Live webinar · Free · 45 minutes

Webinar: CMMC Flow-Down for Subcontractors | palmiq For colleges, universities and public-sector entities performing DoD-funded work as a contractor or subcontractor

CMMC now shows up in real contract language, and it usually reaches an institution through a prime's flow-down questionnaire rather than a call from DoD. This session walks through the three things that gate an award — the correct CMMC level, a scored SPRS self-assessment, and the annual affirmation — and where the ownership gaps sit when IT, research administration and procurement report to different people.

• cmmc
• compliance

• Read the flow-down clause the way a prime reads itDFARS 252.204-7021 requires contractors to flow the correct CMMC level down to subcontractors at all tiers that will process, store or transmit FCI or CUI (or provide security protection for those systems), and to confirm the sub holds a current CMMC status before subcontract award (Summit 7; Fortreum).
• Know which two artifacts actually gate moneycontracting officers will not make award, exercise an option, or extend the period of performance if the offeror or contractor lacks passing results at the required level plus an affirmation of continuous compliance in SPRS (Pivot Point Security). Missing affirmation, same outcome as a failed assessment.
• Assign the Affirming Official before a prime asks who it is32 CFR 170.22 requires all affirmations in SPRS, submitted at completion of a Level 1 self-assessment and annually thereafter, with the Department verifying submission in SPRS (eCFR); the affirmation is also required upon achieving CMMC status and at POA&M closeout (Holland & Knight).
• Put the 60-day window on somebody's calendarDISA's Affirming Official tutorial states the record will require annual affirmations for three years, the Affirm button becomes available 60 days prior to the Affirmation Expiration Date, and the AO needs a PIEE account with the SPRS Cyber Vendor User role (DISA/SPRS).
• Shrink the assessment boundary before you spend on ita defined CUI enclave versus "the whole campus network is in scope," and how palmiq maps endpoint, backup and network controls to NIST 800-171 practices using Microsoft, Fortinet, Sophos, CrowdStrike, SentinelOne, Veeam and Acronis, with continuous monitoring so the annual affirmation has evidence behind it.