Best CMMC MSP for Defense Contractors: How to Choose One Without Creating Assessment Risk
The best CMMC MSP for defense contractors is notthe one with “CMMC compliant” stamped on its homepage. Start with the thing most vendors won’t say plainly: there is no official Cyber AB credential called a “CMMC-certified MSP.”An MSP can be listed in another ecosystem role, like a Registered Provider Organization, and it can even put its own environment or services through a CMMC assessment voluntarily — but none of that certifies your company or replaces the assessment your contract requires.
Below is the buyer’s framework we built from the rule text itself, a 100-point scorecard you can run on any provider today, and the one cost fact the official DoD estimates quietly leave out. Let’s get you to a decision.
Your situation, the short answer, and what not to do first
| If this is you… | The MSP move that fits | Don’t do this first | Why |
|---|---|---|---|
| You handle FCI only, expecting Level 1 | A security-mature MSP that can cover the 15 safeguarding requirements in FAR 52.204-21 | Don’t buy a full Level 2 cloud migration before confirming you have no CUI | Level 1 is FCI-only, self-assessed annually — not the Level 2 NIST 800-171 set, no C3PAO |
| You handle CUI, expecting Level 2 self-assessment | A CMMC-capable MSP/MSSP with written SSP/CRM and evidence support | Don’t accept “we’re compliant” with no shared-responsibility document | You post a self-assessment score in SPRS and sign an affirmation for it |
| You handle CUI, expecting Level 2 C3PAO assessment | A CMMC-capable MSP/MSSP plus a readiness consultant plus a separate C3PAO | Don’t let one firm prep you and certify you | The certification assessor must be independent (more below) |
| Your MSP runs your EDR, SIEM, RMM, backups, or logs | Treat them as likely in-scope — verify before you trust | Don’t assume “they don’t see our CUI, so they’re out of scope” | Security tooling can handle your Security Protection Data, which pulls a provider in |
| Your CUI lives in the cloud (M365, hosting) | Require a documented FedRAMP / GCC High / GovCloud / enclave plan tied to where CUI sits | Don’t assume commercial cloud is fine for CUI | DFARS 252.204-7012 sets cloud requirements for covered defense information |
| You’re not sure your current MSP is enough | Score them with the scorecard below before you scope a switch | Don’t change providers before mapping your CUI boundary | Scope drives provider choice — not the other way around |
Triage your situation in about a minute.
Tell us your level, CUI location, current MSP, and timeline and we’ll route you to the provider category that actually fits — and which evidence to demand.
This page is the MSP/MSSP deep-dive. If you’re still deciding which type of provider to hire first — RPO, MSP, C3PAO, GRC platform, or enclave — start with our companion guide, Best CMMC Providers for Small Business, then come back to vet the MSP itself.
What does “best CMMC MSP for defense contractors” actually mean?
Answer capsule.A CMMC MSP (Managed Service Provider) is an outside firm that runs your IT and security operations in a way that supports Cybersecurity Maturity Model Certification. “CMMC-certified MSP” is not an official Cyber AB credential or provider category. The Cyber AB lists specific ecosystem roles — Registered Practitioners (RPs), Registered Provider Organizations (RPOs), Certified CMMC Professionals (CCPs), Certified CMMC Assessors (CCAs), and Certified Third-Party Assessment Organizations (C3PAOs). An MSP may bea listed RPO, and individual staff may hold RP, CCP, or CCA credentials — but the MSP itself is evaluated by whether it can support your assessment, not by a badge.
When a salesperson says “we’re a CMMC-certified MSP,” they’re using a label that doesn’t exist as a Cyber AB credential. Here’s what the Cyber AB actually lists: RPs and RPOs that provide advisory help, CCPs and CCAs as credentialed individuals, and C3PAOs— the firms authorized to conduct your formal Level 2 assessment and issue your Certificate of CMMC Status. An MSP might bea listed RPO while also providing managed services — those are separate roles the same company can hold — but the certification-assessment function always stays separate.
That’s actually good news. It means you can’t be dazzled by a badge. You evaluate three concrete things instead: what the MSP’s services actually touch in your environment, whether it can produce the shared-responsibility documentation an assessor expects, and whether it is structurally separate from whoever will certify you.
The five non-negotiables of a Level 2-ready MSP
- A CUI and Security Protection Data service map — in writing, which of their services touch, store, transmit, or protect your sensitive data.
- A Customer Responsibility Matrix (CRM) — a document that splits, line by line, what they own versus what you own.
- System Security Plan (SSP) inputs — service descriptions, network diagrams, asset inventory, and admin-role detail your SSP can absorb.
- Evidence production — tickets, logs, configuration records, access reviews, vulnerability scans, and backup records, exportable on demand.
- Clean role separation — a clear statement that they will not also be your C3PAO for the same engagement.
When the “best MSP” is the wrong question entirely
Sometimes the honest answer is that you don’t need a new MSP at all. You might need a CUI enclave to shrink your scope, an RPO or readiness consultant to write your documentation, an MSSP/SOC layered on top of your existing MSP, a GRC platform to manage evidence, or simply a scoping projectbefore you change anything. Buying a managed-services contract to solve a documentation problem is how contractors burn six figures and still aren’t ready.
Is your MSP in your assessment scope? (ESP, CSP, and the data trap)
Answer capsule.Under 32 CFR Part 170, an MSP is an External Service Provider (ESP) when it provides IT or cybersecurity services and your CUI or Security Protection Data (SPD) is processed, stored, or transmitted on the MSP’s assets. The trigger is not only handling CUI directly — handling SPD (the logs, configurations, vulnerability status, and similar data from tools that protect your CUI systems) can pull a provider into your assessment scope. If an MSP also stores, processes, or transmits your CUI in a cloud environment, it is treated as a Cloud Service Provider and must meet FedRAMP Moderate baseline or demonstrate equivalency per DFARS 252.204-7012.
Here’s the trap. Plenty of contractors — and plenty of MSPs — believe a provider is out of scope as long as it “doesn’t see our CUI.” That can be wrong, and it’s the most expensive misunderstanding in the small-business DIB. One mechanism that drags an MSP into scope is Security Protection Data. Your MSP’s SIEM ingests your logs. Their EDR holds detection telemetry. Their RMM tool has privileged access to your machines. Those tools are Security Protection Assets, and when those assets sit on the MSP’s infrastructure, the MSP becomes an ESP under 32 CFR § 170.19, whose applicable services get assessed within your assessment scope — not in some separate, parallel process.
The MSP-as-ESP scoping matrix
| The provider relationship | In your CMMC scope? | FedRAMP Moderate triggered? | Its own CMMC status replaces yours? | What proves it | The one question to ask |
|---|---|---|---|---|---|
| MSP managing your systems, “doesn’t handle CUI” | Usually — if its RMM, admin consoles, EDR, SIEM, backups, or log storage handle your SPD; not if it handles neither CUI nor SPD on its assets | No (if no CUI in its systems) | No — its services are assessed within your scope | Its role, access, and tools documented in your SSP + CRM | “Will your admin accounts, RMM, and security tooling be in our SSP, and will you support a C3PAO’s evidence requests?” |
| MSP/MSSP that stores, processes, or transmits your CUI in its cloud offering | Yes | Yes — FedRAMP Moderate authorization OR a 3PAO-attested equivalency package | No — even a voluntary ESP assessment doesn’t replace your required one | The FedRAMP authorization or equivalency package — not a verbal claim | “Are you FedRAMP Moderate authorized, or can I review your current equivalency package?” |
| MSP that is also a listed RPO | Yes (as above) + provides readiness | Depends on data handling | No — RPO is a registration, not proof your systems comply | RPO listing on the Cyber AB Marketplace + SSP/CRM | “Are you a Cyber AB-listed RPO, and which staff hold RP, CCP, or CCA credentials?” |
| CUI enclave / secure cloud | Yes, if it holds CUI | Yes if it’s a cloud offering holding CUI; a non-cloud managed enclave is assessed under ESP rules instead | No | FedRAMP package (if cloud) + a CRM mapping which 800-171 controls it owns vs. you | “Is the enclave a FedRAMP Moderate cloud offering, and do you give me a control-by-control CRM?” |
What the rule says vs. what the assessor actually checks
| The rule says… | A C3PAO assessor operationally checks… |
|---|---|
| Applicable ESP services are assessed within your scope when they handle CUI or SPD (§ 170.19) | Your MSP’s RMM, privileged accounts, and remote-access paths — and whether they appear in your SSP |
| A CSP handling CUI must meet FedRAMP Moderate or equivalency | Whether you can produce the authorization or equivalency package, not just repeat a vendor’s claim |
| ESP relationships must be documented in your SSP and CRM where applicable | That the SSP actually names the MSP, its services, and the shared-responsibility split |
| The affirming official affirms continuous compliance in SPRS | That your affirmation isn’t resting on an unverified third-party assurance |
The False Claims Act exposure
When your Affirming Official posts a score in SPRS(the Supplier Performance Risk System) and signs an affirmation, that’s a representation to the government. Under the False Claims Act(31 U.S.C. § 3729), “knowingly” includes actual knowledge, deliberate ignorance, and reckless disregard for whether a statement is true. If your affirmation rests on an MSP’s unverified assurance that your environment is compliant — without the SSP entries, CRM, and evidence to back it — that exposure is yours. The MORSECORP $4.6 million settlement (March 2025) illustrates exactly this dynamic. See the full case analysis →
Find out where your current setup actually stands before an assessor does. The Fit Check flags whether your MSP is likely in-scope and what evidence it needs to produce.
Check my MSP’s scope risk →MSP, MSSP, RPO, C3PAO, GRC, or enclave — who does what?
Answer capsule.Most defense contractors don’t need one “CMMC company.” They need a clean stack: an MSP or MSSP to operate technology, an RPO or readiness consultant to prepare documentation and close gaps, a separate C3PAO to perform the Level 2 certification assessment when required, and sometimes a GRC platform or CUI enclave to manage evidence and shrink scope. The roles are complementary, but the certification role must stay independent.
The fastest way to waste money is to buy the wrong role. Here’s the map:
| Provider type | What it does | What it should not claim | When it fits |
|---|---|---|---|
| MSP | Runs IT: identity, endpoints, backups, help desk, tenant administration | That it can “certify” you | You need managed IT aligned to CMMC |
| MSSP / SOC | Runs security operations: monitoring, detection, response, SIEM, MDR | That it replaces SSP ownership or readiness on its own | You need monitoring and security evidence |
| RPO / readiness consultant | Advises on implementation; writes SSP/POA&M; runs gap assessments | That it conducts certified assessments | You need help getting ready |
| C3PAO | Conducts the official Level 2 certification assessment; issues the Certificate of CMMC Status | That it can also be your readiness consultant for the same job | You’re ready for the formal assessment |
| GRC platform | Tracks controls, tasks, evidence, POA&M | That it implements controls for you | You need evidence management at scale |
| CUI enclave / secure cloud | Segments CUI into a controlled environment | That it solves every business process automatically | You need scope reduction or fast containment |
The Cyber AB draws the bright line itself: RPOs provide advisory services and do notconduct certified assessments, while C3PAOs conduct assessments through credentialed CCAs working to the NIST SP 800-171A procedures. Don’t let one vendor blur those lanes.
The stack that usually fits, by situation
| Situation | The stack we’d expect |
|---|---|
| FCI only / Level 1 | Security-mature MSP + you own the policies |
| CUI, Level 2 self-assessment | CMMC-capable MSP + readiness help as needed + a GRC/evidence tracker |
| CUI, Level 2 C3PAO assessment | CMMC-capable MSP/MSSP + RPO/readiness consultant + a separate C3PAO |
| Narrow CUI workflows | CUI enclave + MSP integration + readiness support |
| Broad cloud/CUI footprint | GCC High- or GovCloud-capable MSP + RPO + GRC + C3PAO |
| Level 3 path | Advanced MSP/MSSP + Level 2 closure + DIBCAC readiness support |
Not sure which stack is yours?Tell us your level, CUI location, and timeline and we’ll match you with providers in the category that fits.
Match me with providers →Keep, supplement, or replace your current MSP?
Answer capsule.You don’t automatically need to fire your current MSP. Keep them if they will map every service touching CUI or Security Protection Data, provide a customer responsibility matrix, support your SSP and evidence, and remediate gaps on a written timeline. Supplement or replace them if they downplay CMMC, can’t explain their data exposure, refuse evidence support, or treat compliance as a one-time tool install.
This is the decision most readers are really here for. You have an MSP you trust. Now a prime or a solicitation is forcing the question, and you’re afraid the relationship that’s served you for years is suddenly a liability. Slow down. Switching providers before you’ve scoped your CUI is how contractors create more risk, not less.
Keep them — if they will:
- Map every service that touches CUI or SPD, in writing.
- Provide a customer responsibility matrix and SSP-ready service descriptions.
- Produce tickets, logs, configurations, access reviews, and backup evidence.
- Sit for an assessment interview and support objective-evidence requests.
- Work alongside your RPO instead of fighting it.
- Tell you plainly that they cannot “certify” you.
Supplement or replace them — if they:
- Say “we’re CMMC compliant” but can’t explain what that means.
- Can’t tell you whether their RMM, EDR, SIEM, or backups touch CUI or SPD.
- Can’t support GCC High, GovCloud, or an enclave when your CUI needs it.
- Refuse to produce evidence for an assessment.
- Push you toward a C3PAO date before scoping and remediation are done.
- Treat POA&Ms as a magic eraser for every gap.
The thing we’d rather you hear from us than discover after you’ve signed a six-figure engagement:even the best CMMC MSP can’t guarantee you pass, and it can’t remove the largest cost from your project. The right provider hands your assessor clean evidence and shrinks your scope — but youstill own the System Security Plan, the affirmation, and the gaps. A good MSP will also make your environment feel slower before it feels safer: tighter access, documented exceptions, standardized tools, no more shortcuts. That friction is the point. It’s the difference between a provider that reduces your assessment risk and one that quietly becomes the reason you fail.
If your current MSP is close, you may not need a painful migration at all. Compare their gaps against providers that already run defense-contractor environments before you decide.
Compare matched MSP options →What should a CMMC MSP prove before you sign?
Answer capsule.A serious CMMC MSP should prove, in writing, how it handles scope, evidence, shared responsibility, cloud boundaries, security tooling, incident support, and assessment participation — before you sign. If a provider can’t answer these questions on paper, the risk isn’t just weak IT service; it’s assessment confusion that lands on you.
Stop opening with “Are you CMMC compliant?” It invites a meaningless yes. Ask these instead, and send the same list to every provider so you’re comparing real scope, not sales energy.
The 15-question due-diligence checklist
- Which of your services will process, store, transmit, or protect our CUI?
- Which of your tools generate or store Security Protection Data?
- Do you provide a customer responsibility matrix?
- Do you provide SSP-ready service descriptions and diagrams?
- Can you support NIST SP 800-171 Rev. 2 evidence requests (assessed against the NIST SP 800-171A procedures)?
- Which Level 2 assessments have you supported? (Make them substantiate it.)
- Will you attend assessment interviews if the assessor asks?
- How do you document and retain access reviews?
- How do you document configuration changes?
- How do you export logs and tickets as evidence?
- How do you handle backups that contain CUI?
- How do you support DFARS 252.204-7012 cyber-incident reporting?
- Which cloud environments do you support for CUI?
- Do any subcontractors or overseas personnel have admin access to our systems?
- Are you acting as an MSP, MSSP, RPO, C3PAO — or more than one?
Question 14 deserves a flag, not a slogan
If a provider uses offshore or subcontracted personnel for privileged administration of CUI-related systems, treat it as a serious scoping, access-control, and export-control (ITAR/EAR)question — review it with qualified counsel before you sign. It is not a casual staffing detail.
To make this turnkey, we built a downloadable MSP Evidence Request Packet: a service-description request, a CRM request, a tool inventory, an admin-access list, log/ticket export requests, backup and restoration evidence, an incident-response workflow request, an assessment-participation commitment, a personnel/subcontractor access disclosure, and a cloud-environment documentation request. Attach it to your RFP and you’ll get apples-to-apples answers.
Send every provider the same bar.Grab the packet and request scoped quotes with it attached, so vague “CMMC-ready” promises turn into documented commitments.
Request scoped quotes with the evidence checklist →What contract terms should a CMMC MSP put in writing?
Answer capsule.A CMMC MSP agreement should define service scope, evidence ownership and export, tool and privileged-access boundaries, subcontractor and personnel access, incident-response roles tied to DFARS 252.204-7012, CRM and SSP support, assessment participation, termination rights, and documentation handoff. If those terms aren’t written, the contractor inherits the risk on assessment day.
A handshake “we’ve got you covered” is worthless to an assessor. Put the commitments in the contract or the statement of work. At minimum, get these in writing:
- Scope and boundary— exactly which systems, services, and data the MSP manages, and where your CUI lives.
- Evidence ownership and export— that logs, tickets, configurations, and scan results are yours, exportable on demand, and survive termination.
- Access and tooling— which privileged accounts and tools the MSP uses, and who (including any subcontractor or offshore staff) can touch CUI-related systems.
- Incident response— the MSP’s role in detection, evidence preservation, and supporting your DFARS reporting obligations.
- SSP/CRM support and assessment participation— a commitment to maintain service descriptions and to show up for assessment interviews.
- Exit and handoff— documentation transfer, transition assistance, and no hostage-taking of your evidence if you leave.
The difference between a provider that reduces risk and one that creates it usually shows up here — in what they’ll commit to on paper.
Before you sign anything, pressure-test the agreement. Compare scoped quotes from providers willing to put evidence, access, and assessment support in writing.
Compare matched providers on contract terms →What does a CMMC-capable MSP actually cost in 2026?
Answer capsule.There is no official price for a “CMMC MSP.” The Department of Defense published assessment cost estimates in the CMMC rulemaking, but those figures cover assessment and affirmation activities — not ongoing managed IT, and not the remediation work that is usually the biggest expense. Real MSP pricing depends on users, endpoints, CUI scope, cloud architecture, evidence maturity, and your timeline.
What the DoD’s own numbers say. In the CMMC Program Regulatory Impact Analysis published in the Federal Register on October 15, 2024, DoD estimated a three-year Level 2 self-assessment package at $37,196 for small entities (and roughly $49,000 for other-than-small entities), and a three-year Level 2 C3PAO certification assessment at $104,670 for small entities (and approximately $118,000 for other-than-small entities). Each figure includes the triennial assessment plus two annual affirmations.
The fact almost every competitor buries
Those DoD figures explicitly excludethe cost to implement the 110 security requirements or to remediate a Plan of Action and Milestones (POA&M). DoD’s stated assumption is that contractors have already been required to meet NIST SP 800-171 since December 2017 under DFARS 252.204-7012 — so the rulemaking doesn’t even price the remediation that, for most under-prepared small businesses, is the single largest line item. Read that twice. The scariest official number is notthe whole bill. Which is exactly why your MSP choice matters: a provider that produces evidence and shrinks scope is attacking the cost the government didn’t count.
What the market actually charges
- Gap / readiness assessment: ~$3,500–$20,000+
- Documentation (SSP, policies, POA&M): ~$3,000–$60,000
- Remediation / implementation: ~$10,000–$250,000+ (often several times the assessment fee)
- C3PAO assessment fee: ~$30,000–$75,000 for many small businesses (higher with scope and complexity)
- Managed services + tooling (EDR, SIEM, backups, monitoring): commonly ~$20,000–$80,000/year
- A first Level 2 cycle, all-in: frequently ~$75,000–$300,000+, driven mostly by your starting maturity
One more thing senior buyers should know: the CMMC rule itself states it makes no change to FAR cost allowability or the Cost Accounting Standards. Whether a specific CMMC cost is allowable or recoverable depends on your contract type, cost allocation, and the FAR Part 31 cost principles — confirm it with your contracts lead or accounting counsel before you assume recovery. It can meaningfully change the math.
The cost drivers to put in front of every provider
| Cost driver | Why it moves the price |
|---|---|
| Number of users | Licensing, identity, training, help desk, endpoint management |
| Endpoints / servers | EDR, patching, hardening, monitoring, backups |
| CUI location | Drives scope, architecture, and cloud/enclave needs |
| Current maturity | Determines how much remediation you’re buying |
| Cloud environment | GCC High / GovCloud / enclave / on-prem changes everything |
| Evidence requirements | Ticketing, logging, and assessment support require process maturity |
| MSSP / SOC coverage | Monitoring and response add recurring cost |
| Timeline | Compressed deadlines raise migration and remediation intensity |
| Assessment type | Self-assessment vs. C3PAO changes the evidence burden |
A quote you can trust is scoped to your CUI, not to a generic package.Get pricing matched to your real environment — users, endpoints, cloud, maturity, and assessment type.
Get scoped quotes from matched providers →GCC High, GovCloud, enclave, or on-prem — which does your MSP need?
Answer capsule. The right CUI environment starts with where your CUI actually lives, not with a default migration pitch. If your CUI is processed, stored, or transmitted in cloud services, DFARS 252.204-7012 and CMMC scoping make cloud-provider status and FedRAMP Moderate (or equivalency) central. A good MSP scopes the CUI boundary first, then recommends GCC High, GovCloud, an enclave, on-prem, or hybrid.
Be suspicious of any provider that pitches Microsoft 365 GCC High in the first meeting, before anyone has mapped where your CUI goes. The environment should follow the boundary.
| CUI workflow | Environment that usually fits | The MSP’s job | Evidence to request | Common mistake |
|---|---|---|---|---|
| Email / Teams / SharePoint collaboration with CUI | GCC High or GovCloud-based offering | Tenant setup, conditional access, audit logging, CUI labeling | Tenant type, FedRAMP status, audit-log retention | Putting CUI in a commercial tenant and assuming it’s fine |
| File transfer / sharing of CUI with primes | Compliant secure file-sharing or enclave | Controlled sharing, encryption, access logs | Encryption standard, access logs, FedRAMP/equivalency | Email attachments with no controls |
| CAD / engineering / manufacturing files | Enclave or controlled on-prem/hybrid | Segmentation, access control, evidence capture | Boundary diagram, access reviews, backup tests | Treating engineering systems as “just operations” |
| Narrow CUI used by a few people | CUI enclave (scope reduction) | Segment CUI away from general business | CRM, control ownership map | Migrating the whole company unnecessarily |
| ERP / accounting that touches CUI | Hybrid, scoped carefully | Define what’s in vs. out of the boundary | Data-flow map, scoping rationale | Over-scoping the entire ERP |
- GCC High or GovCloud often fitswhen CUI flows broadly through email, Teams, SharePoint, and OneDrive, or your commercial tenant can’t meet the contract’s requirements.
- A CUI enclave often fitswhen only a small group touches CUI and you want to shrink scope rather than migrate everything — the most underused scope-reduction move in the small-business DIB.
- On-prem or hybrid can still be reasonablewhen you already operate controlled infrastructure and a cloud migration would add more risk than it removes — provided your MSP can document and operate it.
The 100-point MSP scorecard
Run this against any provider before you sign. The full downloadable scorecard covers scoping & boundary documentation, CRM and SSP readiness, evidence production and export, cloud environment and FedRAMP status, security tooling and SPD handling, incident response and DFARS 7012 support, assessment participation, and role separation. Below are two illustrative categories and how we weight them:
| Category | Points | What to look for | Why it matters |
|---|---|---|---|
| Role separation & independence | 8 | A clear statement they won’t be your C3PAO for the same engagement | The wrong structure creates assessment conflicts |
| Contract transparency & exit | 6 | Pricing, scope, exclusions, migration plan, documentation handoff, evidence ownership | Lock-in and missing documentation can trap you before assessment |
How to read your score
- 85–100: a strong Level 2 candidate. Verify the specifics, then move.
- 70–84: workable — but require written remediation commitments before signing.
- 50–69: risky unless paired with an experienced RPO and a tightly limited scope.
- Below 50: likely unsuitable for a Level 2 CUI environment without major change.
What we actually verified
We built this guide from primary sources, not by paraphrasing other articles. On the dates shown we read and cross-checked:
- 32 CFR Part 170(eCFR) — the CMMC program structure, the ESP definition, Level 2 assessment handling, the ESP/CSP scoping rules in § 170.19, POA&M and affirmation rules, and the conflict-of-interest restriction at § 170.8(b)(17)(ii)(G) separating readiness from assessment for three years.
- Federal Register, October 15, 2024— the CMMC Program final rule (effective December 16, 2024) and its Regulatory Impact Analysis cost estimates.
- Federal Register, September 10, 2025— the DFARS final rule (DFARS Case 2019-D041), effective November 10, 2025, implementing DFARS 252.204-7021 and 252.204-7025.
- DFARS 252.204-7012 (Acquisition.gov) and the DoD FedRAMP Moderate Equivalency memorandum dated December 21, 2023, which requires meeting 100% of the FedRAMP Moderate baseline, assessed by a FedRAMP-recognized 3PAO, with a body of evidence.
- NIST SP 800-171 Revision 2 and NIST SP 800-171A(NIST CSRC) — the 110 Level 2 requirements and the assessment procedures. CMMC currently incorporates Rev. 2; NIST has published Rev. 3, but the CMMC rule incorporates Rev. 2 unless DoD amends it.
- The DoD CIO CMMC page— the phased rollout, with Phase 1 running November 10, 2025 through November 9, 2026, focused on Level 1 and Level 2 self-assessments.
- The Cyber AB— the Code of Professional Conduct and the role distinction between RPO advisory work and C3PAO assessment work, plus the Marketplace where you verify a provider’s credential.
Frequently asked questions
Can an MSP make us CMMC certified?
No. Acting as an MSP, a provider can operate your systems, support evidence, and help maintain a compliant environment, but a Level 2 certification assessment is conducted by an authorized C3PAO that issues the Certificate of CMMC Status. An MSP cannot certify your company unless it is separately acting as an authorized C3PAO performing a required assessment — and even then, independence rules apply.
Does our MSP need to be CMMC compliant?
It depends on what the MSP’s services touch. If the MSP processes, stores, transmits, or protects your CUI or Security Protection Data on its assets, it is an External Service Provider whose applicable services are assessed within your assessment scope under 32 CFR § 170.19 — it does not get a separate certificate. If it provides a cloud offering that holds your CUI, it is treated as a Cloud Service Provider and must meet FedRAMP Moderate or demonstrate equivalency.
Does our MSP need its own Level 2 assessment?
Don’t treat the MSP’s own status as a substitute for yours. Under 32 CFR § 170.19, applicable ESP services are assessed within your assessment scope, and an ESP may voluntarilyundergo a CMMC assessment to reduce effort during your assessment — but the minimum assessment type is driven by your DoD contract, not by the MSP’s choice.
Is CMMC Level 2 based on NIST SP 800-171 Rev. 2 or Rev. 3?
Under the current CMMC rule, Level 2 maps to NIST SP 800-171 Revision 2 and its 110 requirements across 14 control families. NIST has published Revision 3, but the CMMC rule incorporates Rev. 2 unless and until DoD amends the rule.
What is Security Protection Data?
Security Protection Data is the security-relevant data generated or used by tools that protect your CUI systems — logs, configuration data, vulnerability status, and similar information. It matters because an MSP’s security tooling can become assessment-relevant even when it never stores your business CUI.
Is GCC High required for CMMC?
Not automatically. The right environment depends on where your CUI lives and which services process, store, or transmit it. A good MSP scopes the CUI boundary first, then recommends GCC High, GovCloud, an enclave, on-prem, or hybrid.
Can we keep our current MSP?
Yes — if they can meet the documentation, evidence, shared-responsibility, and assessment-support requirements your environment needs. If they can’t, supplement them with an MSSP, RPO, or enclave provider, or replace them. Scope your CUI before you decide.
Can one company be our MSP, RPO, and C3PAO?
A firm can offer more than one service, but the certification assessment must stay independent. Under 32 CFR § 170.8(b)(17)(ii)(G) and the Cyber AB Code of Professional Conduct, a C3PAO and its assessment-team members cannot perform a Level 2 certification assessment for an organization they served as a consultant to prepare for any CMMC assessment within the prior three years. The people who get you ready cannot be the people who grade you.
Should we hire a C3PAO before choosing an MSP?
Usually no, unless you’re already assessment-ready. A C3PAO performs the formal assessment; an MSP/MSSP and a readiness consultant handle operational readiness first — and the firm that prepares you cannot be the one that certifies you for that assessment.
What is a customer responsibility matrix?
A customer responsibility matrix (CRM) documents which security responsibilities belong to the provider and which belong to you. For CMMC, it connects the provider’s services to your SSP content, your evidence expectations, and your assessment boundary.
How long does it take to get ready?
Plan in months, not weeks — especially if your CUI scope, cloud architecture, or evidence history is immature. A capable MSP accelerates the technical work, but it can’t compress the time needed to build policies, evidence, and confidence ahead of an assessment.
You already know you need help. Here’s the cleanest next step.
The contractors who get this right don’t search forever — they scope their CUI, score their provider, and move while there’s still runway. Phase 1 is live now. DoD’s final rule estimated 135 C3PAO-led certification assessments in year one, 673 in year two, 2,252 in year three, and 4,452 in year four, against an estimated 8,350 medium and large entitiesthat will need a Level 2 C3PAO assessment — and the Cyber AB’s early-2026 Town Hall figures put authorized C3PAO assessment firms at around 100. The earlier you pick the right provider, the more of that runway is yours.
Need help deciding what type of CMMC provider you need? Get matched with verified providers in 60 seconds.
Related reading
- CMMC Managed Service Providers: When Your MSP Is In Scope — and When It Isn’t
- Best CMMC Providers for Small Business
- CMMC Level 1 vs. Level 2 vs. Level 3
- CMMC Level 2 Requirements
- What Is CUI?
- C3PAO vs. RPO: Which One Do You Need?
- CMMC Level 2 Self-Assessment vs C3PAO: 2026 Decision Guide
- Best C3PAO for CMMC Level 2: The Independent Selection Framework
- How to Find an Authorized C3PAO