Subcontractor says CUI, prime says FCI only: which rules apply
The subcontractor declared one kind of information for this work and your own determination says another. Which rules apply turns on whether the subcontractor will process, store or transmit FCI only or CUI (32 CFR 170.23(a)); where your determination is recorded, the register reads the line by it.
What the register reads
a questionA question for the subcontracts lead: which information will this subcontract flow down, and has the subcontractor been told?
The rule sentences behind it
3 cited32 CFR 170.23(a)(1)codified text, eCFR current to 24 Sep 2026If a subcontractor will only process, store, or transmit FCI (and not CUI) in performance of the subcontract, then a CMMC Status of Level 1 (Self) is required for the subcontractor.
32 CFR 170.23(a)(2)codified text, eCFR current to 24 Sep 2026If a subcontractor will process, store, or transmit CUI in performance of the subcontract, then a CMMC Status of Level 2 (Self) is the minimum requirement for the subcontractor.
DFARS 252.204-7012(m)(1)codified text, eCFR current to 24 Sep 2026Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties.
A line that raises it
inventedSummit Calibration Lab | 5SC10 | SCL5SC1001 | calibration records | | 110 | 2025-11-04 | Level 2 (Self) | final | 2025-11-04 | 2025-11-04 | president | CUI | FCI only