FAR and DFARS Flow-Down Review Guide

Flow-down clauses exist because the government has one contract, with the prime, and needs the obligations it cares about to survive every tier of performance underneath that contract. The mechanism for doing that is to require the prime to pass certain FAR and DFARS clauses down into its subcontracts, sometimes verbatim, sometimes with language that must be adapted to fit a party that has no direct relationship with the government at all. A subcontractor who has never seen the prime contract is left reading a list, or a set of attachments, and trying to work out which obligations are real, which are optional, and which were copied in without anyone checking whether they still make sense.

This is a harder read in 2026 than it was two years ago. The government began a full rewrite of the Federal Acquisition Regulation in 2026, described as the most extensive overhaul since the FAR was created, with parts being restructured and renumbered and clause text moving as the rewrite proceeds. A flow-down matrix built from an older template, or copied from a subcontract signed before the rewrite reached a given part, may no longer describe the clause it claims to cite. The safe habit for the length of the overhaul is to treat any flow-down list as a starting point and confirm the current clause number and text at acquisition.gov before relying on it.

How flow-downs arrive

Subcontracts deliver flow-down obligations one of two ways, and the difference matters more than most subcontractors treat it. The first is an enumerated list, sometimes called a flow-down matrix, that names the specific FAR and DFARS clauses that apply to your subcontract and attaches or restates their text. An enumerated list is readable. You can check each clause against the current regulation, ask why a given clause is included, and hold the prime to the specific set it gave you.

The second is wholesale incorporation, a single sentence stating that the applicable clauses of the prime contract are incorporated into the subcontract by reference. This is faster to draft and leaves the prime maximum flexibility, and it also means you are agreeing to obligations you have not read, some of which carry certification, audit, or cybersecurity duties with real compliance cost. If your subcontract uses wholesale incorporation, ask for the section of the prime contract that lists its own applicable clauses. You are entitled to know what you have agreed to before you sign it, not after a compliance review finds it.

A teaming agreement, when one exists ahead of the subcontract, usually previews which approach the eventual subcontract will take. If you are reviewing a teaming agreement first, our teaming agreement review checklist covers that question directly, and the same distinction between an enumerated list and wholesale incorporation applies at both stages.

The three tiers of clauses

Once you have the actual list, sort what is on it into three groups, because each group calls for a different response.

The first group is mandatory flow-downs, clauses that regulation requires the prime to pass down regardless of its own preference. This group commonly includes equal opportunity obligations under FAR 52.222-26, the combating trafficking in persons clause at FAR 52.222-50, whistleblower protections for contractor employees under FAR 52.203-17, and, above the dollar thresholds that trigger it, obligations tied to the prime’s small business subcontracting plan under the FAR 52.219 series. These clauses are not negotiable and their absence from your subcontract does not relieve you of the underlying duty. What you are checking for is that the prime wrote them down correctly, since an omitted or misquoted mandatory clause is a drafting defect worth raising before signature.

The second group is discretionary flow-downs, clauses the prime chose to include because they simplify its own risk management even though nothing in the FAR requires them at the subcontract tier. This group is not automatically a problem. It is a prompt to ask why a given clause is there and whether its substance actually matches your scope of work, rather than accepting it because it appeared on a template used for a different kind of subcontract.

The third group is the one worth the closest attention: clauses written for a direct relationship between a contractor and the government, copied into the subcontract without adjustment for the fact that you have no such relationship. Termination for convenience is the clearest example. In the prime contract, the government may terminate for its own convenience at its own discretion. Copied unchanged into a subcontract, that same clause can leave the convenience-termination right sitting with a government agency that has no contract with you at all, while granting your actual counterparty, the prime, no comparable right and no comparable duty. The fix is conforming, converting the clause so the termination-for-convenience right runs to the prime, on terms proportionate to what the prime itself faces from the government. A clause in this third group that has not been conformed should be struck or rewritten, not signed as written.

DFARS specifics for defense work

Subcontracts under a Department of Defense prime contract carry an additional layer of DFARS clauses on top of the FAR ones, and several carry compliance obligations that take time to meet, which is a reason to identify them early rather than at the end of a review. Do not assume every DFARS clause on a list applies to your scope; check each one against what you actually do under the subcontract.

Cybersecurity is the clause most worth reading closely. DFARS 252.204-7012 requires safeguarding of covered defense information and imposes cyber incident reporting duties, and it is frequently paired with a Cybersecurity Maturity Model Certification readiness obligation set by the specific level the prime contract requires. If your subcontract touches covered defense information, confirm which CMMC level applies to your scope and by what date, since meeting a certification level is not something a company arranges in the weeks before performance begins.

Two narrower categories are worth a check rather than a close read unless your scope triggers them. Specialty metals restrictions can apply if you are manufacturing or supplying certain items containing specified metals. Counterfeit parts detection and avoidance obligations can apply if electronic parts move through your supply chain. Neither belongs in every defense subcontract, and asking the prime to confirm whether your specific deliverable triggers either one is faster than reading the full clause text against a scope it may not even reach.

The conforming problem

Flow-down clauses are written in the voice of the prime contract, addressed to “ the Contracting Officer” and “the Government,” because that is the relationship the FAR governs directly. When a clause is copied into a subcontract, someone has to decide what those references mean at your tier, and that decision is called conforming. Some references should convert to the prime, since the prime is the only party you are actually in contract with and the only party positioned to exercise authority over your performance. Other references should stay pointed at the government, particularly where the underlying regulation gives the government itself a retained right, such as certain audit or inspection rights that exist independent of which company sits at your tier.

A subcontract that leaves every Contracting Officer and Government reference untouched has not made this decision at all, it has skipped it. That is a drafting defect, not a term you should quietly interpret in the prime’s favor because the clause reads that way on the page. Ask the prime to conform each unconformed reference explicitly, and treat a refusal to do so as information about how the rest of the subcontract will be administered.

Audit and records access

Many flow-down clauses give the government, the prime, or both a right to examine your records, and the scope of that right varies by contract type and dollar value. A commercial item subcontract generally carries a lighter audit obligation than a cost-reimbursement subcontract, and the retention period attached to the right can run well past final payment. Read the clause for three things: who may exercise the right, directly or only through the prime, how long the obligation survives after performance ends, and whether the scope of records covered is proportionate to the size and type of your subcontract. An audit clause copied from a much larger cost-type prime contract into a fixed-price commercial subcontract is a sign the flow-down list was not tailored to your agreement, and worth raising for that reason alone.

Ten-point flow-down review checklist

Work through the following, in order, against the actual subcontract rather than a summary of it.

1. Ask for the complete list of flow-down clauses, not a summary description.
2. Confirm whether each clause is enumerated specifically or incorporated wholesale by reference to the entire prime contract.
3. Identify the mandatory flow-downs and confirm each one appears with correct, current text.
4. Flag every clause that still reads “the Contracting Officer” or “ the Government” and ask how it has been conformed for the subcontract tier.
5. For defense work, confirm whether DFARS 252.204-7012 applies and, if so, which CMMC level and deadline attach to your scope.
6. Check specialty metals and counterfeit parts obligations only if your deliverable is a manufactured item or contains electronic parts.
7. Read the audit and records access clause for who may exercise it, how long it survives, and whether its scope matches your subcontract’s size and type.
8. Compare the flow-down list against the current text at acquisition.gov, given the ongoing FAR rewrite, rather than trusting the date on the template it came from.
9. Confirm termination rights are conformed to run in the prime’s favor where the original clause referenced the government’s discretion, and are not left pointed at a party you have no contract with.
10. Get the prime’s threshold determinations in writing, since several mandatory clauses trigger only above stated dollar values or under specific contract types.

What to ask the prime for

If the flow-down picture is unclear after your own read, four requests will resolve most of it. Ask for the clause matrix or list actually used to build your subcontract, rather than a general description of “standard clauses.” Ask for the section of the prime contract that lists its own incorporated clauses, so you can check the subcontract’s flow-downs against their source rather than against the prime’s summary of them. Ask for the prime’s own determination of which dollar and contract-type thresholds apply to your subcontract, since that determination controls which mandatory clauses reach you at all. And for defense work, ask for written confirmation of the cybersecurity and CMMC applicability determination rather than inferring it from a clause list that may predate the current requirement. A prime that can answer all four quickly has done the underlying work already. A prime that cannot has left that work for you to do at your own risk.