DFARS 252.204-7012(m) requires you to flow the CUI safeguarding + 72-hour incident reporting clauses to every sub. Miss this and the DoD treats it as your non-compliance.
32 CFR 170 makes the prime accountable for its subs' CMMC posture. A single non-compliant sub touching CUI can void your entire affirmation.
DoJ Civil Cyber-Fraud: settlements in 2023-2025 have repeatedly named the prime — not the sub — as the FCA defendant when a sub leaked CUI.
So what: primes today track this in spreadsheets. Athena gives you a defensible, $-quantified, AO-ready audit in 60 seconds.
