Subcontractor approval and flow-down terms on technology projects

Reference article · 5 min read

Most technology contracts are performed in part by someone other than the company that signed them. A prime may bring in a specialty firm for data conversion, a cloud platform for hosting, or an overseas team for development and first-level support. None of that is improper. The trouble starts when the agency learns about it by accident, months after award, from a support ticket signed by a company no one recognizes.

The agency has no contract with a subcontractor. It cannot direct that firm, audit it, or hold it to the security terms it negotiated with the prime. Everything the agency needs from the lower tiers travels through the prime: disclosed at proposal time, approved before it changes, and written into each subcontract as obligations the prime must enforce.

Disclosure at proposal time

Require proposers to name every entity that will perform any portion of the work, and state what each will do and where.

• All tiers, not just the first. A named subcontractor may itself subcontract, so the disclosure should reach the whole chain that touches the system, the data, or agency staff.
• Hosting and infrastructure explicitly. Many proposers do not treat their cloud platform, data center, or monitoring vendor as a subcontractor unless the question says so.
• Places of performance. Countries of performance, and the locations from which remote or administrative access will occur.
• The list as a contract document. Incorporate it as an exhibit, so changing it is a change to the contract rather than an internal vendor decision.

Approval before substitution

The contract should prohibit adding, replacing, or removing a subcontractor without prior written approval from the contract administrator. A workable clause sets out the process and its limits: the prime submits a written request with the reason, the replacement's qualifications, and any effect on price, schedule, or security; the agency may withhold approval; and approval creates no contractual relationship with the subcontractor and relieves the prime of nothing.

Also bar substitution of a firm whose participation was a factor in the evaluation, and require confirmation that no subcontractor is debarred or suspended. Participation-goal programs have their own substitution procedures, which control.

The prime remains solely responsible

State plainly that the prime is the single point of responsibility for performance, service levels, warranty, and remedies regardless of which tier does the work, and that subcontractors' acts and omissions are treated as the prime's own. Payment runs the same way: the agency pays the prime, the prime pays its subcontractors, and no subcontractor has a claim against the agency. Many states require a prime to pass payment down within a set period after it is paid; the rules vary, so confirm yours. Subcontractor-held source code, configurations, credentials, and data must also be deliverable to the agency on request.

Terms that must flow down to every tier

Require the prime to include these obligations in every subcontract and enforce them:

• Confidentiality and permitted use. Agency data used only to perform the contract, never for the vendor's own products, analytics, or model training.
• Security controls and incident reporting. The same requirements the prime accepted, with defined timeframes for reporting incidents up the chain.
• Background screening. Fingerprint-based and other checks where the program requires them, with the prime responsible for verification.
• Data handling and location. Where data is stored, processed, and accessed from, plus return and certified deletion at the end.
• Program-specific compliance. Criminal justice, federal tax, health, and student records carry their own rules, several relying on addenda signed by every entity touching the data.
• Audit and records access. Audit and records rights exercised through the prime, including independent assessment reports from hosting providers.
• Insurance. Coverage appropriate to the subcontractor's role, including cyber and professional liability where relevant.
• Retention, public records, and work product. Retention schedules, litigation holds, response to records requests, and assignment of intellectual property.

Hosting providers and offshore development

These are the two cases agencies most often miss. A software product usually runs on a large cloud platform the contract never names, putting agency data on infrastructure owned by a company outside the agreement. Ask which provider and regions, whether government community regions are used, what assessment evidence is available, and what notice you get if the vendor migrates. Hyperscale providers rarely modify standard terms, so the protection is the prime taking responsibility for the outcome and passing evidence through.

Offshore work is common for development, testing, and support, and it is not automatically prohibited. Some data categories restrict who may access the data and from where, as set by the governing program and the state control agency. List the countries of performance in the contract, require approval before another is added, and confirm the restrictions with the program authority before award.

What to ask and what to require

Ask during evaluation:

1. Name every entity that will touch the system, the data, or our staff, including hosting, monitoring, and support.
2. In which countries will work be performed, and from where will administrative access occur?
3. What screening applies to subcontractor personnel, and who verifies it?
4. Provide the flow-down language from your standard subcontract.
5. How, and how quickly, are we notified of an incident at a subcontractor?

Then require in the contract a named subcontractor exhibit, prior written approval for any change, the flow-down list above, a periodic attestation that the flow-downs are in place, and notice when a subcontract ends. If you find an undisclosed subcontractor mid-contract, treat it as a compliance matter: document it, require the disclosure and approval package in writing, and confirm the flow-down terms are in that subcontract before work continues.

HQT is a technology and software company working with state and local government agencies on software development, cloud, cybersecurity, and systems engineering.

Frequently asked questions