Manufacturers and defense suppliers
CMMC, the SPRS score, 7012, and the prime's flow-down letter. We know the paper each one arrives on.
What arrives
- CMMC, or 7021
- CMMC 2.0 under 32 CFR Part 170, flowed into contracts by DFARS 252.204-7021. Level 2 is certified by a C3PAO.
- The SPRS score
- The NIST SP 800-171 self-assessment score posted to the Supplier Performance Risk System under DFARS 252.204-7019 and 7020. The range runs from -203 to 110.
- 7012
- DFARS 252.204-7012, safeguarding covered defense information and reporting a cyber incident within 72 hours.
- The flow-down, or the supplier letter
- The prime contractor's own supplier notice. Raytheon, Lockheed Martin, Boeing, Elbit and Northrop Grumman each issued one during 2025.
- The SSP and the POA&M
- The System Security Plan and the Plan of Action and Milestones that NIST SP 800-171 requires behind the score.
What the Institute has found here
The Vigil LibraryInstitute
The Vendor as the Vector: Third-Party Risk Management Across Veterinary and Insurance Networks
Field notes · June 2026
Read itInstitute
AI and the Expanding Attack Surface: How Generative Tool Adoption Creates New Risk Vectors in Mid-Market Businesses
Analyst · June 2026
Read itInstitute
The SMB Security Paradox
Analyst · February 2026
Read itStart the conversation
A short, plain conversation about the outside view, with an advisor who knows the paper.