CMMC Cloud Service Provider Requirements: CSP, ESP, and FedRAMP Rules, Explained

CMMC cloud service provider requirements at a glance

The CMMC cloud service provider requirements depend on two facts: whether the provider is a CSP or a non-cloud ESP, and whether it handles CUI, Security Protection Data (SPD), both, or neither. A CSP that handles CUI must be FedRAMP Moderate authorized (Class C) or FedRAMP Moderate equivalent under DFARS 252.204-7012. A CSP or ESP that handles only SPD is assessed inside your CMMC scope as a Security Protection Asset. A provider that handles neither CUI nor SPD is generally not an ESP at all.

Here’s the four-line version. If you only read one thing, read this.

Before you request a single quote, run each cloud, SaaS, or managed-service provider through the full matrix in the next section. It takes about two minutes per provider and tells you the exact requirement, who’s responsible, and what evidence to collect.

The full CMMC Cloud Provider Requirement Matrix

This is the classification most contractors are missing. Find the row that matches your provider. Each row tells you what standard applies, whether the provider needs its own certification, what evidence to collect, and the mistake we see most often. Built from 32 CFR § 170.19, DFARS 252.204-7012, CMMC FAQ v5, and the December 2023 equivalency memo.

Source: 32 CFR § 170.19; DFARS 252.204-7012; CMMC FAQ v5 (E-Q3, E-Q4, E-Q5); December 2023 DoD CIO FedRAMP Equivalency memo. Last verified: July 1, 2026.

A note that resolves half the confusion: administering a tenant is not the same as providing the cloud. If you own the subscription and a vendor merely manages it for you, that vendor is usually an ESP, not a CSP. If the vendor provides or modifies the cloud service itself, it can be a CSP — and the FedRAMP rule attaches. That distinction is defined at 32 CFR § 170.4 and confirmed in the CMMC FAQ (E-Q5). Our full ESP scoping guide covers every MSP/MSSP/SOC scenario in a separate decision matrix.

Is your provider a CSP, an ESP, or neither?

A Cloud Service Provider (CSP) offers on-demand cloud services — SaaS, IaaS, PaaS, hosted storage, cloud email, or cloud collaboration — as defined in 32 CFR § 170.4. An External Service Provider (ESP) is external people, technology, or facilities you use to run IT or cybersecurity services, where CUI or Security Protection Data actually resides on the provider’s assets. A vendor that neither handles that data nor protects a CUI asset generally falls outside the CMMC ESP definition. Get this classification right first, because it decides every downstream requirement.

The official definition is deliberately data-driven. Per the DoD CMMC Level 2 Scoping Guide, to be an ESP, “data (specifically CUI or Security Protection Data, e.g., log data, configuration data) must reside on the ESP assets.” No data on their assets, no ESP status. The DoD looks at what the provider touches, not what its marketing says.

When does a cloud provider need FedRAMP Moderate (or equivalent)?

A cloud provider needs FedRAMP Moderate authorization or FedRAMP Moderate equivalency when it stores, processes, or transmits CUI for a covered DoD contract. This flows from DFARS 252.204-7012, which requires a contractor using an external cloud service for covered defense information to “require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the FedRAMP Moderate baseline.” If CUI is not in the cloud, FedRAMP is not required solelyfor CMMC — though the service may still be in scope as a Security Protection Asset if it handles SPD.

The rule text is not ambiguous. The Federal Register CMMC Program Rule states plainly that defense contractors “must confirm that any Cloud Service Providers (CSPs) used by the contractor to handle CUI meet Federal Risk and Authorization Management Program (FedRAMP) Moderate Baseline or the equivalent requirements.” And the official CMMC FAQ (E-Q1) asks the question directly — must my CSP meet FedRAMP Moderate if it processes, stores, or transmits CUI? — and answers: Yes.

Two forks decide what happens next:

• If the cloud is FedRAMP Moderate (or higher) Authorized on the FedRAMP Marketplace: you’re in the easier lane. The cloud’s controls are the cloud’s problem — but you still own provider selection, your configuration, your shared-responsibility documentation, your SSP and CRM evidence, and the DFARS 7012 incident-reporting obligations that ride alongside the clause.
• If the cloud is not authorized: you own the burden. The Program Rule makes the contractor “responsible for determining if the CSP meets the requirements for FedRAMP Moderate equivalency.” That’s a heavier lift than most teams expect, and we break it down two sections from now.

The encrypted-CUI trap

Encrypting CUI does not exempt the cloud from the requirement. A common argument — “we encrypt everything before it hits the cloud, so FedRAMP shouldn’t apply” — is explicitly rejected by DoD. The CMMC FAQ states that under 32 CFR Part 2002, CUI “remains controlled until it is formally decontrolled,” and encrypted CUI “retains the control designation given to the plain text counterpart.” FAQ item E-Q2 asks whether a non-FedRAMP Moderate cloud can store encrypted CUI, and the answer is no.

The practical consequence: if any CUI, plaintext or ciphertext, lives in a cloud, that cloud needs FedRAMP Moderate authorization or equivalency. Full stop.

If your cloud handles only Security Protection Data

A cloud that handles only Security Protection Data — logs, configuration, security telemetry used to protect your environment — but does not process, store, or transmit CUI is treated as a Security Protection Asset and assessed against the relevant CMMC Level 2 requirements. It follows CMMC requirements, not FedRAMP. This is one of the most-missed distinctions in the whole program, and it cuts both ways: forcing a FedRAMP requirement onto an SPD-only cloud is over-scoping, and ignoring the SPD-only cloud entirely is under-scoping.

Per the CMMC Level 2 Scoping Guide, a Security Protection Asset — for example, a cloud SIEM that never touches CUI but contributes to meeting CMMC requirements — is in your assessment scope and assessed against the Level 2 requirements relevant to its function. You document it with a service description and a Customer Responsibility Matrix. You do not need a FedRAMP Body of Evidence for an SPD-only service.

What “FedRAMP Moderate equivalent” actually requires

Per the DoD CIO memo dated December 21, 2023, “FedRAMP Moderate equivalent” means the cloud offering achieves 100% of the FedRAMP Moderate baseline, assessed by a FedRAMP-recognized Third-Party Assessment Organization (3PAO), with no Plan of Action and Milestones (POA&M) items remaining from that assessment, documented in a complete Body of Evidence (BoE). Self-attestation does not count. The BoE is handed to your C3PAO or DIBCAC on demand during your assessment.

If you take one thing from this section, take the scale. The FedRAMP Moderate baseline is the full NIST SP 800-53 Rev. 5 Moderate control set — many times larger than the 110 requirements in NIST SP 800-171 Rev. 2that you implement for CMMC Level 2. Equivalency asks a cloud to prove that bigger set, at 100%, with zero assessment findings. That’s why so few “equivalent” claims hold up.

What the December 21, 2023 memo actually demands:

One more nuance: “equivalency” is heavier than a standard FedRAMP authorization in one specific way. A full FedRAMP authorization has a government authorizing official who can accept some risk via POA&Ms. Equivalency has no such official — so DoD’s answer is that no implementation gaps are allowed. It is, in effect, the stricter of the two on that point.

FedRAMP “Authorized” vs “Equivalent” vs the 2026 “Certified Class C”

On June 25, 2026, FedRAMP launched its Consolidated Rules for 2026 (CR26), which replace the old impact-level names with Certification Classes and shift the label from “FedRAMP Authorized” to “FedRAMP Certified.” The former Moderate baseline — the one that satisfies the CMMC/DFARS cloud requirement for CUI — is now expressed as Class C. The security bar for CUI did not change; the labels and the process did.

Under CR26, Class C includes the current Moderate baseline and Class D includes the current High baseline. FedRAMP is explicit that a Certification Class describes the scope and assurance of the assessment — not a one-for-one stand-in for a system’s impact level— so match the offering to your actual CUI need and verify the exact Marketplace listing and boundary, not the label alone.

Dates a CMMC buyer should hold in mind, all from FedRAMP’s CR26 timeline:

• June 25, 2026 — Consolidated Rules for 2026 launched.
• July 6, 2026 — Marketplace listings open for the initial implementation stage.
• July 28, 2026 — “FedRAMP Ready” goes Legacy; no new FedRAMP Ready submissions after this date.
• January 1, 2027 — CR26 becomes mandatory for all stakeholders; current Rev5 certifications must adopt the new rules.
• June 11, 2027 — FedRAMP stops accepting applications for new Rev5 certifications.

And one distinction worth locking in: FedRAMP Moderate “equivalency” is a DoD evidence path, not a FedRAMP designation. It is defined by DoD’s December 21, 2023 memo for CMMC/DFARS purposes — it is not a FedRAMP Marketplace authorization or certification, and it does not put a listing on the Marketplace. Equivalency remains a valid path for CUI, but you (or your assessor) must review the complete Body of Evidence to rely on it.

Here’s the translation table. Pin it to your vendor-evaluation checklist.

Does your cloud provider need its own CMMC certification?

Usually not — and this is the single most expensive myth in the market. A CSP that handles CUI must meet FedRAMP Moderate or equivalency; it does not “get CMMC certified.” A non-cloud ESP that handles CUI is assessed as part of your assessment — the CMMC Final Rule specifically removed the proposed-rule requirement that ESPs be certified before serving you. An ESP may still choose to get assessed to make client audits easier, but it is not required to.

The authority here is the rule itself. Under the CMMC Final Rule (32 CFR § 170.19), a non-cloud ESP’s CUI-handling services are assessed within the contractor’s scope, and the official CMMC FAQ (E-Q3) confirms the common case directly: a non-cloud MSP storing your CUI does not require its own CMMC assessment. This reversed the proposed rule, and a big reason a lot of 2023-era advice is now simply wrong.

So what does a CSP’s own certificate actually prove for you? Less than you’d hope. It does not prove your scope is right, your configuration is correct, your users are controlled, or your SSP, CRM, and evidence are in order. Those are yours. A contractor cannot fully outsource CMMC to a provider, and a provider cannot fulfill CMMC on the contractor’s behalf. It’s shared — and the parts that fail assessments are almost always the contractor’s parts.

One guardrail on independence. The organization that helps you get ready (an RPO or MSP doing remediation) and the C3PAO that assesses you must stay appropriately separate — the Cyber AB’s C3PAO authorization requirements include impartiality and conflict-of-interest controls. Keep readiness help and formal assessment in different lanes.

What about MSPs, MSSPs, SIEM/SOC, and helpdesk tools?

If an MSP or MSSP stores, processes, or transmits your CUI and is not a CSP, its in-scope systems are assessed inside your assessment boundary unless it holds its own CMMC certification. If it handles only Security Protection Data, it’s a Security Protection Asset in your scope, and it owes you a Customer Responsibility Matrix. A workstation that can process, store, or transmit CUI by connecting to a CUI cloud is in scope — with one carve-out for properly configured virtual desktops.

The CMMC FAQ (E-Q4) addresses the very common setup where your IT support is one ESP and your security tools are managed by a different MSSP: both are ESPs, and both are evaluated during your assessment. Per the Technical Application slides, when an MSP stores CUI on its own systems, how you draw the scoping boundary “depends on the degree of isolation between the OSA’s enclave and the rest of the MSP’s infrastructure.” Isolation is your friend; sprawl is your enemy.

• SIEM, MDR, EDR, SOC. Usually ESPs handling SPD. That makes them in-scope Security Protection Assets — but it does not automatically trigger FedRAMP, because FedRAMP attaches to a CSP handling CUI, not to SPD.
• Ticketing and helpdesk. Innocuous until someone pastes a drawing, a spec, a screenshot, or contract details into a ticket. The moment CUI lands there, that system is handling CUI. Treat ticketing as a CUI risk and configure/monitor accordingly.
• Backups and email filtering. If CUI flows through them, they’re in scope like any other CUI-touching service. “In scope” follows the data, not the label.

What evidence should you request before trusting a provider with CUI?

Before you rely on any cloud provider for CUI, get evidence that proves the exact service, boundary, responsibility split, and assessment support — not a marketing claim.The essential artifacts are the FedRAMP authorization or equivalency Body of Evidence, the Customer Responsibility Matrix, a service description, SSP mapping, a data-flow diagram, and incident-reporting support language. If a provider can’t produce these, that’s your answer.

Here’s the exact ask-list. Send it to your provider and watch how they respond — the response is the signal.

Steal this: a cloud-provider evidence-request email

Copy, paste, fill in the brackets, and send it to any cloud, SaaS, or managed-service provider that touches your CUI. If they can answer all ten cleanly, you have a provider you can document. If they can’t, you have your answer early — which is exactly when you want it.

Subject: CMMC / DFARS 252.204-7012 evidence request — [your company]

Hi [name], we’re preparing for a CMMC Level 2 assessment and need to document your service in our System Security Plan. Please confirm the following for the specific offering we use:

1. FedRAMP status of the exact service offering and its Marketplace package ID (or, if not on the Marketplace, whether a FedRAMP Moderate equivalency Body of Evidence is available for our assessor to review under NDA).
2. The authorization/certification boundary — what’s covered and what isn’t.
3. Your Customer Responsibility Matrix, mapped to NIST SP 800-171 Rev. 2 / the CMMC Level 2 assessment objectives.
4. A service description we can reference in our SSP.
5. Where our CUI or Security Protection Data is processed, stored, transmitted, and replicated (including backups and logs).
6. How you support DFARS 252.204-7012 incident reporting and related obligations (paragraphs (c)–(g)).
7. Your support/admin access model — who can reach CUI, keys, configuration, or tickets.
8. A list of subprocessors or fourth parties that can access our data.
9. Data residency / U.S.-person handling relevant to our contract’s data categories (e.g., ITAR).
10. What evidence you can provide to our C3PAO or DIBCAC assessor, and in what format.

Please don’t include any CUI in your reply. Thank you — [you]

The honest part: a “CMMC compliant” claim is not enough

A vendor’s “CMMC ready,” “government cloud,” or “FedRAMP equivalent” claim may not answer the assessment question at all — and worse, even a fully FedRAMP-authorized cloud does not make youcompliant. FedRAMP covers the cloud’s controls; the shared-responsibility model still leaves configuration, access control, multifactor authentication, and evidence to you.

32 CFR § 170.19requires the ESP relationship, service description, and Customer Responsibility Matrix to be documented — so if a provider won’t supply the CRM or assessment-usable evidence, you may simply lack the documentation your assessment requires. Treat a vendor that won’t hand over a CRM or a Body of Evidence as disqualifying, not as a paperwork snag.

How C3PAO and DIBCAC assessors actually check your cloud

During a CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessment, the assessor checks each in-scope cloud against the FedRAMP Marketplace; if a cloud isn’t listed, they request its full Body of Evidence and verify completeness and 100% implementation. A cloud that inherits controls from its host platform without documenting them can fall short — and the failure lands on the contractor, not the vendor.

A real example, not a hypothetical. Advisory firm Baker Tilly documented an engagementin which a contractor checked each in-scope CSP against the FedRAMP Marketplace and, for those not listed, requested the Body of Evidence per the DoD memo. One CSP had most BoE elements — but had inherited some FedRAMP requirements from Azure without documenting them, falling short of 100% compliance. Under the equivalency standard, that gap is enough to jeopardize the assessment.

The equivalency path has been walked successfully. Secure-collaboration provider PreVeil states it was the first cloud service provider to meet the DoD’s FedRAMP Moderate Equivalency requirement, after a DIBCAC team reviewed its 3PAO Body of Evidence. This is a company-stated example of what clearing the bar looks like, not an endorsement; verify any provider’s current status directly on the FedRAMP Marketplace and via a current Body of Evidence before you rely on it.

Which cloud environments meet the CMMC cloud requirement?

For CUI, the environments most defense contractors use commonly carry FedRAMP High or Moderate. The critical discipline: FedRAMP authorization attaches to a specific service offering and boundary, not to a brand. Verify the exact offering, package, class, and boundary on the FedRAMP Marketplace — the product family name alone is not proof. A government cloud can carry a lot of the load — but it never makes you compliant on its own.

The snapshot below reflects our review of provider documentation and the FedRAMP Marketplace as of July 1, 2026. Statuses change; confirm each before you rely on it.

We do not rank or endorse providers — these are factual authorization examples, and status can change. The standard-M365 line is the one to internalize: before the December 2023 memo, some contractors argued standard M365 was “equivalent” on the strength of Microsoft’s general security posture; that argument is no longer defensible. Verify everything on the FedRAMP Marketplace before you rely on it.

If your CUI is scattered across email, files, endpoints, and a few SaaS tools, an enclave is often a cheaper path to compliance than dragging your whole environment up to the bar. Our CUI enclave guide goes deeper.

Does this change by CMMC level and assessment type?

The cloud-provider logic is consistent across Level 2 self-assessment and Level 2 C3PAO assessment — a CSP handling CUI needs FedRAMP Moderate or equivalency either way. What changes is scrutiny and evidence pressure. Level 2 maps to the 110 requirements of NIST SP 800-171 Rev. 2 and may be self-assessed or independently assessed by a C3PAO depending on your solicitation; Level 3 requires a prior Final Level 2 (C3PAO) for the same scope plus selected requirements from NIST SP 800-172, assessed by DIBCAC.

Source: 32 CFR §§ 170.3(e), 170.14; DFARS 252.204-7012; DFARS 252.204-7021.

Two dates worth holding in mind: the DFARS acquisition rule took effect November 10, 2025, opening Phase 1 (Level 1 and Level 2 self-assessments appearing in contracts), and Phase 2 begins November 10, 2026, when applicable solicitations begin requiring Level 2 C3PAO certification (32 CFR § 170.3(e)). And if your contract already contains DFARS 252.204-7012, your NIST SP 800-171 obligation exists now— CMMC just verifies it.

How to document cloud providers in your scope and SSP

For CMMC Level 2, you must specify your assessment scope before the assessment, document every asset that processes, stores, or transmits CUI in your asset inventory, SSP, and network diagram, and document each ESP’s relationship and services in your SSP with a Customer Responsibility Matrix. The rule (32 CFR § 170.19(c)(2)(ii)) requires the ESP relationship to be “documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix.” No CRM, no clean assessment.

A simple, non-legal SSP pattern that assessors can follow:

“Provider X is used for [service]. The service [does / does not] process, store, or transmit CUI. The service [does / does not] process, store, or transmit Security Protection Data. Responsibilities are documented in [CRM name, version, date].”

Three habits that save assessments:

• Label every asset. CSP, ESP, Security Protection Asset, Contractor Risk Managed Asset, or out-of-scope — and keep the rationale.
• Draw real data-flow diagrams. Show where CUI and SPD enter, persist, replicate, and leave — not just boxes and arrows.
• Version your CRM. Provider documents change; a dated, versioned CRM is what you’ll defend at assessment.

Which provider category fits your situation?

The right provider category depends on your required level, CUI scope, cloud model, assessment type, current IT maturity, and contract timeline. The table below maps a situation to a provider category, not a named provider. It is not a score, a provider ranking, a legal opinion, or a compliance determination.

Common CMMC cloud provider mistakes

Nearly every cloud mistake in CMMC comes from confusing labels with evidence.“FedRAMP,” “GovCloud,” “GCC High,” “CMMC ready,” “encrypted,” and “secure” mean nothing unless the exact service, boundary, data flow, CRM, and customer responsibilities match your CUI scope. The six below are the highest-risk mistakes because each one maps to a specific, source-backed scoping or evidence failure.

1. Assuming one FedRAMP authorization covers a vendor’s whole catalog. Verify the exact offering and boundary on the Marketplace.
2. Believing encryption exempts a cloud. It doesn’t — encrypted CUI is still CUI (CMMC FAQ E-Q2).
3. Treating security logs as out of scope. SPD makes a service an in-scope Security Protection Asset.
4. Thinking every MSP needs its own CMMC certificate. Non-cloud MSPs are assessed inside your scope; their own assessment is optional (CMMC FAQ E-Q3).
5. Buying GCC High or GovCloud before scoping your CUI. Map the data first, then choose architecture — you may need far less than you think.
6. Forgetting tickets, screenshots, support sessions, and backups. CUI leaks into all of them; include them in the data-flow review.

Frequently asked questions about CMMC cloud service provider requirements

Your next step

You now have what most contractors are missing: a way to classify any cloud, SaaS, or managed-service provider, the exact evidence to demand, and the primary source behind every answer. The move that protects you is to do this beforeyour assessment or your next migration. It’s far cheaper than rushed rework — and it catches the cloud and ESP evidence gaps this page is built to expose.