Supply Chain Risk Management (C-SCRM)

03.17SCRM family added in NIST SP 800-171 Rev. 3

800-161NIST C-SCRM practices (Rev. 1)

7021DFARS clause that flows CMMC to subcontractors

Who this is for

Primes and upper-tier subcontractors who must flow CMMC and DFARS 252.204-7012 requirements down, and verify them; manufacturers whose parts, software, or services come from hundreds of small suppliers; and any contractor preparing for the Supply Chain Risk Management family (03.17) as agencies move to NIST SP 800-171 Rev. 3.

What we deliver

Supplier inventory & tiering

Every supplier mapped to what it touches (FCI, CUI, export-controlled data, production systems) and tiered by criticality, so assessment effort goes where the risk is.

IN · AP vendor list, contracts, data flowsOUT · Tiered supplier register

Flowdown management

Clause-by-clause flowdown for DFARS 252.204-7012, -7020, and -7021 with the CMMC level each subcontract requires, tracked to acknowledgement.

IN · Prime contracts, subcontract templatesOUT · Flowdown matrix and supplier letters

Supplier assessment

Right-sized assessments by tier: SPRS and CMMC status verification for CUI suppliers, evidence-backed questionnaires for critical ones, and remediation tracking.

IN · Tiered registerOUT · Assessment results and risk acceptances

Prohibited-source screening

Screening against Section 889 (FAR 52.204-25), the Kaspersky prohibition (FAR 52.204-23), and FASCSA exclusion orders (FAR 52.204-30), with a repeatable process for new suppliers.

IN · Supplier and product listsOUT · Screening records and procedure

Software supply chain

Software inventory, SBOM expectations for critical software, and secure-development attestations aligned to the NIST SSDF (SP 800-218) where you build or buy software.

IN · Software inventoryOUT · SBOM and attestation requirements

C-SCRM plan

A supply chain risk management plan and policy aligned to NIST SP 800-161 Rev. 1, written to satisfy 800-171 Rev. 3 requirements 03.17.01 through 03.17.03.

IN · Everything aboveOUT · C-SCRM plan, policy, and SSP updates

Where supply chain obligations come from

Source	What it requires	What we build
DFARS 252.204-7021 / 32 CFR Part 170	CMMC level flowed to subcontractors handling FCI or CUI	Flowdown matrix with required level per subcontract
DFARS 252.204-7012	Safeguarding and incident reporting flowed to subs with covered defense information	Clause tracking and supplier incident contacts
NIST SP 800-171 Rev. 3 (03.17)	SCRM plan, acquisition strategies, supply chain requirements	C-SCRM plan and SSP sections
FAR 52.204-25, -23, -30	Prohibited telecom and video equipment, Kaspersky, FASCSA orders	Screening procedure and records
NIST SP 800-161 Rev. 1	Enterprise C-SCRM practices (guidance)	Program structure and maturity targets

Why this matters now: a subcontractor without the CMMC level its work requires cannot be awarded that work. Knowing your suppliers' status before a proposal is due is cheaper than finding out during one.

How an engagement runs

Map (2–3 weeks): build the supplier register from AP, contracts, and data flows; tier by what each supplier touches.
Flow down (2 weeks): clause matrix, CMMC level per subcontract, supplier notification letters.
Assess (ongoing by tier): verify SPRS and CMMC status for CUI suppliers, run evidence-backed assessments for critical ones.
Operate: new-supplier intake, prohibited-source screening, and quarterly re-verification as part of Managed Compliance.

Questions contractors ask us

Do we have to verify our subcontractors' CMMC status?

When a subcontract involves FCI or CUI, the CMMC requirement flows down at the level the work requires, and a subcontractor without that status cannot perform it. Primes need a reliable way to know each supplier's status and currency; that is the register and verification process we build.

What does NIST SP 800-171 Rev. 3 add for supply chain?

Rev. 3 adds a Supply Chain Risk Management family (03.17) covering an SCRM plan, acquisition strategies, tools and methods, and supply chain requirements and processes. Rev. 2 had no equivalent family, so most programs have nothing written for it yet.

Is NIST SP 800-161 required?

SP 800-161 Rev. 1 is guidance for building a cyber supply chain risk management program. It is not a contract clause on its own, but it is the most complete reference for the practices that Rev. 3 and agency requirements expect, so we use it to structure the program.

How deep into our supply chain do we go?

As deep as the data goes. Tiering by what each supplier touches keeps the effort proportional: a supplier handling CUI gets verification and evidence; a supplier of office goods gets screening and nothing more.

Map your suppliers

Know which suppliers can carry your CUI.

Tell us roughly how many suppliers you have and which ones handle FCI or CUI, and we'll scope the register and flowdown work. Or email rj@indirectit.com directly.