lives inside the file itself.

File-level encryption that persists after download means the file arrives at the machining shop's environment still encrypted, still requiring authenticated access to open, and still governed by the access policy the prime defined before transmission. The supplier's IT infrastructure is irrelevant. The file does not decrypt because it landed on a compliant endpoint. It decrypts because the person attempting to open it is authenticated and authorized under a policy the prime controls.

This is what ITAR compliant file sharing looks like: not a portal the supplier must log into, but a file that enforces the prime's policy regardless of where it resides.

Theodosian applies per-file FIPS 140-3 AES-256 encryption with a unique key per file. Every file that leaves a prime's environment carries its own cryptographic identity. Access requires authentication through Theodosian's patent-pending zero-knowledge architecture, where even Theodosian itself cannot read customer data. The prime's administrator sees a centralized audit log of every access attempt — who opened the file, from what device, from what geography, and when.

Context-aware access controls let the prime restrict access by organization, device type, or geography before transmission. If the machining shop's contract ends, Drop the Gate — Theodosian's autonomous access revocation capability — can terminate access to every file shared with that supplier from a single administrator action. The files are not deleted. They are cryptographically inaccessible. That distinction matters for audit trails.

Suppliers do not install software to receive protected files. The friction is on the access control side, where it belongs, not on the supplier's IT side, where enforcement is impossible.

How Should a Prime Contractor Structure Its Supply Chain CUI Policy Today?

The answer is not to audit every supplier. Primes do not have the resources, and suppliers do not have the patience. The answer is to make the data self-governing.

A mature supply chain CUI policy has three components. 

First, classify every file before it leaves the prime's environment. If the prime cannot tell which files contain CUI, it cannot protect them. 

Second, apply file-level encryption at the point of transmission — not at the portal, not at the VPN — so that protection travels with the file. 

Third, maintain centralized visibility into who accessed what, when, and from where, so that any anomaly can be investigated and any supplier relationship can be cleanly terminated without residual data risk.

That policy is achievable today. Theodosian deploys in days. Suppliers require no onboarding. The prime gains verifiable, auditable control over CUI from transmission to revocation.

FAQs: Sub-Tier CUI Governance & DFARS Flowdown