r/CMMC•
DR-CT

Subcontractor CMMC Verification Challenges

Has anyone experienced subcontractor compliance issues with CMMC L2 verification when DFARS 252.204-7021 is in a contract mod advancing a prime contract into a new Option Period? If so, how does a prime respond to a subcontractor that is unable or refuses to provide SPRS report or other supporting evidence a CMMC L2 status?

We also noticed some SMB subcontractors initially resist providing a cyber report from SPRS, but then provide a CMMC L2 (self) verification from SPRS that is dated within a day or two of the prime requesting their status.

Posted Jun 10, 2026, 4:34 PM UTC

67
Loading comments…