FAR Flow-Down Clauses: How to Determine What Applies to Your Suppliers

Government or defense contracts are often full of FAR and DFARS clauses, and now procurement has to figure out which ones belong in supplier agreements.

The useful question is pretty narrow: which requirements imposed on your company also need to be imposed on your suppliers?

You can answer that without becoming the person at the office holiday party who wants to discuss FAR prescriptions.

A flow-down is a contractual requirement that one party must pass to another party farther down the supply chain. The concept exists throughout commercial contracting. Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) clauses are a particular, heavily regulated type of flow-down.

Your customer buys something from you under a contract or PO. That agreement requires your company to follow certain rules. When a purchase is made to support a government contract, we will refer to it as a program-related procurement.

Some of those requirements stay with your company, while others must continue into contracts with suppliers and subcontractors.

Federal flow-downs get complicated because each clause can have its own applicability rules. A clause may depend on subcontract value, contract duration, what information the supplier receives, whether government property is involved, or whether the purchase qualifies as commercial or commercially available off-the-shelf (COTS). Some clauses tell you exactly what language to insert. Others require the "substance" of a clause. A few also make your supplier pass the obligation to its own lower-tier suppliers.

A threshold is a measurable condition, often a dollar amount or contract duration, above which a requirement applies. A trigger is a fact about the supplier relationship or the work being performed that causes a requirement to apply.

There is no universal dollar cutoff that tells you whether a program-related PO to a supplier needs to have FAR or DFARS clauses flowed down. Some requirements are driven by contract value. Others depend on what the supplier receives, handles, or does.

That variety is why your analysis needs to happen clause by clause. A $50 purchase order for a standard commercial component may have no flow-down requirements because it does not meet any applicable threshold or trigger. A supplier supporting the same program could require additional obligations if it handles controlled information, government property, or technical data.

The practical question is:

Does this specific program-related supplier purchase meet the conditions that make a flow-down requirement apply?

For each clause in a program-related procurement, evaluate it using the following four questions. The first question determines whether the requirement applies. The next questions determine whether that applicable requirement becomes a flow-down requirement and what belongs in the supplier contract.

1. Does this requirement meet the applicable threshold or trigger?

Determine whether it is an applicable requirement by comparing it against the appropriate thresholds and triggers.

For a dollar threshold, compare it with the value of the supplier PO or subcontract you are placing. For an operational trigger, look at the facts surrounding the purchase.

If you determine the requirement is not applicable, stop and move on to the next requirement.

2. Does this applicable requirement apply to this supplier based on what they will do, receive, or handle?

Some applicable requirements depend on the supplier's actual role in the program-related procurement. Review what the supplier will do, receive, or handle to determine whether the requirement applies to this supplier.

For example, a supplier that receives CUI may require cybersecurity-related flow-down obligations. A supplier that only provides a commercial component and receives no controlled information, government property, or technical data may not.

Other supplier-specific conditions may include whether the supplier will: - receive, store, process, or transmit FCI or CUI - handle covered defense information - receive government property - create technical data - provide technical data for government delivery - provide certified cost or pricing data - perform work in a particular country - place qualifying subcontracts

If the applicable requirement does not apply to this supplier, stop and move on to the next requirement.

3. Does this applicable requirement actually need to be passed to your supplier?

Once you determine that the applicable requirement applies to this particular procurement, review the clause language to determine whether the obligation must continue downstream.

Look for references to subcontracts, purchase orders, suppliers, lower tiers, or further subcontracting. Then determine whether the applicable requirement must continue downstream.

If the applicable requirement applies to this procurement and must be passed downstream, it is a flow-down requirement. Continue to the next question to determine what must be included in the supplier contract.

4. What exactly must go into the supplier contract?

Once you determine that a requirement must be flowed down, identify exactly what the governing clause requires you to include in the PO or subcontract.

Depending on the requirement, that could mean: - the complete clause - incorporation by reference - the clause with party names changed - the substance of the clause - a specific contractual obligation - a certification or representation - cybersecurity or information-handling terms - audit and record-retention obligations - government-property controls - a requirement for further lower-tier flow-down

Wording matters. DFARS 252.227-7013, for example, contains specific downstream instructions when covered technical data will be obtained from a subcontractor for delivery to the government. FAR 52.245-1 similarly contains subcontract requirements where government property is acquired or furnished for subcontract performance.

You can turn this analysis into a repeatable workflow without asking every engineer who buys a connector to study federal procurement law.

Start with the customer contract and identify purchasing-related requirements that could affect supplier purchases. Review those requirements against the appropriate thresholds and triggers to determine which ones are applicable.

For each applicable requirement, evaluate whether it applies to the specific supplier based on what that supplier will do, receive, or handle. If it applies, determine whether the requirement must be passed downstream and what language or obligation belongs in the supplier contract.

Finally, document the decision. Record why a requirement was included or excluded, along with the facts that supported the decision.

A standard flow-down attachment can support this process. It cannot replace it.

Say your company is delivering hardware for a DoD program and your customer contract includes a collection of FAR and DFARS requirements. You need to place a PO for a commercial electronic component.

Start by reviewing the purchasing-related requirements in the customer contract.

Check the thresholds and triggers to identify applicable requirements. Determine whether the supplier will receive controlled information, government property, technical data, or anything else that creates a supplier-specific condition.

Then review each applicable requirement to determine whether it must be passed to the supplier. If a flow-down is required, include the required language or obligation in the PO.

Passing every customer clause to every supplier is one of the easiest mistakes to make. It can burden commercial suppliers with requirements that do not apply to their purchase and create unnecessary contractual obligations.

Small POs create another common mistake. A low dollar value may eliminate some threshold-based requirements, but information handling, government property, technical data, or other triggers may still apply.

Commercial and COTS classifications also require careful review. They can narrow the applicable clause set, but they do not automatically eliminate flow-down requirements.

Standard clause attachments cause trouble when teams treat them as the analysis itself. A maintained clause library saves time, but somebody still needs to determine whether each requirement applies to the specific procurement.

You do not need an encyclopedic knowledge of every FAR clause to make better supplier flow-down decisions. You need a disciplined way to evaluate the requirements connected to your customer contract.

Ask four questions: 1. Does this requirement meet the applicable threshold or trigger? 2. Does this applicable requirement apply to this supplier based on what they will do, receive, or handle? 3. Does this applicable requirement actually need to be passed to your supplier? 4. What exactly must go into the supplier contract?

The goal is accurate applicability. Every supplier PO should contain the requirements that belong there, in the form the governing clauses require, with a record showing how you reached the decision.

Ready to let Cofactr handle sourcing, negotiations, storage, kitting, and delivery while your team focuses on building products? It's free to get started with Cofactr today.

What is a FAR flow-down clause?

A FAR flow-down is a contractual requirement your company must pass to a supplier or subcontractor when the governing clause and procurement facts require downstream application.

How do I determine which FAR clauses apply to a supplier?

Review each purchasing-related clause for applicable thresholds or triggers, supplier activities, downstream requirements, and the specific language or obligation required in the supplier agreement.

Why does supplier PO value matter for FAR flow-downs?

Some clauses use dollar thresholds. FAR 52.203-13, for example, applies to qualifying subcontracts exceeding $7.5 million when the performance period exceeds 120 days.

Can I exclude FAR flow-downs from a small purchase order?

Sometimes. Low value may eliminate threshold-based clauses, but requirements involving FCI, CUI, government property, technical data, or other operational triggers can still apply.

What is the difference between a threshold and a trigger?

A threshold is measurable, such as subcontract value or duration. A trigger is a procurement fact, such as receiving government property, CUI, FCI, or covered technical data.

How do I know whether a cybersecurity clause must flow down?

Check what information the supplier processes, stores, or transmits. FAR 52.204-21 addresses FCI, while DFARS 252.204-7021 addresses FCI or CUI, with COTS exclusions.

Can I use the same FAR flow-down attachment for every supplier?

A standard attachment can support purchasing, but each procurement still requires applicability analysis based on thresholds, triggers, supplier responsibilities, commercial status, and governing clause language.

What should I put in a supplier contract when a clause applies?

Follow the governing clause's downstream instructions. Required content may include the complete clause, incorporation by reference, modified party names, substantive obligations, certifications, or lower-tier flow-down requirements.

Do I need FAR or DFARS flow-downs for COTS purchases?

Possibly. COTS status can narrow applicable requirements, and certain clauses expressly exclude COTS items, but the classification does not automatically remove every potential flow-down obligation.

Why should FAR flow-down decisions be documented?

Documenting each inclusion or exclusion records the applicable threshold, trigger, supplier facts, and contractual basis, giving procurement teams a defensible record of the flow-down analysis.