DFARS & CMMC Contract Checklist: Map Obligations Before You Score
Quick answer: Before you map 110 controls, map what your contracts actually require: safeguarding clauses, SPRS/reporting language, flow-downs, CUI handling expectations, and any assessment path language. Contract text and prime direction beat social-media CMMC headlines. This checklist is operational—not legal advice.
Key takeaways
- Pull clauses from awards, solicitations, and prime flow-downs—not from memory.
- Separate ‘safeguard CUI / 800-171’ from ‘obtain C3PAO certification by date X’.
- SPRS obligations can exist independent of certification theater.
- Document who is authorized to sign representations.
- When unclear, escalate to counsel and the prime—not a blog comment thread.
Why this comes before the 110
Ops teams that jump straight into controls often optimize for the wrong boundary or the wrong path (self-assessment vs certification theater). Contracts define the job.
Work with contracts/BD. Capture excerpts offline. Do not paste sensitive proposal text into public tools.
Document inventory
Collect and date:
- Active DoD / prime awards and mods
- Open solicitations you are bidding
- Flow-down packages from primes
- NDAs / data-handling exhibits
- Any prior SPRS submission records and who approved them
- MSP/cloud contracts that touch in-scope systems
Clause extraction table
| Field | Capture |
|---|---|
| Contract / solicitation ID | |
| Clause / section citation | e.g. DFARS reference as written |
| Obligation summary | Safeguard / report / assess / certify / flow-down |
| CUI / CDI mentioned? | Y/N + where defined |
| SPRS / score language? | Y/N + frequency |
| Assessment path language? | Self-assessment / C3PAO / other / unclear |
| Dates / milestones | |
| Flow-down required to subs? | Y/N |
| Who signed last representation | Name / role / date |
| Open questions for counsel/prime |
Questions ops must answer
- Do we process, store, or transmit CUI/CDI for this work?
- Are we required to implement NIST SP 800-171 (or equivalent)?
- Must we report a score in SPRS—and when? (SPRS 2026 guide)
- Is formal CMMC certification required for this opportunity, or is self-assessment the live posture? (self-assessment vs C3PAO)
- What did suspension change for this instrument—if anything? (suspension guide)
- Who is authorized to sign cyber representations?
If (1)–(3) are yes-ish, you need status mapping even if certification timing is fuzzy.
Flow-down reality
Primes may require more than the minimum you hoped for. Ops should:
- Track flow-down receipts
- Align sub obligations with your enclave (or exclude subs from CUI paths)
- Avoid promising primes a certification date you cannot control
Signature authority
Create an internal rule:
No SPRS or cyber representation without named approvers from Ops + Contracts (+ Counsel as required).
Use the sign-off checklist before approval.
Hand-off into technical work
| Contract answer | Technical next step |
|---|---|
| 800-171 / CUI applies | Status mapping |
| Score must be reported | Scoring guide + evidence rigor |
| Path unclear | Prime Q&A + counsel; do not invent maturity |
| Certification required later | Gap + remediation now; C3PAO is third party later |
| Only commercial / no CUI | Document why controls out of scope—do not fake a defense score |
DIY vs help
| Need | Path |
|---|---|
| Clarify posture fast | Free Defensibility Check |
| Rebuild honest score story | Workbook + Review |
| Full 110 gap | Gap Analysis |
Sources
Prefer primary text: DFARS, DoD CMMC program, SPRS, and our sources page. If this checklist and a primary source disagree, trust the primary source and your counsel.
Frequently asked questions
Does Phase II suspension mean our clauses are void?
Do not assume that. Suspension headlines do not automatically erase DFARS safeguarding, reporting, or flow-down duties. Read the instrument and ask counsel. See our suspension guide for operational framing.
We only have commercial work—do we care?
If you never touch covered defense information / CUI for DoD or primes, scope may differ. Confirm with contracts; many suppliers discover flow-downs late.
Is this legal advice?
No. It is a practical extraction checklist for ops and contracts collaboration.
What this page is / is not: readiness and advisory guidance only. Not legal advice, not a C3PAO assessment, and not a CMMC certification. CUI designation is driven by government requirements and contract language—not by this site. Prefer primary sources when policy text conflicts with any blog (including ours).