Subcontractors
Subcontractors/Suppliers have multiple requirements to fulfill. When specified requirements are included in their Purchase Order or in the general terms and conditions provided by their customer general the Prime, they must fulfill those requirements.
If the Prime flows down requirements for Federal Contract Information (FCI) FAR 52.204-21 then the subcontractor or supplier must comply with those requirements. The same is true when a subcontractor receives or handles information designed as CUI, JCP and/or ITAR. It is up to the Prime contractor to vet its subcontractors and suppliers to ensure that they are eligible to receive the type of information to be shared.
Subcontractors/suppliers also must handle and share information with their subcontractors and suppliers in a manner similar to the procedures used by its Prime. At a minimum, information identified as either FCI, CUI, JCP and/or ITAR requires that all companies which will receive and/or handle this information are eligible to received it. Consequently, any business in the supply chain and which will receive/handle any of this information must meet the prerequisites. Additionally, a subcontractor at the fourth or seventh tier that needs to utilize the services of another downstream contractor must determine that contractors eligibility to receive the information and include it its Purchase Order the appropriate marking, and flowdown requirements.
The following is partial copy from DFARS 252.204-7012. It provides an example of language in a contract clause that requires the requirements and the clause to be flowed-down to next tier companies if a needs exists.
Subcontracts. The Contractor shall—
1 – Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and
There are many important qualifiers in this statement.
1 – “Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments” – This language is the language that informs all recipients to include the entire clause. This would include all language beginning with the DFARS number and title through the statement – (end of clause).
2 – The language “including this paragraph (m), in subcontracts, or similar contractual instruments” informs the recipient of the requirement that they must also flow down (include the entire clause) in any purchase order to any of their subcontractors or suppliers.
3 – Lastly, there is an exception to requirement to flow down the clause. The exception is stated in the second sentence. “The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer …,” DoD’s intent is to protect the information that legitimately requires protection but not to place regulatory burdens on businesses when not required.