Choose how to support suppliers
How much help does this group need? Compare three ways to bring suppliers into the program. Funding, support, and access terms are agreed for each program.
Recommend
Recommend Deep Fathom when a supplier can choose and fund its own approach, but needs a clear route from requirements to work.
- Prime: Explains the requirements and who will review the response.
- Supplier: Decides whether to adopt the platform and funds its own use.
Coordinate a rollout
Coordinate a rollout when a defined group needs common onboarding, checkpoints, and support.
- Prime: Selects the suppliers and agrees who handles onboarding, support, and reviews.
- Supplier: Names the people who will do the work, confirms scope, and keeps its own record current.
Fund access
Consider funding access when your program depends on a supplier that needs help getting started. You can pay an agreed share of the costs. The supplier still carries out the work.
- Prime: Sets the budget, duration, and decision that the investment must support.
- Supplier: Completes and maintains the work, and makes accurate claims about its status.
Agree what the program will cover
Agree what you’ll pay for, who will help suppliers, and how their work continues when funding ends. The aim is to help suppliers meet and maintain the requirements your program depends on.
Separate the cost of putting safeguards in place, maintaining them, and completing any required assessment. NDIA’s 2025 report presents survey estimates for implementation and maintenance that explicitly exclude CMMC assessment and certification costs. Those estimates are not a price for your supplier group. NDIA report, page 33.
- Who joins: Name the suppliers, the work that depends on them, and the decision the program supports.
- Funding and cost: State what the prime pays for, what remains supplier-funded, and when the arrangement ends. Consider staff time, implementation, outside support, platform fees, administration, and maintenance. Compare those costs with the group’s starting point before claiming savings.
- Onboarding and support: Identify who invites suppliers, answers questions, and performs technical implementation.
- Sharing and review: Define what a supplier may provide, who may review it, and the decision it informs.
- Continuity: Decide how suppliers retain needed records and continue work when sponsorship ends.
Start with one group of suppliers
Consider a subprime buying machined housings for one subsystem before a subcontract review. One shop needs help working out which systems the requirements cover. Another needs to update its evidence.
In this illustrative example, the subprime starts with those shops:
- Identify the suppliers and the work your program needs from them.
- Confirm which requirements apply to that work and the information involved.
- Ask each supplier for its required status or declaration, what it covers, and where it needs help.
- Agree funding, support, permitted sharing, and review dates.
- Review progress and unresolved gaps before adding more suppliers.
Give suppliers a place to do the work
A supplier can use Deep Fathom to assess gaps, assign tasks, and organize evidence as its team puts safeguards in place. That work supports its system security plan and plans to fix remaining gaps. Snapshots preserve a record for later review.
On the buyer side, Flowdown records the supplier’s obligation, recorded status, and acknowledgment alongside review notes and linked evidence. Your reviewer records what was checked and when. Sharing arrangements still need to be agreed with each supplier.
Bring one group of suppliers and the decision you’re working toward. We’ll discuss how to roll out Deep Fathom, what support suppliers need, and whether funding access makes sense. Explore the supplier program.
In Deep Fathom
A workspace for the supplier doing the work.
Implementation work has a home in Deep Fathom. This is the supplier workspace; funding and sharing arrangements are agreed for each program.
Expand product view Keep responsibilities clear
The governing terms still control. FAR 52.204-21 and DFARS 252.204-7012 apply under different conditions. Where DFARS 252.204-7021 applies, its assessment and affirmation routes remain separate from a prime’s review.
Suppliers and their service providers implement safeguards. The prime makes its own review decisions. Paying for a workspace doesn’t transfer those duties or certify a supplier. Confirm what applies and the required response for each relationship.