The trade subs most likely to misprice a Davis-Bacon job, confuse markup with margin, or run out of cash waiting on retainage are, almost without exception, the same subs who have never run a CMMC self-assessment. Both gaps come from the same place — and both are now the prime's problem to manage. This brief covers the connection, and the four free tools that help close it.
Executive Summary
Most CMMC compliance writing treats cybersecurity documentation as a standalone problem — separate from the financial management gaps that already exist at the small trade sub level. It isn't separate. A 10-to-15-person electrical, HVAC, or mechanical sub that has no process for calculating its true overhead and burden rate, no system for verifying Davis-Bacon wage determinations, and no visibility into retainage held across active task orders is a sub running entirely on owner intuition rather than documented process. That same sub, almost by definition, has never heard of SPRS and has no self-assessment on file.
For a prime contractor, this means the financial-health signal and the compliance-risk signal are the same signal. A sub who can show you their numbers is a sub who can show you their compliance posture — or can be walked through doing so. This brief covers why the two gaps share a root cause, what each one actually costs a prime managing a NAVFAC Pacific or MILCON supply chain, and introduces four free calculators PCC built specifically for this population — tools a prime can hand to any sub today, independent of whether that sub has started a CMMC program yet.
The shared root cause
The typical Level 1 trade sub on a Hawaii or Guam military construction project does not have an estimator, a controller, or a compliance officer. The owner bids the job, runs payroll, and manages the crew — often from a truck, using QuickBooks or a spreadsheet and whatever wage number feels right. This isn't negligence. It's the structural reality of a 5-to-15-person trade business. But it produces predictable, compounding errors on federal work specifically, where the math is less forgiving than commercial bidding.
Burden rate miscalculation is the most common. Subs frequently bid using a worker's direct hourly wage without adding payroll taxes, workers' compensation, liability insurance, and other true labor costs — understating their actual cost to perform by a meaningful margin before the job even starts. On a single-trade job this might be survivable. Across a multi-year NAVFAC MACC task order pipeline, it erodes margin steadily until the sub is underwater without understanding why.
Markup and margin get treated as the same thing — they aren't. A sub who marks up cost by 20% is not earning a 20% margin; they're earning roughly 16.7%. That gap, multiplied across every bid, is real money a sub thinks they have and don't.
Davis-Bacon wage determinations are misapplied. Federal construction work requires paying the correct prevailing wage by trade classification and county, per the Department of Labor's published wage determinations. Getting the classification wrong — or not checking it at all — creates two separate problems: an inaccurate bid, and a prevailing wage violation that carries back-wage liability and potential debarment under the Davis-Bacon Related Acts.
Retainage is a cash flow blind spot. NAVFAC and USACE contracts typically withhold a percentage of progress payments until project closeout. A sub who hasn't planned for that gap — especially across several concurrent task orders — can run out of working capital mid-project even while technically profitable on paper.
None of these errors are cybersecurity problems. But the population making them — under-resourced, no back-office capacity, no formal process for any number that matters — is the exact same population that has never run a CMMC self-assessment, doesn't know what SPRS is, and has no documentation if a prime asks for their compliance posture. A sub with no process for their burden rate has no process for their compliance posture either. It's the same gap wearing two different hats.
Why it's the prime's problem
These two risks fail differently, but they both land on the prime. A sub who misjudged their burden rate or got caught short by retainage doesn't quietly absorb the loss — they slow down, ask for early payment, cut corners on labor, or walk off the job mid-performance. On a MILCON task order with a fixed completion date, that's a schedule risk that can cascade into liquidated damages and a strained relationship with the contracting officer. A sub with no SPRS score and no compliance documentation is a different kind of exposure — the False Claims Act risk this series has covered in prior issues — but it surfaces through the exact same channel: a prime contractor who didn't ask the right questions before award.
The diagnostic value of the question itself
Asking a sub to show their burden rate calculation, their Davis-Bacon wage verification, or their retainage tracking is not an accounting exercise — it's a fast, low-friction way to identify which subs in your supply chain are operating with structure and which are operating on intuition. The subs who can't answer the financial question are very likely the same subs who can't answer the compliance question either. That correlation is useful: it tells you where to focus onboarding support before either risk becomes a contract problem.
Risk signal to resource
The table below maps the financial-literacy gaps most common among Pacific trade subs to what each one signals for the prime, and the specific free PCC resource built to close it. All four tools are live now, free to use, and free to share with any sub in your supply chain — regardless of where they are in a CMMC program.
| If a sub shows you this | It signals | Free PCC tool |
|---|---|---|
| A bid based on straight labor rate, no burden calculation | Margin erosion risk across the contract period | Overhead & Burden Rate Calculator → |
| Uncertainty about the correct wage classification for a task order | Davis-Bacon violation exposure — back wages, possible debarment | Davis-Bacon Wage Lookup → |
| "20% markup" used interchangeably with "20% margin" | True profitability is lower than the sub believes — further erosion ahead | Markup vs. Margin Calculator → |
| No visibility into retainage held across active task orders | Cash flow blind spot — risk of mid-project financial distress | Retainage Tracker → |
| No SPRS score, no self-assessment, "we'll figure that out" | FCA exposure at the moment of award — this is the prime's documented gap, not the sub's | Sub Compliance Risk Check → |
The pattern across all five rows is the same: a sub showing any one of the first four gaps is a strong candidate to also be showing the fifth. Lead with the financial tools — they're less intimidating, faster to use, and immediately useful to the sub regardless of their compliance status — and the compliance conversation tends to follow naturally once the sub trusts that you're trying to help them get paid correctly, not just checking a box.
Action items
Add the four free calculators to your sub onboarding packet — not just the CMMC materials. They cost the sub nothing, take minutes to use, and build trust before the compliance conversation starts.
During bid review, ask for the burden rate behind the number, not just the price. A sub who can show their math is lower-risk on every dimension — pricing, schedule, and compliance.
Confirm Davis-Bacon wage determination accuracy before mobilization on any MILCON task order. A wage classification error discovered mid-project is far more expensive to fix than one caught at bid.
Track retainage exposure across every active task order, by sub — not just SPRS scores. A sub approaching a cash flow cliff is a schedule risk you can see coming if you're tracking it.
Treat the financial-literacy signal as a compliance-readiness signal. A sub who can't produce a burden rate is very likely a sub with no SPRS score either. Prioritize that sub for your structured compliance intake, not the email asking if they're "compliant."
Free calculators your subs can use today — Davis-Bacon wages, burden rate, margin, and retainage — plus the structured CMMC Level 1 compliance program that documents your entire supply chain. Flat fee. Unlimited subs. Pacific-based.