For prime contractors
Bedrock Flowdown
CMMC flow-down tracking for primes. A live roster of your subcontractors' CMMC and DFARS status — SPRS scores, C3PAO certifications, annual affirmations, 252.204-7012 attestations — evaluated against the level each contract flows down.
The problem
Flow-down diligence lives in a spreadsheet
Without Flowdown
- Sub status tracked in a spreadsheet and an email thread
- Nobody is sure which subs are actually certified when a solicitation lands
- SPRS scores and affirmation dates go stale silently
- Chasing PDFs and attachments for every attestation
- No record to show a contracting officer that diligence happened
With Flowdown
- Every sub is green, amber, or red against the level their contracts require
- Subs update their own status through a private link — no account, no attachments
- Validity windows and affirmation clocks run automatically, with warnings 90 days out
- Append-only evidence trail: every attestation is a dated row with its source
- CSV export of the roster and evidence trail for the CO or an auditor
How it works
Three steps from spreadsheet to defensible
-
01
Record the contract
The contract number and the CMMC level it flows down — Level 2 C3PAO for CUI, self-assessment for FCI. Link the subs on it.
-
02
Ask each sub, by link
One click sends a private link. The sub fills in their SPRS score, certification, affirmation, and 7012 status. Subs never pay to respond.
-
03
See who blocks what
Open a contract and see exactly which subs are below the required level, with the reason and the next date that matters. That's your flow-down diligence record.
What it tracks
The four things a contracting officer will ask about
SPRS score & date
Level 1 and Level 2 self-assessments, with the three-year validity and annual affirmation clock running automatically.
Certification
Level 2 C3PAO or Level 3 DIBCAC: who certified, when, and when it expires. Warns 90 days out.
DFARS 252.204-7012
Whether the sub has attested to incident reporting and cloud FedRAMP-equivalence — expected on any CUI contract.
Evidence trail
Nothing is edited in place. Every attestation is a dated row with its source — you, or the sub via a request link. Full audit log.
Free for primes with up to 10 subs
No card required, and subcontractors never pay to answer a request. When a sub needs to build its own compliance package, Bedrock CMMC is one link away.