FAR Flow-Down Clauses: What Primes Must Pass to Subcontractors

When you sign a subcontract, you’re not just agreeing to the terms on the page — a specific set of FAR and DFARS clauses attach automatically, whether or not the prime bothered to write them into your agreement. These are flow-down clauses, and misunderstanding which ones are mandatory versus negotiable is one of the more expensive blind spots a growing subcontractor can have.

What “Flow-Down” Actually Means

A flow-down clause is a requirement from the prime’s contract with the government that has to pass through to subcontracts, because the government’s interest in that requirement doesn’t stop at the prime — it extends to everyone actually performing the work. Some flow-downs are negotiable business terms the prime chooses to include. Others are what’s sometimes called “self-executing”: they apply by their own legal force regardless of whether the subcontract explicitly states them, because federal law requires it.

The Clauses That Flow Down Automatically

A handful of clauses are considered mandatory, self-executing flow-downs that apply to qualifying subcontracts regardless of whether the paperwork explicitly includes them:

• FAR 52.203-13 — Contractor Code of Business Ethics and Conduct
• FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems (the FCI baseline discussed in our CMMC and cybersecurity compliance guide)
• FAR 52.222-26 — Equal Opportunity
• FAR 52.222-41 — Service Contract Act requirements, where applicable

On defense contracts specifically, DFARS 252.204-7012 (safeguarding covered defense information and cyber incident reporting) is a critical flow-down whenever CUI is involved in the subcontracted work — this is the clause that pulls a subcontractor into full NIST 800-171 obligations even if their own prime contract language is thin on the details.

Clauses a Smart Prime Adds Even When Not Strictly Required

Beyond the mandatory list, experienced primes typically flow down several additional clauses to protect themselves, even where the law doesn’t force it: Changes clauses (so scope modifications on the prime’s side can properly flow to the sub), Termination for Convenience language (so the prime isn’t left holding an obligation it can’t pass along if the government terminates), and Limitation of Funds or Limitation of Cost clauses on cost-reimbursement work. If you’re a subcontractor and these are missing from your agreement, that’s worth raising before signing — their absence usually means ambiguity that resolves in the prime’s favor, not yours, if a dispute happens.

Why This Matters Even If You Never Read the Full Prime Contract

Most subcontractors never see the prime’s full contract with the government — you work from the subcontract document alone. That’s exactly why understanding which clauses are self-executing matters: your legal obligations under federal law can exceed what’s explicitly written in the subcontract in front of you. A subcontract that’s silent on cybersecurity requirements doesn’t mean you’re exempt from DFARS 252.204-7012 if the underlying work involves covered defense information — the requirement flows down whether or not someone remembered to type it into your specific agreement.

What Happens When a Flow-Down Gets Missed

If a mandatory flow-down clause isn’t properly incorporated, the risk doesn’t disappear — it typically lands on the prime. Primes can be held financially responsible if a subcontractor fails to comply with requirements like the Service Contract Act’s wage and benefit provisions, even where the subcontract itself was silent on the point. This is why experienced primes maintain a subcontractor monitoring system with built-in audit rights, rather than assuming a signed subcontract alone guarantees compliance down the chain. If you’re a subcontractor, treat missing flow-downs as a red flag in the relationship, not a lucky break — a prime that’s sloppy about flow-downs is often sloppy about other contract administration too.

Where Teaming Agreements Fit In

The cleanest way to avoid a flow-down dispute later is to put the expectation directly into the relationship before work starts, not after. If you’re structuring a subcontracting or teaming relationship with a prime, the underlying dynamics of that prime-versus-subcontractor relationship shape how flow-downs actually get handled in practice, not just what the clause list says on paper. And if you’re still working on finding primes to team with in the first place, it’s worth understanding this flow-down exposure before you’re negotiating your first agreement, not after you’ve already signed one. On small-business set-aside work specifically, the limitations-on-subcontracting rule caps how much of the total contract value can be passed down to subcontractors in the first place — a separate compliance question from flow-down clauses, but one that shapes the same subcontracting relationship.

Key Takeaways

• Flow-down clauses pass the government’s contractual requirements from the prime down to subcontractors — some are negotiable, but a specific set are legally self-executing regardless of what the subcontract paperwork says.
• Mandatory flow-downs include FAR 52.203-13 (ethics), FAR 52.204-21 (basic safeguarding), FAR 52.222-26 (equal opportunity), and FAR 52.222-41 (Service Contract Act) where applicable.
• DFARS 252.204-7012 is a critical flow-down on defense work involving CUI, pulling subcontractors into full NIST 800-171 obligations even with thin subcontract language.
• Your legal obligations can exceed what’s explicitly written in your subcontract, since self-executing clauses apply by federal law regardless of the paperwork.
• Primes can be held financially responsible for a subcontractor’s non-compliance with flow-down requirements — which is why experienced primes maintain active subcontractor monitoring rather than assuming a signed contract is enough.

FAQ

If my subcontract doesn’t mention a specific FAR clause, am I exempt from it?
Not necessarily — self-executing flow-down clauses apply by operation of federal law regardless of whether the subcontract document explicitly states them. Don’t assume silence means exemption, particularly for cybersecurity and information-safeguarding requirements.

As a subcontractor, should I ask to see the prime’s full contract?
You’re generally not entitled to the full prime contract, but you can and should ask the prime directly which flow-down clauses apply to your specific scope of work, especially around cybersecurity, wage requirements, and any technical data markings — get the answer in writing where possible.

Who’s liable if a subcontractor doesn’t comply with a flow-down requirement?
Often the prime bears financial responsibility to the government, which is exactly why experienced primes actively monitor subcontractor compliance rather than treating a signed subcontract as the end of the obligation. That monitoring risk is also why primes vet subcontractors carefully before adding them to a team.