Flow-Down Clauses for Software Companies: What Primes Must Pass to Subcontractors

#saas#federal-market

By — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.

See it in the data: search federal awards for “software subcontract” →

A software company that sells to the government through a prime contractor, a reseller or a teaming partner does not sign the prime contract. It still inherits part of it. The terms that pass from the prime contract into a subcontract are called flow-down clauses, and for a software company the ones that matter most are usually about security, supply chain and data.

This guide covers how flow-down works, the short list of clauses the FAR requires primes to pass down on commercial subcontracts, the Department of War (DoW) security clauses that reach software suppliers, and what a subcontractor can push back on. It is written for founders and contracts leads reviewing their first federal subcontract.

How flow-down works

A federal contract is between the government and the prime contractor. The government has no contract with the subcontractor, so its requirements reach a subcontractor only through the subcontract. Clauses get there in two ways:

  • Required flow-down. Many FAR and DFARS clauses tell the contractor to include the substance of the clause in its subcontracts, sometimes in all of them and sometimes only above a dollar value or for a certain kind of work. A prime that leaves out a required flow-down is out of compliance with its own contract.
  • Voluntary flow-down. A prime may also add clauses that the regulations do not require, so that it can meet its own obligations to the government. A clause that lets the government terminate the prime contract for convenience, for example, is often mirrored in the subcontract so the prime is not left holding a subcontract it no longer needs.

The prime stays responsible to the government for the whole contract, including the parts its subcontractors perform. That is why primes tend to flow down too much rather than too little.

The commercial list is short

Most software and SaaS buys are commercial products or commercial services under FAR Part 12. Our guide to commercial buys under FAR Part 12 covers that route. The FAR deliberately keeps flow-down to commercial subcontractors short:

  • Commercial prime contracts. FAR 52.212-5(e) says the contractor is not required to flow down any FAR clause, other than those listed in that paragraph, in a subcontract for commercial products or commercial services.
  • Other prime contracts. FAR 52.244-6, Subcontracts for Commercial Products and Commercial Services, does the same job when the prime contract itself is not commercial. It lists the FAR clauses that must flow down to commercial subcontracts.
  • The policy behind both. FAR 44.402 says that, to the maximum extent practicable, contractors and subcontractors should not be required to apply clauses to suppliers of commercial products or commercial services other than those required by law or executive order or listed in 52.244-6.

Both clauses also let the prime include a minimal number of additional clauses needed to satisfy its own contractual obligations. “Minimal” is the operative word.

On DoW contracts, DFARS 252.244-7000 plays the same role for DFARS clauses, listing which ones flow down to subcontracts for commercial products and commercial services.

Clauses software companies see most

The required lists change as rules are added and removed, and many entries apply only above a dollar value or for certain work. Read the version in your prime’s contract. The ones a software company is most likely to meet include:

  • FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. Flows to subcontracts in which the subcontractor may have federal contract information residing in or transiting through its information system, including commercial subcontracts, other than those for commercially available off-the-shelf (COTS) items. It sets basic safeguarding requirements for those systems.
  • FAR 52.204-25, the Section 889 clause. Flows to all subcontracts, including commercial ones. It prohibits providing covered telecommunications equipment or services from the named Chinese companies and requires reporting if you find them. Our guide to Section 889 covers it in full.
  • FAR 52.204-23, the prohibition on hardware, software and services from Kaspersky Lab and related entities, which also flows to all subcontracts.
  • FAR 52.222-50, Combating Trafficking in Persons. Flows to all subcontracts.
  • FAR 52.203-13, Contractor Code of Business Ethics and Conduct. Flows to subcontracts above a dollar threshold with a performance period of more than 120 days.
  • FAR 52.219-8, Utilization of Small Business Concerns. Flows to subcontracts that offer further subcontracting opportunities. Our guide to small business subcontracting plans covers the larger-prime side of this.
  • Labor clauses where they apply. If your work includes services covered by the Service Contract Act, its clause flows down too. Our guide to the Service Contract Act covers when that happens.

Security clauses on Department of War work

Two DFARS clauses do most of the work for software suppliers on DoW contracts:

  • DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. The prime must flow it down to subcontracts for operationally critical support or where performance will involve covered defense information, which includes controlled unclassified information (CUI). A subcontractor that receives it must protect that information under NIST SP 800-171 and report cyber incidents to the DoW and to the prime. If the subcontractor uses a cloud service to store or process that information, the clause brings FedRAMP Moderate baseline or equivalent requirements with it.
  • The CMMC clause, DFARS 252.204-7021. Flows to subcontractors that will process, store or transmit federal contract information or CUI, at the CMMC level that fits the information the subcontractor handles.

The trigger for both is the information, not the dollar value. A small SaaS subcontract that will hold CUI can carry heavier security obligations than a much larger one that never touches it. Ask the prime early what information your product will receive, because that answer decides which clauses apply.

Self-attested compliance and verified compliance are not the same thing. A prime may accept a self-assessment for some requirements and need a third-party assessment for others. Know which one your subcontract asks for before you sign.

What you can push back on

Required flow-downs are not negotiable in substance. Much of the rest of a subcontract is. Points worth raising:

  • Blanket incorporation. Some primes flow down “all clauses of the prime contract” by reference, with “Government” read as “Contractor.” That can sweep in clauses that make no sense for a commercial software supplier. Ask for a list of the specific clauses that apply to your scope.
  • Applicability. Many required clauses apply only above a dollar value, for certain work, or when certain information is involved. If a clause’s trigger is not met for your subcontract, say so and ask for it to be removed or marked not applicable.
  • Your commercial license. A commercial software subcontract can usually be based on your standard license terms, with the federal clauses layered on top. Make sure the government’s rights in your software are stated clearly. Our guides to software license terms and data rights cover what to watch for.
  • Termination and changes. If the prime mirrors the government’s termination for convenience or changes clauses, make sure you get the matching protections too, such as recovery of costs and an equitable adjustment. Our guide to termination for convenience covers what is usually recoverable.
  • Reporting duties. Incident reporting, Section 889 reporting and similar duties need a named owner and a timeline in your company before the subcontract starts.

A review checklist

  • Ask for the prime contract’s clause list, or at least the clauses the prime says flow to you, and the prime contract number.
  • Find out whether the prime contract is commercial. That tells you whether 52.212-5(e) or 52.244-6 sets the required list.
  • Map each clause to its trigger. Dollar value, period of performance, type of work, and above all what information your product will handle.
  • Check the security clauses against your actual posture. Do not accept a CUI or CMMC obligation you cannot meet on day one.
  • Keep your commercial license in the deal and make the order of precedence clear.
  • Read the current rule text. The FAR is being rewritten under the Revolutionary FAR Overhaul, so section numbers, clause lists and wording may change. Confirm the clauses in your subcontract, and get advice from counsel on anything you are unsure of.

What this means for a software company

  • You inherit part of the prime contract. Flow-down clauses are how the government’s requirements reach you.
  • The required list for commercial subcontracts is short. FAR 52.212-5(e) and 52.244-6 set it, and a prime may add only a minimal number of clauses beyond it.
  • Security clauses follow the information. CUI brings DFARS 252.204-7012 and CMMC with it, whatever the subcontract’s size.
  • Blanket flow-down is negotiable. Ask for the specific clauses and their triggers.
  • Your license still matters. Keep your commercial terms and state the government’s rights clearly.

Where this fits

Primes choose subcontractors partly on whether those subcontractors can carry the clauses they need to flow down. Before you start those conversations, it helps to know how your company looks across the categories federal buyers and primes review, from compliance posture to registration and federal track record. Score your company’s federal readiness to see where you stand.

Frequently Asked Questions

What is a flow-down clause?

A flow-down clause is a term from the prime contract that the prime contractor must, or chooses to, include in its subcontracts. Some federal clauses say so in their own text, for example by requiring the contractor to insert the substance of the clause in subcontracts. Others reach subcontractors only because the prime writes them into the subcontract.

Does a prime have to flow down every clause in its contract?

No. For subcontracts for commercial products and commercial services, FAR 52.212-5(e) (in commercial prime contracts) and FAR 52.244-6 (in other prime contracts) list the FAR clauses the prime must flow down. The prime is not required to flow down any other FAR clause, though it may add a minimal number of additional clauses needed to meet its own contract obligations.

Which flow-down clauses matter most to a software company?

Usually the security and supply chain clauses. FAR 52.204-21 on basic safeguarding of federal contract information flows to subcontractors whose systems may hold that information, other than suppliers of commercially available off-the-shelf items. FAR 52.204-25, the Section 889 telecommunications clause, flows to all subcontracts. On Department of War work, DFARS 252.204-7012 and the CMMC clause can apply where the subcontractor handles controlled unclassified information.

Can a subcontractor negotiate flow-down clauses?

Yes, within limits. Clauses the regulations require the prime to flow down are not negotiable in substance, but whether they apply to your scope often is. Clauses a prime adds beyond the required list, or flows down by blanket reference to the whole prime contract, are business terms you can question and negotiate.

Alerts on new awards in your market

Save a search on your free account and you get an email when new awards match it.

Set a free alert