Checklist
Government Contractor Startup Checklist
What to put in place before your first federal award creates security obligations you cannot meet.
Intermediate
40 min
Free
FAR
DFARS
Published · v1.0.0 · 2026-08-01
Guide
Understanding Federal Contract Requirements
How security obligations actually reach you: clauses, flow-downs, and the questions to ask before you sign.
- Intended audience
- Owners, capture teams, and subcontractors
- Difficulty
- Intermediate
- Estimated time
- 13 minutes
- Access
- Free
FAR
DFARS
NIST SP 800-171
Government contracting
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Identify the different channels through which security obligations reach a contractor.
- Explain the difference between standard acquisition clauses and agency-specific supplements.
- Describe how flow-down language obligates subcontractors.
- List the key questions to ask before signing a federal contract or subcontract.
- Assess a statement of work for embedded security standard references.
Where obligations come from
- Standard acquisition clauses incorporated into the contract.
- Agency-specific supplements.
- Flow-down language in a prime's subcontract.
- Statements of work that reference security standards directly.
Questions to ask before signing
- Will we receive or create FCI or CUI?
- Which security standard is named, and at what scope?
- What are the incident reporting timelines?
- What must we flow down to our own subcontractors?
Key takeaways
- Security obligations reach contractors through standard acquisition clauses, agency-specific supplements, prime flow-down language, and statements of work.
- Flow-down language in a prime's subcontract can impose the same security obligations on subcontractors.
- Before signing, a contractor should determine whether it will receive or create FCI or CUI.
- Contracts should be checked for the specific security standard named and the scope at which it applies.
- Incident reporting timelines and subcontractor flow-down obligations must be clarified before work begins.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
Acquisition.gov
FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems(opens in a new tab)Link last confirmed 2026-02-01
Acquisition.gov
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting(opens in a new tab)Link last confirmed 2026-02-01
NIST · Revision 3
SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems(opens in a new tab)Link last confirmed 2026-02-01
National Archives (ISOO)
Controlled Unclassified Information (CUI) Registry(opens in a new tab)Link last confirmed 2026-02-01
Earn a Certificate of Training Completion
Complete every section, acknowledge, and pass the knowledge check.
Sections opened0 of 2
This certificate recognizes completion of educational training material only. It is not a professional certification, accreditation, license, compliance assessment, audit result, or attestation of compliance with any law, regulation, or contract requirement. ComplianceAnvil is not a certification authority, accreditation body, assessor, or law firm.
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal); DoD supply chain
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This resource is educational readiness material. ComplianceAnvil is not a certification authority, assessor, or law firm, and this content is not legal advice or a compliance assessment.
Related resources
Matched on shared frameworks, topics, and program packs.
Checklist
CMMC Readiness Checklist
Work through the preparation steps most small contractors miss before a CMMC assessment: scope, system boundary, documentation, and evidence.
Intermediate
45 min
Free
CMMC
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Exercise
Identify CUI Examples
Practice separating CUI from FCI and from ordinary business information.
Advanced
15 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Checklist
NIST SP 800-171 Preparation Checklist
A plain-language preparation pass across the requirement families, focused on what a small business must produce and prove.
Advanced
60 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Quick reference
Compliance Acronyms — One Page
The acronyms that appear in contracts and assessments, defined in one line each.
Beginner
5 min
Free
CMMC
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Guide
Understanding Controlled Unclassified Information (CUI)
How to recognize CUI, why marking matters, and what changes the moment you handle it.
Intermediate
12 min
Free
NIST SP 800-171
DFARS
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.