How to Spot a Client in the DoD Industrial Base That Handles CUI

What it is

A field method for MSPs/MSSPs to determine whether a client falls under DFARS 252.204-7012/-7021, CMMC, and NIST 800-171 — even when the client doesn't self-identify as a defense contractor. Authored by Ryan Bonner (founder/CEO of DEFCERT), published on the Huntress blog. Its value over the summary is the interpretation logic: what a given signal actually proves, and the compliance deadline it turns on.

How it works

The method pairs public-record research with client questions, but the actionable part is the decision rules attached to each signal:

• USASpending.gov → search under the Recipient tab. Shows direct contract awards only (not subcontracts), so it establishes direct defense exposure and quantifies dollar impact — a negative result does not clear a subcontractor.
• Nadcap accreditation (public directory) → strongly implies subcontracted work for aerospace primes, which "often involves CUI."
• DFARS clauses in a client's subcontracts → flow-down clauses mean the client is a defense subcontractor. This is definitional, not suggestive.
• DoD distribution statements on received technical data → check whether tied to a contract/PO with DFARS clauses; if so, defense contractor. Note: not all distribution-statement docs are CUI, but even a few qualifying ones make the systems that process/store/transmit them CUI data flows.
• PIEE account → required for WAWF payments and for submitting NIST 800-171 self-assessments via SPRS. If they have PIEE, ask whether they submitted a "Basic self-assessment" — only defense contractors submit these, so a yes is confirmation.

Other softer signals: ITAR/DDTC registration, AS9100 (vs. plain ISO 9001), listed contract vehicles (IDIQ, GWAC, BPA, OTA), and "Defense" in Industries Served.

flowchart TD
    A[Client] --> B{DFARS clauses in<br/>subcontracts?}
    B -->|yes| Z[Defense contractor / CUI in scope]
    B -->|no| C{Distribution-stmt docs<br/>tied to DFARS contract?}
    C -->|yes| Z
    C -->|no| D{PIEE + Basic<br/>self-assessment?}
    D -->|yes| Z
    D -->|no| E[Weigh softer signals:<br/>Nadcap, ITAR, AS9100]

What to do

Run the public research first, then ask the three definitional questions (DFARS clauses in contracts/POs; DoD distribution-statement technical data; PIEE account + prior Basic self-assessment). A yes on any confirms scope.

Caveats

• USASpending omits subcontract awards, so it will miss subcontractors entirely — the group the article says most often fails to self-identify.
• Distribution statements alone don't establish CUI; they must be checked against DFARS-clause contracts.
• The closing "How Huntress helps" section is vendor marketing (claims coverage of 51 of 110 CMMC Level 2 controls, cites a November 10, 2025 CMMC deadline) — the deadline is the one useful fact there.