Flow-down safeguarding requirements to subcontractors: what does it entail?

• A. The prime contract requires subcontractors to follow the same CUI safeguarding requirements.
• B. The subcontractors can handle CUI however they want.
• C. Flow-down applies only to DoD prime contractor's own staff.
• D. Flow-down means the subcontractor becomes the data owner.

Answer: (A)

Flow-down safeguarding requirements means that the protections the prime contract imposes on CUI must be applied by any subcontractors that handle or access that information. In practice, this means subcontractors are required to implement the same safeguards—such as proper marking and handling of CUI, access controls restricting who can view or modify it, secure storage and transmission methods, and a defined incident reporting and response process—so the level of protection is consistent across the entire supply chain. These obligations are usually codified in contract clauses so the prime is responsible for ensuring that every subaward containing CUI includes equivalent safeguarding requirements. It doesn’t transfer ownership of the data to the subcontractor, and it isn’t limited to the prime’s own staff; anyone who handles CUI through the contract must follow the same protections.