FAR Clauses for Subcontractors: Flow-Downs, CMMC, and Miller Act

If you’re taking work as a subcontractor on a federal contract, the prime is required to pass certain Federal Acquisition Regulation clauses into your subcontract, and those FAR flow-down clauses for subcontractors are what bind you to the same ethics, labor, cybersecurity, and reporting rules the government imposes on the prime. FAR 52.244-6 sets the mandatory list for commercial products and services, and other clauses attach based on dollar value, contract type, or the kind of information and property you handle. Several of the dollar thresholds moved upward on October 1, 2025, so a clause that applied to your last subcontract may not apply to the next one at the same price.

Why the Prime Has to Flow Clauses Down to You

The government contracts with the prime, not with you. That legal relationship, called privity of contract, exists only between the government and the prime contractor. Flow-down is how the prime transfers its government-imposed obligations into your subcontract so you’re bound by them. The prime remains answerable to the government for what you do, which is why primes push hard on flow-down and push back when subcontractors try to strike clauses.

Each FAR clause carries its own flow-down instructions inside its text. Some say the prime “shall include the substance of this clause” in all subcontracts. Others apply only above a dollar threshold or only to specific types of work. Reading the flow-down paragraph of each clause is the only reliable way to know what actually applies to your subcontract.

Mandatory Clauses Versus Permissive Ones

FAR 52.244-6 is the master list of clauses that must be flowed into subcontracts for commercial products and commercial services. The prime “shall insert” these, covering ethics, equal opportunity, cybersecurity, small business utilization, trafficking, and several technology prohibitions.¹ Beyond that list, the prime may add “a minimal number of additional clauses necessary to satisfy its contractual obligations.” Anything in that permissive category is where you have room to negotiate, especially when the clause has nothing to do with your scope or would force you to build compliance infrastructure the subcontract value doesn’t justify.

The Ethics and Labor Clauses That Reach Almost Every Subcontract

Equal Opportunity

FAR 52.222-26 prohibits employment discrimination based on race, color, religion, sex, sexual orientation, gender identity, or national origin, implementing Executive Order 11246. It applies once a contractor or subcontractor has received $10,000 or more in aggregate federal contracts or subcontracts in a twelve-month period.² In practice, nearly every federal subcontract carries it.

Small Business Utilization

FAR 52.219-8 requires contractors to give small businesses the maximum practicable opportunity to participate as subcontractors.³ It flows down when your subcontract offers further subcontracting opportunities. If your subcontract crosses the subcontracting plan threshold, you also have to develop your own Small Business Subcontracting Plan. Effective October 1, 2025, that threshold rose from $750,000 to $900,000 for supplies and services, and from $1.5 million to $2 million for construction.⁴

Anti-Kickback Procedures

FAR 52.203-7 prohibits providing or accepting anything of value to improperly obtain or reward favorable treatment in a subcontract, and flows to subcontracts above the threshold in FAR 3.502-2(i).⁵ The threshold moved from $150,000 to $200,000 on October 1, 2025.⁴

Combating Trafficking in Persons

FAR 52.222-50 flows into every subcontract and agent contract at every tier and every dollar value. It prohibits destroying identity documents, using misleading recruitment, and charging employees recruitment fees. Where the subcontract involves supplies acquired or services performed outside the United States and the estimated value exceeds $700,000, you also need a compliance plan covering employee awareness, confidential reporting, a recruitment and wage plan that bars charging workers recruitment fees, and housing standards if you provide housing.⁶

Clauses That Attach Based on Dollar Value or Contract Type

Contractor Code of Business Ethics and Conduct

FAR 52.203-13 requires a written code of ethics, an internal control system to detect violations, and timely disclosure of criminal conduct or civil fraud to the agency’s Inspector General. It flows to subcontracts that exceed the threshold in FAR 3.1004(a) with a performance period longer than 120 days.⁷ As of October 1, 2025, that threshold rose from $6 million to $7.5 million.⁴

Certified Cost or Pricing Data

On cost-type and negotiated procurements, FAR 52.215-12 requires the prime to obtain certified cost or pricing data from you before award when the subcontract exceeds the threshold in FAR 15.403-4(a)(1). For subcontracts awarded on or after July 1, 2018, that threshold is $2.5 million.⁸ You have to provide detailed financial data sufficient to verify your pricing, including the methods and assumptions behind your estimates. Exceptions apply where there is adequate price competition, established catalog pricing, or a contracting officer waiver.⁹

Cost Accounting Standards

On CAS-covered contracts, you have to follow Cost Accounting Standards for how you allocate, accumulate, and report costs. Subcontractors under modified CAS coverage on negotiated subcontracts over $2.5 million but under $50 million may need to submit a Disclosure Statement describing actual accounting practices. Any inconsistency between what you disclose and what you actually do can trigger cost adjustments.

Service Contract Labor Standards

If your subcontract involves services covered by the Service Contract Labor Standards statute (formerly the Service Contract Act), FAR 52.222-41 requires you to pay at least the minimum wages and fringe benefits in the applicable Department of Labor wage determination.¹⁰ A missing clause doesn’t erase the obligation; it just creates a gap that surfaces during audit.

Cybersecurity Flow-Downs

Basic Safeguarding of Federal Contract Information

FAR 52.204-21 applies to any subcontract (other than for commercially available off-the-shelf items) where you may have federal contract information on your systems. The clause requires fifteen specific security controls: limiting system access to authorized users, authenticating identities, protecting communications at network boundaries, scanning for malicious code, sanitizing storage media before disposal or reuse, and others. The substance of the clause has to flow to subcontractors at all tiers.¹¹

CMMC for Defense Subcontracts

On Department of Defense work, the Cybersecurity Maturity Model Certification program adds requirements on top of FAR 52.204-21. Phased implementation began November 10, 2025. Phase 1 runs through November 9, 2026, and focuses primarily on Level 1 and Level 2 self-assessments, though DoD may require third-party assessments in some Phase 1 procurements.¹²

Level 1 is an annual self-assessment against the fifteen controls in FAR 52.204-21 and applies to subcontractors handling only Federal Contract Information. Level 2 applies where you store, process, or transmit Controlled Unclassified Information (CUI); it requires compliance with the 110 security requirements in NIST SP 800-171 Revision 2, verified through self-assessment or independent assessment by a certified third-party organization every three years. Level 3, for the most sensitive CUI, adds 24 enhanced requirements from NIST SP 800-172 and requires assessment by the Defense Contract Management Agency.¹² These requirements flow through every tier. A second-tier subcontractor handling CUI carries the same Level 2 obligations as the prime.

Property, Inspection, and Records

Government Property

If you hold government-owned property, FAR 52.245-1 requires a system to manage, track, and report on it, whether the property is raw material provided for manufacturing or specialized test equipment. You have to meet the property management standards in FAR Part 45 and you are financially accountable for loss, damage, or destruction.¹³

Inspection and Acceptance

The FAR 52.246 series gives both the prime and the government the right to inspect work at any stage and any location. For supply contracts, FAR 52.246-2 sets the inspection framework; for services, FAR 52.246-4 covers similar ground.¹⁴ Rejection of nonconforming work puts rework or replacement cost on you.

Record Retention and Audit Access

You have to keep financial and performance records for at least three years after final payment on the contract. FAR Subpart 4.7 explicitly defines “contracts” and “contractors” in the retention rules to include subcontracts and subcontractors.¹⁵ Individual clauses can impose longer retention periods. During the retention window, government auditors and the Comptroller General can demand access to your books, accounting procedures, and supporting documentation. Destroying records early is one of the fastest ways to turn a routine audit into an enforcement action.

What You Owe Your Own Lower-Tier Subcontractors

Flow-down doesn’t stop at the first tier. When you hire your own subcontractors, many FAR clauses require further flow-down. FAR 52.219-8 has to appear in lower-tier subcontracts that offer further subcontracting opportunities when the subcontract exceeds the applicable threshold.¹ FAR 52.204-21 requires the substance of the cybersecurity clause at every tier where federal contract information may reside.¹¹ FAR 52.222-50 requires anti-trafficking provisions at every tier and every dollar value.⁶ Identify which clauses in your subcontract require further flow-down, insert them in your purchase orders, and confirm your vendors understand what they signed on to. Primes increasingly audit their subcontractors’ purchasing systems for exactly this gap.

What Happens If You Get It Wrong

Debarment and Suspension

The government can debar or suspend a subcontractor for a pattern of non-compliance, fraud, or other conduct indicating a lack of business integrity. Once you’re listed in the System for Award Management (SAM), federal contracts and most subcontracts are closed to you. Contractors are barred from entering into any subcontract over $45,000 (other than for commercially available off-the-shelf items) with a party that has an active SAM exclusion, unless there is a compelling reason approved at the agency-head level.¹⁶

False Claims Liability

Even without privity, subcontractors are directly exposed under the False Claims Act. If you knowingly submit false cost data, inflated invoices, or certifications you know to be inaccurate, and that information moves up through the prime into a claim for payment, you can be independently liable. Penalties include treble damages and per-claim civil penalties that adjust for inflation annually. The government doesn’t have to prove you submitted the claim yourself; causing a false claim to be submitted is enough.

Indemnification Back to the Prime

Most primes include indemnification provisions that shift financial liability for FAR violations back to the subcontractor. If your non-compliance triggers an audit finding, cost disallowance, or termination, the prime will seek to recover its losses from you. Courts generally enforce these clauses.

If the Prime Doesn’t Pay You: The Miller Act

On federal construction, alteration, or repair contracts exceeding $100,000, the Miller Act requires the prime to furnish a payment bond securing payment to those who supply labor or materials. First-tier subcontractors and suppliers may sue directly on the bond for the unpaid amount.¹⁷

Second-tier subcontractors and their suppliers can also sue on the bond, but they have to give the prime written notice within 90 days from the date they last performed labor or supplied materials. Any Miller Act claim must be filed within one year of the date the claimant last furnished labor or material, in the U.S. District Court where the contract was performed. Miss the deadline and the claim is gone.¹⁷

Working Through the Subcontract in Practice

Read the subcontract terms and conditions line by line. Some FAR clauses will be quoted in full; others are incorporated by reference, meaning only the clause number and title appear and you have to look up the actual language on acquisition.gov. Watch the dollar thresholds and conditional applicability notes. A clause that applies only above $900,000 doesn’t touch a $400,000 subcontract.

Sort the mandatory clauses from the permissive ones. Everything listed in FAR 52.244-6(c)(1) is non-negotiable for commercial subcontracts.¹ For non-commercial subcontracts, the flow-down paragraph of each individual clause controls. Anything the prime added under the permissive “minimal number of additional clauses” authority is a candidate for negotiation, particularly where the clause is unrelated to your scope.

Compliance work is cross-functional once you know the applicable list. HR handles equal opportunity policies. Accounting handles government cost reporting and, where applicable, Cost Accounting Standards. IT has to meet FAR 52.204-21 at minimum, and NIST 800-171 if CUI is involved. Property management tracks any government-furnished equipment. None of it is one and done: expect annual certifications, ongoing monitoring, and audit readiness across the three-year post-payment retention window.

One legal point worth carrying with you. Courts have held that a mandatory government contract clause required by regulation may be read into a contract by operation of law even when it was physically omitted from the contract text. This principle, known as the Christian doctrine, has been applied primarily to prime contracts, and its extension to subcontracts remains legally unsettled. Don’t treat a missing clause as a missing obligation. When you’re unsure whether a clause should have been included, raise it with the prime before performance begins, not after.

1
Acquisition.GOV. FAR 52.244-6 Subcontracts for Commercial Products and Commercial Services
2
eCFR. 48 CFR 52.222-26 – Equal Opportunity
3
eCFR. 48 CFR 52.219-8 – Utilization of Small Business Concerns
4
Federal Register. Federal Acquisition Regulation Inflation Adjustment of Acquisition-Related Thresholds
5
eCFR. 48 CFR 52.203-7 – Anti-Kickback Procedures
6
Acquisition.GOV. FAR 52.222-50 Combating Trafficking in Persons
7
Acquisition.GOV. FAR 52.203-13 Contractor Code of Business Ethics and Conduct
8
Acquisition.GOV. FAR 15.403-4 Requiring Certified Cost or Pricing Data
9
Acquisition.GOV. FAR 52.215-12 Subcontractor Certified Cost or Pricing Data
10
eCFR. 48 CFR 52.222-41 – Service Contract Labor Standards
11
Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
12
Department of Defense CIO. About CMMC
13
eCFR. 48 CFR 52.245-1 – Government Property
14
eCFR. 48 CFR 52.246-2 – Inspection of Supplies – Fixed-Price
15
Acquisition.GOV. Subpart 4.7 – Contractor Records Retention
16
Acquisition.GOV. Subpart 9.4 – Debarment, Suspension, and Ineligibility
17
U.S. General Services Administration. The Miller Act