Your Prime Sent You a Cybersecurity Questionnaire. Now What?

For most small defense subcontractors, CMMC doesn’t arrive through a regulation. It arrives as an email from a prime contractor with a spreadsheet attached and a date by which you’re expected to return it.

If that just happened to you, here’s how to handle it without panicking and without over-committing.

First: don’t answer it yet

The instinct is to fill in the form and send it back quickly, because the prime is a customer and you want to look responsive. Resist that for a day or two.

A cybersecurity questionnaire is a record. What you write becomes something the prime relies on, may flow into their own compliance position, and can be pointed at later. Answering “yes” to something you haven’t actually verified is a worse outcome than answering a week late.

Step 1: Work out what information you actually handle

Everything downstream depends on this, and most people guess.

Federal Contract Information (FCI) is non-public information provided by or generated for the government under a contract — purchase orders, delivery schedules, contract numbers, the working paperwork of the job. If you do defense work at all, you almost certainly handle FCI.

Controlled Unclassified Information (CUI) is a defined category of more sensitive information, usually marked as such, often technical data. CUI is what triggers the heavier requirements.

Go and look at actual contracts and actual files. Check for markings. Check whether any drawings or specifications came with distribution statements. Don’t rely on what you assume — FCI vs. CUI walks through how to tell them apart.

Step 2: Work out your level

If you handle FCI only, you’re looking at Level 1 — 15 requirements, self-assessed.

If you handle CUI, you’re looking at Level 2 — 110 requirements, and a substantially bigger undertaking.

Most small subcontractors are Level 1. Getting this right early matters, because answering a questionnaire as though you’re Level 2 when you aren’t commits you to work you don’t need to do, and the reverse understates your obligations.

Step 3: Read what the questionnaire is actually asking

Prime questionnaires vary enormously in quality. Some are a clean restatement of the 15 Level 1 requirements. Others are a generic security questionnaire bought off the shelf, asking about penetration testing and security operations centres that have nothing to do with your obligations.

You’re entitled to notice the difference. If a question asks about something outside the requirements that apply to you, it’s reasonable to answer accurately — “we don’t do this; it isn’t required at Level 1” — rather than treating every line as a demand.

Step 4: Assess yourself before you answer

Work through the 15 requirements against how your business actually operates. This is the real work, and it’s smaller than it sounds — most of the 15 are things like “does each person have their own login” and “do you wipe computers before you dispose of them.”

You’ll usually find a handful of gaps, and most of them are configuration changes rather than purchases.

Then answer the questionnaire from what you found. Not from what you intend to do, and not from what you think they want to hear.

Step 5: Say what’s true, including the awkward parts

If you have a gap, you have three honest options: fix it before you reply, disclose it with a date by which you’ll fix it, or disclose it plainly.

What you should not do is mark it compliant. If the prime relies on your answer and it turns out to be wrong, you’ve created a problem considerably larger than the gap was. At Level 1 there’s no partial credit mechanism — see you answered “no” to a requirement for what to do with gaps.

Primes generally respond better to “not yet, here’s when” than they do to a clean sheet that unravels later.

What the prime can and can’t require

Flow-down is real. Primes are expected to pass requirements down to subcontractors and to obtain assurance about compliance, so being asked is normal and not a sign of suspicion.

What a prime can’t do is invent requirements that don’t apply to you and present them as CMMC. If you’re told you need a specific product, a government cloud tenant, or a third-party audit for Level 1 work, that’s worth questioning. None of those are Level 1 requirements.

The bottom line

Slow down, establish what information you actually handle, assess yourself honestly against the 15 requirements, then answer from what you found.

The questionnaire is not the obligation — the underlying requirements are. Answer those properly and the questionnaire becomes straightforward. Start with where to actually start.