What “Flowdown” Means in Government Contracting
Flowdown is the mechanism by which obligations from a prime contract are passed to subcontractors. When a FAR or DFARS clause “flows down,” the subcontractor must comply with that clause as if it were a direct requirement in their subcontract. The legal basis is FAR Subpart 44.4, which requires prime contractors to include certain clauses in their subcontracts, and FAR 52.244-6, which specifies the minimum set of clauses that must flow down for commercial product and service subcontracts.
Flowdown is not optional. Under FAR 44.402(a), the prime contractor is responsible for ensuring that applicable clauses are included in subcontracts. Failure to flow down required clauses does not relieve the prime of its obligations to the government. The prime remains liable for subcontractor non-compliance.
Mandatory vs. Discretionary Flowdown
Mandatory Flowdown
Certain clauses must be flowed down by regulation. The clause text itself or the FAR prescription paragraph will state “the Contractor shall include the substance of this clause in all subcontracts” or specify a dollar threshold above which the clause applies.
Key reference: FAR 52.244-6(c) lists the mandatory flowdown set for commercial item subcontracts. For non-commercial subcontracts, each clause's prescription in FAR Parts 1-51 specifies its flowdown requirement.
Discretionary Flowdown
Some clauses are not required by regulation to flow down, but the prime may choose to include them for risk management. For example, a prime may flow down inspection, acceptance, or warranty clauses to protect itself when the subcontractor's performance directly affects the prime's deliverables.
Warning: Primes sometimes over-flow by including every clause from the prime contract. Per FAR 44.402(b), only clauses “appropriate to the subcontract” should be included. Over-flowdown creates unnecessary compliance burden and can inflate subcontract pricing.
Key Mandatory FAR Flowdown Clauses
The following clauses have explicit flowdown requirements in their prescription language or are listed in FAR 52.244-6(c) as mandatory for commercial item subcontracts. Dollar thresholds and conditions apply as noted.
| Clause | Title | Flowdown Rule | Authority |
|---|---|---|---|
| FAR 52.203-13 | Contractor Code of Business Ethics and Conduct | Required in subcontracts over $6M with a performance period exceeding 120 days | FAR 3.1004(b) |
| FAR 52.203-19 | Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements | Flows down to all subcontracts at all tiers | FAR 3.909-3(b) |
| FAR 52.204-21 | Basic Safeguarding of Covered Contractor Information Systems | Flows down to all subcontracts where subcontractor may have federal contract information on its systems | FAR 4.1903 |
| FAR 52.204-23 | Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab | Flows down to all subcontracts at all tiers | FAR 4.2004(b) |
| FAR 52.204-25 | Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment | Flows down to all subcontracts and purchase orders | FAR 4.2105(b) |
| FAR 52.219-8 | Utilization of Small Business Concerns | Flows down to all subcontracts exceeding the simplified acquisition threshold that offer further subcontracting opportunities | FAR 19.708(a) |
| FAR 52.222-21 | Prohibition of Segregated Facilities | Flows down to all subcontracts | FAR 22.810(a) |
| FAR 52.222-26 | Equal Opportunity | Flows down to subcontracts over $10,000 | FAR 22.810(b); E.O. 11246 |
| FAR 52.222-35 | Equal Opportunity for Veterans | Flows down to subcontracts of $150,000 or more | FAR 22.1310(b); 38 U.S.C. 4212 |
| FAR 52.222-36 | Equal Opportunity for Workers with Disabilities | Flows down to subcontracts over $15,000 | FAR 22.1408(b); 29 CFR 60-741 |
| FAR 52.222-50 | Combating Trafficking in Persons | Flows down to all subcontracts and contracts for the acquisition of commercial products and services | FAR 22.1705(b) |
| FAR 52.225-1 / 52.225-2 | Buy American Act (Supplies / Certificate) | Flows down to subcontracts for supplies as prescribed | FAR 25.1101(a) |
| FAR 52.225-13 | Restrictions on Certain Foreign Purchases | Flows down to all subcontracts | FAR 25.1103(a) |
| FAR 52.244-6 | Subcontracts for Commercial Products and Commercial Services | Prime must include in subcontracts for commercial items; lists minimum set of clauses that must flow down | FAR 44.403; FAR 52.244-6(c) |
| FAR 52.247-64 | Preference for Privately Owned U.S.-Flag Commercial Vessels | Flows down to subcontracts involving ocean transportation of supplies | FAR 47.507(a) |
How Contract Type and Value Affect Flowdowns
Not every clause flows down to every subcontract. Three variables control which clauses apply:
1. Dollar Threshold
Many clauses activate only above specific dollar amounts. For example, the Simplified Acquisition Threshold (SAT) of $250,000 (FAR 2.101) triggers small business subcontracting plan requirements under FAR 52.219-9. Equal opportunity clauses apply above $10,000 (FAR 22.810). Cost Accounting Standards apply above $2M for CAS-covered subcontracts (FAR 30.201-4). Always check the specific clause prescription for the applicable threshold.
2. Commercial vs. Non-Commercial Items
Commercial item subcontracts have a reduced flowdown set. FAR 52.244-6(c) provides the complete list of clauses that must flow to commercial item subcontracts. This is significantly shorter than the full set that applies to non-commercial subcontracts. However, per FAR 12.301(d), the Contracting Officer may add additional clauses on a case-by-case basis when necessary for the government's needs.
3. Contract Type (Fixed-Price vs. Cost-Reimbursement)
Cost-reimbursement subcontracts trigger additional flowdown requirements that do not apply to fixed-price work. For example, FAR 52.215-2 (Audit and Records) and the Cost Accounting Standards (CAS) at FAR Part 30 flow down to cost-type subcontracts above their respective thresholds. Cost Accounting Standards coverage applies to cost-reimbursement subcontracts exceeding $2M (48 CFR 9903.201-1). Fixed-price subcontracts for commercial items generally have the lightest flowdown burden.
DFARS-Specific Flowdowns for DoD Subcontractors
If the prime contract is with the Department of Defense, DFARS clauses supplement the FAR flowdown requirements. The following are the most consequential DFARS flowdowns for subcontractors:
| Clause | Title | Flowdown Rule | Authority |
|---|---|---|---|
| DFARS 252.204-7012 | Safeguarding Covered Defense Information and Cyber Incident Reporting | Flows down to all subcontracts for operationally critical support or involving CDI/CTI | DFARS 204.7304(d) |
| DFARS 252.204-7020 | NIST SP 800-171 DoD Assessment Requirements | Flows down to subcontracts (excluding COTS) where CDI is processed, stored, or transmitted | DFARS 204.7304(e) |
| DFARS 252.204-7021 | Cybersecurity Maturity Model Certification Requirements | Flows down to all subcontracts and purchase orders (excluding COTS) at the CMMC level specified by the prime | DFARS 204.7503(b) |
| DFARS 252.225-7001 | Buy American and Balance of Payments Program | Flows down to subcontracts for defense supplies | DFARS 225.1101(2) |
| DFARS 252.225-7009 | Restriction on Acquisition of Certain Articles Containing Specialty Metals | Flows down to subcontracts for items containing specialty metals at all tiers | DFARS 225.7003-5(a) |
| DFARS 252.225-7012 | Preference for Certain Domestic Commodities (Berry Amendment) | Flows down to subcontracts for items covered by the Berry Amendment | DFARS 225.7002-3 |
| DFARS 252.227-7013 / 7014 | Technical Data / Computer Software Rights | Flows down to all subcontracts where technical data or software is generated | DFARS 227.7103-6(d); 227.7203-6(d) |
| DFARS 252.246-7007 | Contractor Counterfeit Electronic Part Detection and Avoidance System | Flows down to subcontracts for electronic parts or assemblies containing electronic parts | DFARS 246.870-3(b) |
Critical note on CMMC: Under DFARS 252.204-7021, prime contractors must ensure subcontractors achieve the required CMMC level before awarding a subcontract that involves Controlled Unclassified Information (CUI). This applies at all tiers, excluding only acquisitions of commercially available off-the-shelf (COTS) items. Starting with the CMMC phased rollout, subcontractors who cannot demonstrate the required certification level will be ineligible for award.
IT Services Contractor Implications
IT services subcontractors face a particularly dense flowdown landscape because their work frequently involves government data, systems access, and cyber infrastructure. Key considerations:
- 1Cybersecurity is nearly always mandatory. If you process, store, or transmit Federal Contract Information (FCI), FAR 52.204-21 flows down. If Controlled Unclassified Information (CUI) is involved on a DoD contract, DFARS 252.204-7012 adds the full 110-control NIST SP 800-171 requirement plus 72-hour incident reporting.
- 2Telecommunications prohibitions apply to your supply chain. FAR 52.204-25 (Section 889) prohibits the use of covered telecommunications equipment or services. This flows down to all tiers, meaning your cloud providers, network equipment vendors, and data center operators must also comply.
- 3Technical data and software rights follow the work. Under DFARS 252.227-7013 (technical data) and DFARS 252.227-7014 (computer software), the government acquires rights in data and software developed under the contract. These flow down to subcontractors. If you develop software or create technical documentation as a sub, understand which rights you are granting: unlimited, government purpose, or limited/restricted rights.
- 4Counterfeit parts detection applies to hardware providers. IT subcontractors supplying hardware or assemblies containing electronic parts must comply with DFARS 252.246-7007, which requires a counterfeit electronic part detection and avoidance system. This flows down through all tiers per DFARS 246.870-3(b).
- 5Cloud services add FedRAMP considerations. Per DFARS 252.204-7012(b)(2)(ii)(D), cloud computing services used to store, process, or transmit CUI must meet FedRAMP Moderate baseline (or equivalent) and comply with DoD Cloud Computing Security Requirements Guide (SRG). IT subcontractors using cloud services must verify their providers meet these requirements or risk non-compliance at the prime contract level.
Common Flowdown Mistakes (and How to Avoid Them)
1. Blanket Flowdown of All Prime Contract Clauses
Some primes include a clause that says “all terms and conditions of the prime contract are incorporated by reference.” This is both overbroad and potentially unenforceable. FAR 44.402(b) requires that only “appropriate” clauses flow down. Courts have found blanket incorporation ambiguous. Instead, list each flowdown clause by number and title.
2. Failing to Update Flowdowns After Contract Modifications
When the prime contract is modified to add clauses (common during option exercises or scope changes), the prime must modify subcontracts to flow those new clauses down. Per FAR 44.402(a), the prime's consent to subcontract includes ensuring ongoing compliance. Subcontractors should request the current prime contract clause list when signing modifications.
3. Ignoring Lower-Tier Flowdown Requirements
Many clauses require flowdown “at all tiers,” meaning if you are a first-tier sub and you award your own subcontracts, you must include the clause in those lower-tier subcontracts. Failure to do so makes you non-compliant even if you comply with the clause yourself. Key all-tiers clauses include FAR 52.222-50 (trafficking) and DFARS 252.204-7012 (cybersecurity).
4. Not Adapting Clauses for Subcontract Context
When flowing down clauses, references to “Contractor” become the subcontractor, “Contract” becomes the subcontract, and “Contracting Officer” typically remains the government CO (not the prime). Per FAR 44.403, clauses should be adapted for the subcontract relationship. Misidentified parties create ambiguity about who bears which obligation.
5. Assuming Commercial Item Status Eliminates All Flowdowns
Commercial item subcontracts have a reduced flowdown set under FAR 52.244-6(c), but that set still includes significant requirements: equal opportunity (FAR 52.222-26), anti-trafficking (FAR 52.222-50), cybersecurity (FAR 52.204-21), telecommunications prohibitions (FAR 52.204-25), and Buy American requirements (FAR 52.225-1). Commercial does not mean exempt.
6. Missing the Cybersecurity Flowdown Chain
Under DFARS 252.204-7012, the cybersecurity requirement flows to every subcontractor that will “process, store, or transmit” covered defense information, or that will “provide operationally critical support.” Primes who fail to flow this clause or subcontractors who fail to pass it to their own subs create a compliance gap that can result in contract termination. With CMMC (DFARS 252.204-7021), uncertified subcontractors are simply ineligible for award.
Need to check a specific flowdown clause?
ClariFAR searches the full FAR and DFARS corpus and returns the exact clause text with a plain-English explanation of flowdown requirements.