Describe the service before asking for a badge
Start with the actual relationship. What work does the supplier perform, what information will it receive, and which systems or facilities will it use? A generic statement that a provider is “CMMC ready” does not answer those questions. Ask for the scope of any status claim and the basis for using it in your particular arrangement.
FAR 52.204-21 contains a subcontract flowdown provision for covered arrangements involving FCI, with specified treatment for commercially available off-the-shelf items. Your contracts team should evaluate the actual subcontract and applicable clauses. Do not assume that every commercial vendor receives the same obligations or that a vendor's status removes your own responsibilities.
Use five operational questions
Ask: Where will the information go? Who can access it? Which safeguards does the provider operate? Which actions remain with our company? What current records or demonstrations support that explanation? Follow each answer until an accountable person and system are identified.
For an illustrative managed IT engagement, the provider might configure endpoint protection while the customer must enroll devices and report departures. If those responsibilities are not explicit, each side may assume the other is handling a missed device or former employee account. The resulting gap is operational, even if the contract contains a broad security paragraph.
Review evidence access before the annual cycle
Determine how the company can obtain information needed for its review without collecting other customers' data or unnecessary sensitive details. Agree on a suitable method, responsible contact, and realistic response process. Keep the evidence in a protected location and record only a non-sensitive reference in general planning tools.
Ask what happens when the provider changes a service, moves information, or discovers a failure affecting your environment. Include a way to resolve disputes over responsibility. A service description is a useful starting point, but an annual self-assessment needs a current understanding of what was actually implemented.
Keep the customer claim precise
When a prime contractor asks for your status, determine exactly what it needs and the authorized way to provide it. Check that the organization, CAGE code, scope, assessment date, and affirmation information correspond to the relevant work. A readiness engagement letter or software subscription is not equivalent to a current government record.
If the supplier will receive CUI or a different level is involved, stop applying a Level 1-only checklist and examine the additional requirements. This guide helps structure the conversation, but it cannot interpret every contract or establish a supplier's eligibility. Escalate uncertainty to the responsible contracts and security personnel before sharing information or making assurances.