What Do Prime Contractors Expect from Their Supply Chain?

Defense subcontractors are entering a new era of accountability. Prime contractors, long tasked with delivering cutting-edge capabilities to the U.S. Department of Defense (DoD), are now shifting serious attention downstream—into the thousands of subcontractors and suppliers that make their missions possible.

During a recent executive panel at CS2 Reston, leaders from BlueHalo, Tutor Perini, and Marvin Group pulled back the curtain on what prime contractors actually expect from their supply chains—especially as Cybersecurity Maturity Model Certification (CMMC) becomes contractually enforceable.

Here’s what every supplier, subcontractor, and mid-tier manufacturer needs to understand, internalize, and act on—immediately.

1. CMMC Level 2 Compliance Will Be a Hard Requirement

While the rulemaking clock ticks, one point is already non-negotiable: If you handle Controlled Unclassified Information (CUI), you will need CMMC Level 2.

Matt Ramsey, CIO of BlueHalo, made it crystal clear:

“We’re hearing from the DoD that self-attestation is no longer sufficient. Third-party assessments will be embedded in procurements. If you're not already in the pipeline for certification, you're at serious risk of being dropped.” 

This isn’t theoretical. It's operational. Even today, primes are pushing their suppliers to disclose:

• Whether they’ve scheduled a CMMC assessment
• If they’ve engaged with a C3PAO
• Their current NIST SP 800-171 implementation status
• Their SPRS score—and whether it’s accurate

John Kronick of Tutor Perini emphasized that education is not enough anymore. “The knowledge gap and the certification gap must be closed if you want to be part of our future programs,” he said.

2. Self-Certification Is on Life Support

Many primes are still accepting supplier self-attestations for DFARS 252.204-7012 and NIST 800-171—but not for long. The panelists confirmed a clear internal push toward verification.

Matt Reynolds, CIO of The Marvin Group admitted:

“Right now, we're trusting without verifying. But that won’t continue. We’re building toward a requirement for validated certification evidence.”

Ramsey added that flow downs alone are no longer sufficient. New subcontract language must establish:

• Explicit CMMC requirements
• Proof of certification (not promises)
• Accountability for second and third-tier suppliers

Kronick confirmed that Tutor Perini already includes contractual language requiring their subs to vouch for downstream compliance—an increasingly common best practice.

3. If You're Not Ready, You May Be Replaced

All three panelists acknowledged a stark truth: the majority of their suppliers are not ready.

Reynolds shared that only a fraction of Marvin Engineering’s 350 surveyed suppliers had implemented all NIST 800-171 controls—and most were likely overestimating their readiness.

Kronick estimated that up to 90% of his supply base is at risk if CMMC were enforced today, especially in environments like Guam where local sourcing is required. “If you can't isolate CUI or decouple it from those suppliers, you're forced to replace them—or vertically integrate.”

That’s not speculation. Tutor Perini has already created wholly owned companies to reduce exposure in HVAC, rebar, and electrical systems.

4. Suppliers Must Be Transparent—and Fast

Here's what primes are starting to demand from their suppliers:

• Specific CMMC assessment dates
• Identification of chosen C3PAOs
• Certification level being pursued
• Clarification on where and how CUI will be handled

Ramsey noted:

“If you don’t have a date or plan, you’re not ready. And if you’re not ready, you may not stay in our supplier network.” 

At Marvin, they’ve begun surveying suppliers and will now pivot to requesting concrete evidence of readiness.

5. The Risk Isn’t Just Compliance—It’s Capability Loss

This isn’t just a policy exercise. It’s a mission risk.

The panelists spoke candidly about potential disruptions to project delivery if critical suppliers drop out or fail to meet compliance expectations. In construction, for instance, certain suppliers in remote areas may be the only local option—and retraining or replacing them is costly and time-consuming.

In response, primes are:

• Sanitizing technical data packages to limit CUI exposure
• Providing controlled enclaves and issued laptops to key subs
• Limiting BYOD access to align with Level 2 controls
• Isolating subs who receive CUI from those who don’t

6. Compliance Readiness Is Becoming a Bid Discriminator

Multiple panelists shared stories of new business opportunities materializing specifically because they were already CMMC-ready.

“One prime came to us and was thrilled we were certified. They said it made our inclusion in their bid a no-brainer,” said Reynolds.

While many companies see CMMC as a regulatory burden, forward-looking primes are treating CMMC as competitive edge.

Don’t be surprised to see CMMC readiness become:

• A required checkbox during teaming and capture
• A tiebreaker in award decisions
• A key differentiator in sole-source negotiations

7. Your Entire Supply Chain Is Your Responsibility

Every panelist affirmed what the DoD has made clear: Primes are responsible for all tiers of their supply chain. That includes subcontractors of subcontractors.

As Ramsey explained:

“You need to include mandatory language that downstream suppliers must flow down CMMC requirements—and provide proof of compliance all the way back up.”

It’s no longer acceptable for a Tier 1 to say, “We didn’t know.” Your suppliers’ gaps are your risks.

The Bottom Line: Adapt or Exit the Defense Ecosystem

If your company is anywhere in the defense supply chain—Tier 1 through Tier 5—the expectations from prime contractors are clear:

1. Get certified. Self-attestation is being phased out.
2. Be transparent. Vague timelines and lip service won’t cut it.
3. Prepare for proof. Contracts are starting to require real evidence.
4. Know your CUI exposure. You can't protect what you can't identify.
5. Educate your team. Business development, contracts, and operations all need to understand what’s at stake.

What do prime contractors expect from their supply chain? They expect proactive cybersecurity, verifiable compliance, and strategic readiness—and they’re done waiting.

Next Steps for Suppliers:  

• Begin your NIST 800-171 gap assessment now.
• Engage a C3PAO before 2025 capacity disappears.
• Identify where CUI enters your workflows—and who handles it.
• Collaborate with your primes. Silence signals unreadiness.

Summit 7 is here to guide you every step of the way. From your first gap assessment to full CMMC certification readiness, our expert team ensures you're not just checking boxes—you’re building a resilient, compliant future.

Start your CMMC assessment with confidence.