What RTX Requires
- A minimum CMMC level. FCI only needs Level 1 (Self). CUI needs Level 2 (Self). CUI under a prime contract that calls for Level 2 (C3PAO) or Level 3 needs Level 2 (C3PAO). RTX Annual Supplier Registration B.8, Sept 2026
- A system security plan. Certify that you can meet DFARS 7012, including having a system security plan. Registration B.5
- A current SPRS score. Have a Basic NIST SP 800-171 assessment less than 3 years old, with the score posted in SPRS before award. Registration B.7
- The flowdowns. DFARS 252.204-7012, 252.204-7021 and 252.240-7997 flow down to every order that isn't COTS only. RTX flowdown of U.S. Government clauses, Sept 2026
How RTX Checks
- Your annual registration. Report your current CMMC level, intended level, target date and annual SPRS affirmation. Registration B.8
- A written program. Keep a written security program aligned to a recognized framework, and give RTX a framework report on request. RTX Terms of Purchase 20.2, 20.3.4, Dec 2025
- Audits and evidence. RTX may audit your records on physical and network security. Keep self assessment evidence for 6 years. Terms 11.1, RTX supplier cybersecurity page
Incidents and Questions
Report a security incident within 72 hours to supplier.cyber.incident@rtx.com (Terms 20.3.10). RTX's May 2024 supplier letter also requires multifactor authentication from CUI subcontractors.