Bedrock Flowdown is a roster of your subcontractors' CMMC and DFARS status — SPRS scores, C3PAO certifications, annual affirmations, 7012 attestations — evaluated against the level each contract flows down. Subs update it themselves, by link. You get the roll-up and the audit trail.
Free for up to 10 subcontractors. No card. Built by Foxx Cyber, the team behind Bedrock CMMC.
Most primes track flow-down in a spreadsheet and an email thread. When a solicitation lands, nobody is sure which subs are actually certified. This fixes that.
The contract number and the CMMC level it flows down — Level 2 C3PAO for CUI, self-assessment for FCI. Link the subs on it.
One click sends a private link. The sub fills in their SPRS score, certification, affirmation and 7012 status. No account, no attachments to chase.
Every sub is green, amber or red against the level their contracts require, with the reason and the next date that matters. Export it for the contracting officer.
Level 1 and Level 2 self-assessments, with the three-year validity and annual affirmation clock running automatically.
Level 2 C3PAO or Level 3 DIBCAC: who certified, when, and when it expires. Warns 90 days out.
Whether the sub has attested to incident reporting and cloud FedRAMP-equivalence — expected on any CUI contract.
Nothing is edited in place. Every attestation is a dated row with its source — you, or the sub via a request link.
Open a contract and see exactly which subs are below the required level, with the reason. That's your flow-down diligence record.
Roster with posture, and the full evidence trail. Opens in Excel; hand it to an auditor or a CO.
Primes pay when they need automation and scale. Subcontractors never pay to answer a request.
Interested? Sign up free and we'll be in touch.
Find out now which of your subs are ready — not when the CO asks.
Start free