CUI Contract Flow-Down Agreement
Version 2026-09-29 · RodyWorks, LLC. (EzFormBuilder) · DFARS 252.204-7012
This CUI Contract Flow-Down Agreement ("Agreement") supplements and is incorporated into the EzFormBuilder Terms of Use between RodyWorks, LLC., operator of EzFormBuilder ("EFB"), and the customer entity accepting it ("Customer"). It governs Covered Defense Information and other Controlled Unclassified Information that Customer creates, receives, maintains, or transmits through the EzFormBuilder services ("Services") under a United States Government contract, task order, or subcontract identified by Customer at the time of acceptance (the "Identified Contract"). It is effective on the date Customer accepts it electronically (the "Effective Date"). EFB accepts this Agreement as a flow-down of DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, pursuant to paragraph (m) of that clause. Customer must identify the Identified Contract at acceptance; a flow-down that does not name the contract from which it flows establishes no obligation and is not evidence of compliance.
1. Definitions
Capitalized terms not defined here have the meanings given in DFARS 252.204-7012, 32 CFR Part 2002, and 32 CFR Part 170. "CUI" means Controlled Unclassified Information as defined in 32 CFR 2002.4 and listed in the NARA CUI Registry. "Covered Defense Information" ("CDI") means unclassified controlled technical information or other information described in the CUI Registry that requires safeguarding or dissemination controls and is either marked or otherwise identified in the Identified Contract and provided to or collected by EFB in support of contract performance. "Covered Contractor Information System" means an information system that is owned or operated by a contractor that processes, stores, or transmits CDI. "Cyber Incident", "Compromise", "Media", "Rapidly Report", and "Technical Information" have the meanings given in DFARS 252.204-7012(a). "NIST SP 800-171" means NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, at the revision specified in the Identified Contract.
2. Scope and the Boundary of the Covered System
2.1 The Covered Contractor Information System under this Agreement is limited to the EzFormBuilder CUI tier: the form submission, storage, and retrieval paths for forms an authorized Customer administrator has placed in CUI encryption mode, together with the supporting database, key management, logging, and backup services that serve those forms. 2.2 CUI must not be submitted through forms configured in any other encryption mode, nor placed in fields outside the encrypted submission payload (for example, a form title, a slug, a file name, or an email subject line). Customer is responsible for configuring forms so that CUI is confined to the CUI tier. 2.3 EFB does not assess, and makes no representation regarding, whether particular data constitutes CUI or CDI. Identification and marking of CUI in accordance with 32 CFR 2002.20 and the Identified Contract is Customer's responsibility.
3. EFB Safeguarding Obligations
3.1 EFB implements the security requirements of NIST SP 800-171 for the Covered Contractor Information System described in Section 2, as required by DFARS 252.204-7012(b)(2)(i). EFB maintains a System Security Plan and, where any requirement is not yet fully implemented, a Plan of Action, in accordance with NIST SP 800-171 3.12.4 and 3.12.2. 3.2 Cryptographic protection. CUI is encrypted at rest using AWS Key Management Service, a cryptographic module validated under FIPS 140 (NIST SP 800-171 3.13.11), reached over FIPS-validated service endpoints. Encryption keys are maintained per tier; no key is shared between the CUI tier and any other tier. CUI is encrypted in transit using TLS. 3.3 Isolation. The CUI tier is maintained in a separate database with a dedicated database role. Cross-tier database access is removed rather than merely restricted, so that CUI cannot be reached from, or joined to, data held under any other regulatory regime. 3.4 Audit and accountability. Access to CUI, including every unsuccessful attempt, is recorded in an append-only audit log sufficient to trace actions to individual users (NIST SP 800-171 3.3.1, 3.3.2). 3.5 Cloud service provider. Where EFB uses an external cloud service provider to store, process, or transmit CUI, that provider meets security requirements equivalent to the FedRAMP Moderate baseline, as required by DFARS 252.204-7012(b)(2)(ii)(D). EFB maintains the corresponding Customer Responsibility Matrix and inherits the provider's controls only to the extent that matrix permits.
4. Cyber Incident Reporting
4.1 On discovery of a Cyber Incident that affects the Covered Contractor Information System, CUI residing on it, or EFB's ability to perform operationally critical support under the Identified Contract, EFB will conduct a review for evidence of compromise and will Rapidly Report the incident to the Department of Defense at https://dibnet.dod.mil within 72 hours of discovery, as required by DFARS 252.204-7012(c). 4.2 EFB will notify Customer of the same incident without unreasonable delay and no later than 72 hours after discovery, and will provide the incident report number and the information reasonably available to allow Customer to meet its own obligations under the Identified Contract. 4.3 Reporting under this Section requires a DoD-approved medium assurance certificate as provided in DFARS 252.204-7012(c)(3). Where EFB does not hold such a certificate at the time of an incident, EFB will report through Customer without delay and will provide Customer everything necessary to report within the same 72-hour window; Customer remains responsible for its own reporting obligation in every case. 4.4 Media preservation. EFB will preserve and protect images of known affected information systems and all relevant monitoring and packet capture data for at least 90 days from submission of the incident report, to allow DoD to request the media (DFARS 252.204-7012(e)). 4.5 Malicious software discovered and isolated in connection with a reported incident will be submitted to the DoD Cyber Crime Center in accordance with DFARS 252.204-7012(d); malicious software will not be sent to Customer. 4.6 EFB will provide DoD access to additional information or equipment necessary to conduct a forensic analysis, to the extent required by DFARS 252.204-7012(f), and understands that DoD may conduct a damage assessment under paragraph (g).
5. Customer Responsibilities
Customer is solely responsible for, and represents and warrants that: 5.1 The Identified Contract exists, is in force, and contains DFARS 252.204-7012, and Customer has authority to flow that clause down to EFB; 5.2 It will configure forms so that CUI is collected only through the CUI tier, and will restrict authorized users and viewers to persons permitted to access the CUI under the Identified Contract; 5.3 It will mark and identify CUI as required by 32 CFR 2002.20 and the Identified Contract, and will not rely on EFB to determine what is or is not CUI; 5.4 It will not submit through the Services any information subject to the International Traffic in Arms Regulations (22 CFR Parts 120-130), the Export Administration Regulations (15 CFR Parts 730-774), Classified National Security Information, or information requiring an AWS GovCloud (US) or other sovereign enclave. The Services operate in AWS commercial United States regions, which are authorized at FedRAMP Moderate but are not an ITAR-controlled environment; and 5.5 It is responsible for the acts and omissions of its authorized users.
6. CMMC
6.1 EFB maintains the NIST SP 800-171 implementation described in Section 3 and posts its summary level score in the Supplier Performance Risk System (SPRS) as required by DFARS 252.204-7019 and 252.204-7020, where applicable to EFB. 6.2 Where the Identified Contract includes DFARS 252.204-7021, EFB will maintain the Cybersecurity Maturity Model Certification level required by that contract for the duration of performance, in accordance with 32 CFR Part 170, and will provide Customer its current assessment status on request. 6.3 EFB does not certify Customer. Customer's own CMMC status, assessment, and affirmation remain Customer's responsibility. EFB's status is one input to Customer's assessment of its external service providers, not a substitute for it.
7. Subcontractors and Flow-Down
7.1 EFB will include the substance of DFARS 252.204-7012 in subcontracts and other agreements with providers that store, process, or transmit CUI on EFB's behalf, as required by paragraph (m) of that clause, without alteration except to identify the parties. 7.2 EFB maintains a current list of such providers and will make it available to Customer on request.
8. Term, Revocation, and Disposition
8.1 This Agreement takes effect on the Effective Date and continues until terminated under this Section or superseded by a later version accepted by Customer. 8.2 Customer may revoke this Agreement at any time through account settings. Revocation prevents new CUI submissions and prevents new forms from being placed in CUI mode. Revocation does not delete or re-encrypt existing records, which may be subject to retention obligations under the Identified Contract; disposition is addressed in Section 8.3. 8.3 On termination of the Identified Contract or on Customer's written request, EFB will return or destroy CUI held on Customer's behalf, in accordance with NIST SP 800-171 3.8.3, and will provide written confirmation of destruction. Where return or destruction is infeasible, EFB will extend the protections of this Agreement to the retained CUI and limit further use and disclosure to the purposes that make return or destruction infeasible. 8.4 EFB will notify Customer before any material change to this Agreement. Continued submission of CUI after a version change requires acceptance of the current version; EFB will prevent new CUI submissions until the current version is accepted.
9. Audit and Evidence
9.1 On reasonable written request and no more than once in any twelve-month period, EFB will provide Customer its System Security Plan summary, its current SPRS summary level score where applicable, its Customer Responsibility Matrix, and the results of its most recent security assessment, subject to a confidentiality undertaking. 9.2 Nothing in this Section requires EFB to disclose information about another customer, or information whose disclosure would itself create a security risk.
10. Order of Precedence and General
10.1 In the event of a conflict between this Agreement and the EzFormBuilder Terms of Use with respect to CUI, this Agreement controls. In the event of a conflict between this Agreement and the Identified Contract, the Identified Contract controls as between Customer and the Government; this Agreement is not a contract with the Government and creates no privity between EFB and the Government. 10.2 This Agreement does not alter Customer's obligations under any other agreement, including any Business Associate Agreement or Data Privacy Agreement Customer has accepted. Where the same data is subject to more than one regime, the most protective applicable requirement governs. 10.3 Acceptance is recorded with Customer's account identifier, the Identified Contract reference, the version accepted, the date and time of acceptance, and the originating IP address. That record is the evidence of this flow-down.
RodyWorks, LLC. (EzFormBuilder) is bound by this Agreement upon Customer’s acceptance of the version then presented through the Services. Canonical text: docs/legal/CUI-FLOWDOWN-AGREEMENT.template.md.