The prime contractor (contractor organization)is responsible for ensuring thatits subcontractorshave the requiredCMMC certification levelbefore engaging them inDoD contracts that involve FCI or CUI.
This requirement is enforced throughflow-down clausesinDFARS 252.204-7021, which mandates that subcontractors handlingCUImeet the necessaryCMMC Level 2 or Level 3 requirements.
[Reference:, DFARS 252.204-7021(CMMC Compliance), CMMC 2.0 Program Documentation, Step 2: Why Other Answer Choices Are IncorrectA. CMMC-AB (Incorrect):, TheCyber AB (formerly CMMC-AB)is responsible foraccrediting C3PAOs and managing the assessment process, but it does not enforce subcontractor compliance., B. OUSDA&S (Incorrect):, TheOffice of the Under Secretary of Defense for Acquisition & Sustainment (OUSD A&S)develops and overseesCMMC policy, but it does not monitor or enforce individual subcontractor compliance., C. DoD agency or client (Incorrect):, While theDoD sets CMMC requirements, it relies onprime contractors to ensure compliance among their subcontractorsthrough contract flow-down requirements., Final Confirmation of Correct Answer:Prime contractors must ensure their subcontractors have the required CMMC certification level to handle FCI or CUI., Thus, the correct answer is:D. Contractor organization, , , ]
Submit