Yes — CMMC flows down the supply chain. If a prime passes you FCI, you need Level 1; if any CUI reaches you, you need Level 2. The requirement follows the data, not the company size, and primes are already dropping subs who cannot show progress.
What subs should do now
- Ask the prime, in writing, exactly what data classification you will receive
- If CUI: get an SPRS score submitted — primes check SPRS before awarding
- Consider an enclave so a 10-person shop is not hardening 100 endpoints
- Get the flow-down clauses (DFARS 252.204-7012/7019/7020/7021) reviewed before signing
Many of our international clients are subs to US primes — see CMMC for non-US contractors or start with the free SPRS calculator.