PO applicability notice: This flowdown applies when the Purchase Order identifies or involves Federal Contract Information (FCI), Controlled Unclassified Information (CUI), Covered Defense Information, or a stated CMMC requirement.
1. Applicability
When performance of this Purchase Order requires Supplier to receive, access, develop, generate, store, process, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) provided by or on behalf of MTP Drivetrain Services, Supplier shall comply with the cybersecurity requirements applicable to that information and the underlying Government contract.
The CMMC requirement applies to each contractor information system used to process, store, or transmit the applicable FCI or CUI. The level and assessment type required by this Purchase Order shall be the level and type identified by MTP Drivetrain Services or required by the applicable Government contract.
2. CUI and DFARS Requirements
For any CUI or Covered Defense Information provided to, generated by, or otherwise handled by Supplier in performance of this Purchase Order, the following requirements are incorporated by reference when applicable to the underlying contract:
- DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting.
- DFARS 252.204-7019: Notice of NIST SP 800-171 DoD Assessment Requirements.
- DFARS 252.204-7020: NIST SP 800-171 DoD Assessment Requirements.
- DFARS 252.204-7021: Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements.
Supplier shall implement and maintain the security requirements applicable to each covered contractor information system used to process, store, or transmit such information.
3. CMMC Level 2 Requirement
Where MTP Drivetrain Services identifies this Purchase Order as requiring CMMC Level 2, Supplier represents that each contractor information system used to process, store, or transmit applicable CUI holds the current CMMC Level 2 status, or higher, required by the applicable contract and that the applicable status and affirmation of continuous compliance are entered in the Supplier Performance Risk System (SPRS).
Supplier shall maintain the required CMMC status and applicable affirmation of continuous compliance for as long as Supplier receives, accesses, processes, stores, or transmits MTP Drivetrain Services CUI and for any additional period required by the applicable contract, regulation, records-retention requirement, or direction from MTP Drivetrain Services.
If the underlying requirement specifies CMMC Level 2 (Self), CMMC Level 2 (C3PAO), or another assessment type, Supplier shall maintain that specific status or a higher qualifying status.
4. NIST SP 800-171 and SPRS Requirements
Where Supplier is required to implement NIST SP 800-171, Supplier shall implement and maintain the applicable security requirements and maintain the assessments, scores, records, and access required by DFARS 252.204-7019 and DFARS 252.204-7020.
Supplier shall ensure that current summary-level scores for each relevant covered contractor information system are posted in SPRS as required and shall provide supporting evidence to MTP Drivetrain Services upon reasonable request when permitted by the applicable contract and law.
5. Cyber Incident Reporting
Supplier shall comply with the cyber incident reporting requirements of DFARS 252.204-7012, including reporting a qualifying cyber incident affecting a covered contractor information system or Covered Defense Information to the Department of Defense within 72 hours of discovery through the DoD reporting mechanism identified by the clause (currently the DoD Cyber Crime Center DCISE portal).
Supplier shall promptly provide MTP Drivetrain Services with the applicable DoD incident report number and information reasonably necessary for MTP Drivetrain Services to meet its own contractual reporting, investigation, preservation, response, and cooperation obligations.
Supplier shall preserve and protect images of affected information systems and relevant monitoring or packet-capture data for the periods required by DFARS 252.204-7012 and shall provide access or information as required by the applicable clause.
6. Federal Contract Information (FCI)
Where Supplier will receive, process, store, or transmit FCI but will not receive or handle CUI, Supplier shall comply with FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, when applicable.
Where the applicable Purchase Order or Government contract requires CMMC Level 1, Supplier shall maintain a current CMMC Level 1 status and applicable affirmation of continuous compliance in SPRS for each contractor information system used to process, store, or transmit the applicable FCI.
7. Lower-Tier Subcontractor Flowdown
Supplier shall not provide MTP Drivetrain Services CUI, Covered Defense Information, FCI, or other protected Government information to a lower-tier subcontractor unless the lower-tier subcontractor is authorized to receive the information and satisfies all cybersecurity, CMMC, NIST SP 800-171, FAR, and DFARS requirements applicable to the subcontracted work and information.
Supplier shall flow down all applicable requirements of this clause, including applicable requirements of DFARS 252.204-7012, DFARS 252.204-7019, DFARS 252.204-7020, DFARS 252.204-7021, and FAR 52.204-21, to lower-tier subcontractors as required by the applicable clauses and Government contract.
Supplier remains responsible for ensuring that lower-tier subcontractors comply with applicable safeguarding, incident-reporting, assessment, CMMC, and information-disposition requirements.
8. Authorized Use and Protection of Information
Supplier shall use MTP Drivetrain Services CUI or FCI solely to perform the MTP Drivetrain Services Purchase Order and shall not use, disclose, reproduce, release, or distribute the information for any other purpose except as authorized in writing by MTP Drivetrain Services or required by law or the applicable Government contract.
Supplier shall limit access to authorized personnel with a lawful need to know and shall protect the information against unauthorized access, disclosure, modification, loss, or destruction.
9. Return, Destruction, and Disposition
Upon completion, termination, or expiration of the work, Supplier shall return, destroy, sanitize, or otherwise dispose of the CUI or FCI, including copies and information on system media, as directed by MTP Drivetrain Services and in accordance with applicable Government contractual and regulatory requirements.
If Supplier is legally or contractually required to retain any information, Supplier shall continue to safeguard that information for the full retention period and shall limit its use to the purpose requiring retention.
10. Notification of Noncompliance
Supplier shall immediately notify MTP Drivetrain Services if Supplier:
- does not possess or loses the CMMC status required by this Purchase Order,
- does not maintain an applicable affirmation of continuous compliance,
- does not have a required NIST SP 800-171 DoD Assessment or summary-level score in SPRS,
- determines that it cannot satisfy an applicable FAR, DFARS, NIST SP 800-171, CMMC, or contractual cybersecurity requirement,
- experiences a change to its information systems, ownership, security posture, or assessment status that affects its eligibility to handle the applicable FCI or CUI, or
- becomes aware of another condition that could prevent Supplier or a lower-tier subcontractor from lawfully receiving or continuing to safeguard MTP Drivetrain Services CUI or FCI.
Supplier shall not receive, process, store, or transmit CUI until all applicable cybersecurity and CMMC requirements have been satisfied, Supplier has signed MTP Drivetrain Services’ Supplier CUI/FCI Agreement, and MTP Drivetrain Services has authorized performance to proceed.
11. Acceptance and Continuing Obligation
Acceptance of a Purchase Order that references this flowdown constitutes Supplier acknowledgment and agreement that Supplier is responsible for determining and maintaining the cybersecurity requirements applicable to its performance and for ensuring that applicable requirements are flowed down to its lower-tier subcontractors.
The obligations concerning protection, incident reporting, cooperation, retention, return, destruction, and disposition of protected information survive completion or termination of the Purchase Order for as long as Supplier or its lower-tier subcontractors retain or have access to the protected information.
Regulatory References
DFARS 252.204-7012: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
DFARS 252.204-7019: https://www.acquisition.gov/dfars/252.204-7019-notice-nistsp-800-171-dod-assessment-requirements
DFARS 252.204-7020: https://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements
DFARS 252.204-7021: https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements
FAR 52.204-21: https://www.acquisition.gov/far/52.204-21
Reference URLs are included for convenience. The version of each clause applicable to the underlying contract controls.