Understanding flow-down clauses in subcontracts

Flow-down clauses are contract provisions that a prime contractor is required (or chooses) to pass from their government contract into your subcontract. They impose federal compliance obligations on you — equal employment, cybersecurity, anti-trafficking, cost accounting, and more — even though your contract is with the prime, not the government. Some are mandatory by law. Others are discretionary, and primes add them to shift risk onto you.

If you’re new to subcontracting, this is the single most misunderstood part of the arrangement. Your subcontract might be 15 pages of scope and payment terms followed by 40 pages of FAR clauses you’ve never seen. Signing without understanding those clauses is how small businesses end up liable for compliance violations they didn’t know existed.

What flow-down clauses actually do

When the government awards a contract to a prime, that contract contains dozens of Federal Acquisition Regulation (FAR) clauses. Each clause imposes a specific obligation — how to handle government data, how to treat employees, what cybersecurity standards to meet, whether you can hire former government employees, and on and on.

Some of those obligations only make sense for the prime. But many apply to anyone touching the work, including subcontractors. The mechanism for extending those obligations to you is the flow-down clause. The prime includes the relevant FAR clause text in your subcontract, and now you’re bound by it too.

Here’s what makes flow-downs tricky for small businesses: you can’t negotiate them away when they’re mandatory. FAR 52.244-6 lists specific clauses that must flow down to commercial subcontracts. The prime has no choice, and neither do you. But primes also routinely include non-mandatory clauses in subcontracts — sometimes out of caution, sometimes to transfer compliance risk downward. Knowing the difference is how you protect your business.

The mandatory flow-downs (you can’t negotiate these out)

FAR 52.244-6 is the master list. It requires prime contractors to include specific clauses in every commercial subcontract, regardless of dollar value. Here are the ones you’ll encounter most often:

FAR 52.203-13 — Contractor code of business ethics and conduct. If your subcontract exceeds $6 million and has a performance period longer than 120 days, you need a written code of business ethics and an internal compliance program. You also have to disclose credible evidence of fraud, violations of criminal law, or False Claims Act violations to the agency’s Inspector General.

FAR 52.203-19 — Prohibition on requiring certain internal confidentiality agreements. You can’t force your employees to sign agreements that prevent them from reporting fraud, waste, or abuse to the government. This protects whistleblowers in your organization.

FAR 52.219-8 — Utilization of small business concerns. If your subcontract exceeds $750,000 (or $1.5 million for construction), you need your own subcontracting plan showing how you’ll use small businesses on your portion of the work. Yes, this applies even if you’re a small business yourself — the obligation flows down at every tier.

FAR 52.222-21 — Prohibition of segregated facilities. You can’t maintain segregated facilities or permit your employees to work where segregated facilities are maintained.

FAR 52.222-26 — Equal opportunity. The standard anti-discrimination clause. You can’t discriminate in employment based on race, color, religion, sex, sexual orientation, gender identity, or national origin. Applies to subcontracts exceeding $10,000.

FAR 52.222-35, -36, -37 — Veterans’ employment. Three separate clauses covering equal opportunity for veterans, affirmative action for workers with disabilities, and employment reports on veterans. These apply to subcontracts of $150,000 or more.

FAR 52.222-50 — Combating trafficking in persons. You can’t engage in or tolerate trafficking, forced labor, or commercial sex acts. This one applies regardless of subcontract value. Violations can result in contract termination, suspension, and debarment.

FAR 52.222-55 — Minimum wages for contractor workers. Sets minimum wage requirements for workers on the contract, currently $17.75/hour (effective January 2025, adjusted annually).

FAR 52.225-26 — Contractors performing private security functions outside the United States. If your work involves security functions overseas, this clause governs how your personnel operate.

FAR 52.247-64 — Preference for privately owned U.S.-flag commercial vessels. If your work involves ocean shipping, U.S.-flag vessels get preference.

The discretionary flow-downs (these are negotiable)

Beyond the mandatory list, primes frequently include additional clauses. Some are appropriate. Others are the prime dumping risk.

Cost Accounting Standards (FAR 52.230-2). CAS applies to negotiated contracts above specific dollar thresholds. If your subcontract is below the CAS threshold (currently $2 million for modified coverage), you can push back on full CAS flow-down. Many primes include it reflexively. Check whether your subcontract value actually triggers the requirement.

Organizational conflicts of interest (FAR 52.209-8, -9). Primes sometimes flow down OCI restrictions that are broader than what the government contract requires. Read these carefully. An overly broad OCI clause could prevent you from working on other contracts in your industry.

Limitation of liability. Some primes add clauses limiting their liability to you while keeping your liability to them unlimited. This isn’t a FAR clause — it’s a commercial term the prime inserts. You can and should negotiate it.

Intellectual property and data rights. Primes sometimes flow down data rights clauses (DFARS 252.227-7013, -7014) more broadly than necessary, claiming ownership of technical data and software you develop. If you’re bringing your own IP to the subcontract, this is where you fight. The government’s data rights in your work depend on who funded the development, not on what the prime writes into your subcontract.

CMMC and cybersecurity flow-downs: the one that’s catching everyone off guard

If you’re subcontracting on a Department of Defense contract, cybersecurity flow-downs deserve their own section because the consequences of getting them wrong are severe.

DFARS 252.204-7012 — Safeguarding covered defense information. This clause requires you to implement NIST SP 800-171 security controls if you handle Controlled Unclassified Information (CUI). It flows down to every tier of the supply chain. The prime can’t waive it. You can’t opt out. If the contract involves CUI and you touch it, you need 110 security controls in place.

CMMC requirements (DFARS 252.204-7021). As of November 2025, contracting officers can require a specific CMMC level as a condition of contract award. That requirement flows down to subcontractors. If the prime contract requires CMMC Level 1, every sub handling Federal Contract Information (FCI) must also have Level 1. If it requires Level 2, every sub handling CUI must have Level 2.

The timeline for CMMC enforcement is phased through 2028, but don’t treat it as a future problem. Primes are already asking subcontractors for their SPRS scores during team selection. If you haven’t done your Level 1 self-assessment, you’re losing subcontracting opportunities right now.

Cyber incident reporting. Under DFARS 252.204-7012, if you experience a cybersecurity incident involving covered defense information, you must report it to the DoD within 72 hours. Not 72 business hours. 72 hours. You also have to preserve and provide forensic images and relevant data for 90 days. A small business without an incident response plan can easily miss this deadline and face serious consequences.

What happens when you violate a flow-down clause

The consequences depend on the clause, but they’re real.

Contract termination. The prime can terminate your subcontract for cause. For mandatory flow-downs like anti-trafficking (FAR 52.222-50), the government can direct the prime to terminate you.

False Claims Act liability. Here’s the part that surprises most subcontractors: you can face False Claims Act liability even though you have no direct contract with the government. If the prime passes your invoices or compliance certifications to the government, and those representations are false, you’re exposed. The False Claims Act imposes penalties of $13,508 to $27,018 per false claim (2025 amounts, adjusted annually for inflation), plus treble damages. MORSE Corp paid $4.6 million in 2025 for submitting false cybersecurity compliance scores to SPRS. Those numbers get your attention fast.

Suspension and debarment. FAR 52.209-6 requires primes to check the System for Award Management (SAM.gov) exclusions list before awarding subcontracts. If you get debarred for a flow-down violation, you’re locked out of all federal contracting — prime and sub — for up to three years. Debarment at the federal level also typically triggers debarment from state and local government contracts.

Liquidated damages. Some clauses specify dollar penalties for non-compliance. FAR 52.222-4 (Contract Work Hours and Safety Standards) authorizes $10 per worker per day for overtime violations.

How to review flow-down clauses before signing

When a prime hands you a subcontract, here’s how to work through the flow-down section without losing your mind.

Step 1: Find the flow-down section. It’s usually an appendix, exhibit, or attachment titled “Applicable FAR/DFARS Clauses,” “Flow-Down Terms and Conditions,” or something similar. In some subcontracts, the clauses are incorporated by reference — meaning the subcontract lists clause numbers without printing the full text. You’ll need to look them up on acquisition.gov.

Step 2: Separate mandatory from discretionary. Pull up FAR 52.244-6 and compare the clauses in your subcontract against the mandatory list. Everything on that list stays. Everything else is potentially negotiable.

Step 3: Flag clauses that don’t apply. Some clauses only trigger above certain dollar thresholds. CAS (FAR 52.230-2) doesn’t apply to subcontracts under $2 million. Small business subcontracting plans (FAR 52.219-9) don’t apply under $750,000. If your subcontract is below these thresholds and the prime included the clause anyway, ask for removal or acknowledgment that the threshold isn’t met.

Step 4: Read the data rights and IP clauses word by word. If you’re a technology company or bringing proprietary methods to the work, DFARS 252.227-7013 (Rights in Technical Data — Noncommercial Items) and DFARS 252.227-7014 (Rights in Noncommercial Computer Software) determine who owns what you create. The default government rights categories are “unlimited,” “government purpose,” and “limited.” If you developed something with your own money before this contract, you should have limited rights or restricted rights — not unlimited. Don’t sign away your IP because you didn’t read the clause.

Step 5: Ask questions. If a clause confuses you, ask the prime’s subcontracts manager to explain it. If they can’t, that’s a warning sign. A prime that doesn’t understand their own flow-down clauses won’t be a good partner when compliance questions come up during performance.

Recent changes affecting flow-down clauses (2025-2026)

A few developments are reshaping flow-down requirements right now.

CMMC enforcement is live. The DFARS acquisition rule took effect November 10, 2025. Contracting officers are now inserting CMMC requirements into solicitations, and those requirements flow down. If you haven’t submitted your SPRS self-assessment, you’re already behind.

Executive Order 14173 — DEI and affirmative action changes. In January 2025, Executive Order 11246 (the 1965 order requiring federal contractor affirmative action plans) was revoked. New contracts, amendments, and renewals now include certifications that contractors and subcontractors don’t operate programs that violate federal anti-discrimination laws. These certifications are being treated as material for False Claims Act purposes, which means false certifications carry treble damages and whistleblower liability. The core anti-discrimination flow-downs (FAR 52.222-26, equal opportunity) remain mandatory, but the affirmative action planning requirements under the old OFCCP framework are gone.

Subcontracting plan threshold increase. The FAR 19.702 threshold for requiring subcontracting plans rose from $750,000 to $900,000 on October 1, 2025 ($1.5 million to $2 million for construction). If your subcontract value falls in that gap, some flow-down obligations that previously applied may no longer trigger.

Your next move

Before you sign your next subcontract, print out the flow-down section and work through the five-step review process above. If you’re actively looking for subcontracting work, knowing how to read and negotiate flow-downs puts you ahead of most small businesses in the market. Primes notice when a sub asks intelligent questions about clause applicability instead of blindly signing.

If you’re doing DoD work, get your CMMC self-assessment into SPRS this month. That requirement is flowing down into every new defense subcontract, and primes are dropping subs who can’t show compliance.