CMMC External Service Provider Assessment: How ESPs Are Scoped — and When They Need Their Own

Do external service providers need their own CMMC assessment?

Usually, no. The DoD CIO’s CMMC FAQ (Section E, answer E-A3) states plainly that an MSP storing your CUI in a system it provides is not required to have its own CMMC assessment — though it may elect to self-assess or pursue certification to simplify your assessment. When a non-cloud ESP touches your CUI or SPD, its relevant services are assessed as part of your assessment against the applicable security requirements (32 CFR § 170.19).

This is the single most misreported fact in the CMMC ecosystem. Search the CMMC Program Rule for “MSP” and you won’t find the acronym once. The Department of Defense uses one umbrella term — External Service Provider— to cover managed service providers, managed security service providers, cloud administrators, and the tooling they run. What matters is not the label on the invoice. It’s the answer to three questions.

The three-question test: CUI, SPD, or CSP?

Before you can decide how a provider is handled, you answer these in order. This is the logic baked into Table 4 of the rule.

1. Does the provider process, store, or transmit your CUI? CUI is information the government creates or possesses — or that a company creates or possesses for the government — that a law, regulation, or government-wide policy requires or permits an agency to protect with safeguarding or dissemination controls (32 CFR 2002.4). Common examples: export-controlled technical data, contract data, engineering drawings, and specifications related to defense work.
2. Does it process, store, or transmit your SPD? Security Protection Data is the supporting data used to protect your environment — log files, configuration data, the vulnerability status of in-scope assets, and passwords that grant access to the in-scope environment (32 CFR § 170.4).
3. Is the provider actually a Cloud Service Provider?A CSP delivers cloud computing services under the NIST SP 800-145 definition. Reselling licenses or logging into your cloud does not automatically make a vendor a CSP — more on that below.

If the answer to both 1 and 2 is no, the provider does not meet the CMMC ESP definition and drops out of this entire framework. If yesto either, it’s an ESP, and the treatment depends on the CSP question.

The one variable that decides it: whose systems hold the CUI?

Here’s the distinction that resolves nearly every argument. The regulation and the DoD FAQ point the same direction:

• CUI stays on your systems; the MSP only administers them remotely. The MSP’s administrative access is in scope and assessed inside your assessment, but no CUI resides on the MSP’s own systems — so the MSP needs no separate certification.
• CUI actually resides on the MSP’s own systems. Now the MSP is a non-CSP ESP that processes, stores, or transmits your CUI. Per DoD CMMC FAQ E-A3 it still isn’t required to hold its own certification — but the ESP services used to meet your requirements are in your assessment scope and assessed as part of your assessment against all Level 2 requirements, which is a heavier lift for everyone involved.

Either way, the burden lands on you to document the relationship and prove the controls.

What a voluntary ESP certification can — and can’t — do

An ESP is allowed to voluntarily undergo a CMMC assessment. If it does, the assessment level and type must be at least equal to what your contract requires and must cover the assets in scope for your assessment (32 CFR § 170.19(c)(2)(ii); DoD CMMC FAQ E-A3). It can reduce friction: a certified ESP’s validated controls can be inherited through your CRM, so it doesn’t have to participate directly in your assessment for those objectives. It cannotcertify you — that certification is yours to earn.

A certified MSP does not make you compliant, and it does not remove that MSP’s services from your assessment scope. You, the contractor, remain accountable for all 110 NIST SP 800-171 Revision 2 security requirements and all 320 assessment objectives in NIST SP 800-171A. We flag this because contractors routinely treat a vendor’s certificate as a finish line and discover, during a readiness review, that their own tenant configuration, user management, and customer-owned controls were never mapped.

The CMMC ESP Assessment Decision Matrix: which provider scenarios are in scope?

The safe way to answer ESP scope is by scenario, not by vendor label. What does the provider actually do, what data lands on its systems, is the service cloud-based, and which assessment type does your contract require? The matrix below is built from 32 CFR § 170.19, the DoD CIO CMMC FAQ Section E, and the DoD CIO technical ESP guidance. It is a scoping triage tool, not a compliance determination.

MSP, help desk, and IT administration

Source: 32 CFR § 170.19 (eCFR); DoD CIO CMMC FAQ E-A3, E-A4.

MSSP, SOC, SIEM, and security tooling

Source: 32 CFR §§ 170.4, 170.19; DoD CIO CMMC FAQ E-A4.

Cloud, CSP, GovCloud, and CUI enclave

Source: 32 CFR § 170.19 Table 4; DFARS 252.204-7012; DoD CIO CMMC FAQ E-A2, E-A5.

GRC platforms, documentation, and edge cases

Source: 32 CFR §§ 170.4, 170.19 (eCFR); DFARS 252.204-7021; DoD CIO CMMC FAQ Section E.

What is an External Service Provider under CMMC?

An ESP is external people, technology, or facilities you use to provide or manage IT or cybersecurity services — but under CMMC, the provider counts as an ESP only if your CUI or SPD is processed, stored, or transmitted on its assets (32 CFR § 170.4). The provider’s label matters less than what it actually does and where your data lands.

That definition does real work. It’s the reason a payroll SaaS or a break/fix technician who never logs into a CUI system isn’t an ESP, while a SOC that only ever sees your logs is one. Two clarifications save contractors the most grief.

ESP vs. a normal vendor

If a vendor never touches your CUI and never handles your security data, it isn’t a CMMC ESP. Office suppliers, generic marketing tools, and procurement-only resellers don’t get pulled into scope just because you pay them. The test is data flow, not a purchase order — resist the urge to over-scope every line item in your budget.

ESP vs. subcontractor

If another company receives your FCI or CUI to perform contract work, that’s a subcontractor flow-down question, not merely an ESP question. Under DFARS 252.204-7021and the CMMC Program Rule, prime contractors must flow the appropriate CMMC level down to subcontractors that will process, store, or transmit FCI or CUI. A subcontractor implements and validates its own CMMC status; an ESP’s services are assessed inside yours. Confusing the two is a scoping and contracting error with real consequences.

ESP vs. CSP

Every CSP that touches your CUI or SPD is an ESP, but CSPs are the special case with their own rulebook (FedRAMP, covered below). The DoD CIO’s FAQ (E-A5) draws the line clearly: if the cloud tenant is subscribed or licensed to you, an MSP that merely administers it is notthe CSP — even if the MSP resold you the licenses. If the MSP contracts with the CSP directly and modifies the base cloud service, then the MSP itself may be a CSP and must meet FedRAMP requirements.

ESP vs. an RPO/RP readiness consultant

A readiness advisor — a Registered Provider Organization (RPO) or Registered Practitioner (RP) helping you prepare — should not receive CUI through intake forms or casual uploads unless the engagement is explicitly scoped and built for it. Kept clean, an advisory relationship generally doesn’t make the consultant an ESP. Send them CUI through an unsecured portal, and you’ve created a scoping problem where none needed to exist.

Are MSPs and MSSPs assessed during a CMMC Level 2 assessment?

Yes — when their services process, store, transmit, or protect CUI or SPD in your assessed environment, even if you never send CUI to them. The DoD CIO CMMC FAQ (E-A4) gives the direct example: where an MSP handles IT support and an MSSP manages your security tools, bothqualify as ESPs and are assessed as part of your assessment against the applicable requirements — and neither is required to hold its own CMMC certification.

CMMC Level 2 is built on the 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families, and assessed against the 320 objectives in NIST SP 800-171A (32 CFR § 170.14). When your MSP or MSSP is part of how those controls get met, the assessor will look at how their services contribute — and may interview their personnel directly.

MSP with admin credentials

The DoD CIO’s technical guidance treats offsite technicians or MSPs holding passwords to your equipment as handling SPD — those admin credentials are Security Protection Data. That alone can bring the provider into scope even when no CUI ever crosses to their systems. Document the access, define it in the CRM, and be ready to show it.

MSSP running a SOC or SIEM

Log monitoring, SIEM, and security operations commonly involve Security Protection Assets and SPD. Expect the assessor to want your asset inventory, SSP treatment, a network diagram, and evidence for the requirements relevant to what the SOC actually provides. Under the current rule, an MSSP handling only your SPD (not CUI) is assessed within your scope as a Security Protection Asset — it is not required to certify on its own, though many do to reduce the burden of joining each client’s assessment (DoD CMMC FAQ E-A4).

RMM, EDR, DLP, backup, ticketing, and remote access

The practical rule: any tool that stores logs, configurations, access paths, alerts, endpoint telemetry, admin credentials, scan results, or CUI-containing tickets needs a data-flow and responsibility analysis. Don’t scope by product category — scope by what data the tool holds and who can reach it.

What if your MSP refuses to provide evidence?

It happens, and it’s a planning problem, not an assessment-week surprise. Your options, roughly in order of preference:

• Get the provider evidence-ready — request a CRM or Shared Responsibility Matrix (SRM) and the artifacts for its responsibilities.
• Reduce CUI/SPD exposure — move CUI, tickets, logs, backups, and admin paths into controlled boundaries so less of the provider’s footprint is in scope.
• Change provider category — if the MSP can’t support evidence, a CMMC-focused MSP/MSSP, a CUI enclave, or a GRC platform may fit the gap better.
• Delay the formal assessment — if provider evidence doesn’t exist, a Level 2 C3PAO assessment is premature.

An MSP can be excellent at uptime and still be a poor CMMC fit if it can’t produce assessment evidence. That doesn’t mean you need the most expensive provider — it means you need one whose role, data boundary, CRM, and evidence package match your contract requirement. It helps to see how ESP scope actually moves CMMC readiness and assessment cost before you ask anyone for quotes.

When is an MSP a Cloud Service Provider instead of just an ESP?

It depends on the relationship among the CSP, the MSP, and you. Per the DoD CIO CMMC FAQ (E-A5): if the cloud tenant is subscribed or licensed to you — even if the MSP resells the service — the MSP is not the CSP. If the MSP contracts with the CSP and modifies the basic cloud service, then the MSP may be a CSP and must meet the applicable FedRAMP or equivalency requirements.

This distinction has real money attached, because the CSP path (FedRAMP) is a different and heavier obligation than the ESP path (assessed inside your assessment).

You own the tenant; the MSP administers it

Here the MSP typically isn’t the CSP. But it may still be an ESP because of its administrative access or the SPD it handles. Keep proof of tenant ownership in your evidence packet, list the admin roles, and define responsibilities in the CRM.

The MSP owns or modifies the cloud service

Now the MSP may become the CSP, and if CUI is processed, stored, or transmitted there, FedRAMP requirements apply. You cannot lean on “it’s managed by a CMMC-aware MSP” as a substitute for the platform’s authorization.

FedRAMP Moderate, FedRAMP equivalency, and encrypted CUI

The rule here is firm. Under DFARS 252.204-7012, if you use a CSP to store, process, or transmit CUI, you must require and ensure the CSP meets security requirements equivalent to the FedRAMP Moderate baseline. The Department’s December 2023 FedRAMP Moderate Equivalency memo sets a high bar: to be considered equivalent, a cloud offering must achieve 100 percent of the FedRAMP Moderate controls through an assessment by a FedRAMP-recognized Third Party Assessment Organization (3PAO), backed by a body of evidence including an SSP and a CRM (DoD CMMC FAQ E-A1).

And here’s the trap the DoD FAQ (E-A2) closes explicitly: encrypting CUI does not let you store it in a non-FedRAMP cloud. CUI stays controlled regardless of encryption state. A non-FedRAMP-authorized platform can’t hold your encrypted CUI and claim the encryption erased the authorization requirement. The fastest way to check a cloud vendor is to search the exact offering — not just the vendor name — on the FedRAMP Marketplace, then confirm your specific license is for that authorized offering, because standard commercial tiers usually aren’t. For Microsoft environments specifically, that typically means a U.S. Government cloud such as GCC Highrather than commercial Microsoft 365; verify the exact service boundary against Microsoft’s own current documentation before you rely on it.

What documents should you collect from an ESP before assessment?

At minimum: the ESP’s service description, a Customer Responsibility Matrix (CRM) or Shared Responsibility Matrix (SRM), SSP language, data-flow and asset boundaries, access paths, and the evidence package for the provider’s responsibilities. 32 CFR § 170.19(c)(2)(ii)requires the ESP’s use, relationship, and services to be documented in your SSP and described in the ESP’s service description and CRM.

The CRM is the linchpin. Assessors verify it, and they may interview your provider on the specific controls the CRM assigns to it — so vague, aspirational language won’t survive contact.

Customer Responsibility Matrix / Shared Responsibility Matrix

Structure it so every requirement has a named owner and a traceable artifact:

SSP language for an ESP (fill-in template)

“The [OSA] uses [provider / category] to provide [service]. The provider [does / does not] process, store, or transmit CUI. The provider [does / does not] process, store, or transmit Security Protection Data. Responsibilities are documented in [CRM/SRM name, version, date]. Connecting infrastructure and access paths are shown in [network diagram name, version, date].”

Network diagram and asset inventory

Map, and label, the following: CUI assets, Security Protection Assets, provider-managed systems, remote admin paths, cloud tenant ownership, and every ticketing, logging, or evidence repository. An assessor who can trace CUI and SPD across your diagram is an assessor who moves quickly.

The evidence-request email to send your MSP or MSSP (copy/paste)

Subject: CMMC scoping — external service provider documentation request

We’re finalizing our CMMC assessment scope and need to document every external service provider that processes, stores, transmits, or protects our CUI or Security Protection Data. Please send: (1) your current service description; (2) your Customer Responsibility Matrix or Shared Responsibility Matrix; (3) a data-flow diagram for our environment; (4) the list of tools you use to administer or monitor our systems; (5) the evidence you can support for the applicable responsibilities; and (6) confirmation of whether any CUI or SPD is stored on your systems. Please do not include any CUI in your response.

How does ESP assessment change for Level 1, Level 2 (Self), Level 2 (C3PAO), and Level 3?

Your contract clause sets the required level and assessment type — and that, in turn, sets the minimum for your ESPs. Level 2 is assessed against NIST SP 800-171 Revision 2; Level 3 requires a Final Level 2 (C3PAO) status first and is assessed by DCMA DIBCAC. An ESP’s minimum assessment type follows your DoD contract requirement (32 CFR §§ 170.16–170.19). For a deeper split of the two Level 2 paths, see our guide on CMMC Level 2 self-assessment vs. C3PAO certification.

Source: 32 CFR §§ 170.3(e), 170.14, 170.16–170.19; DoD final-rule analysis.

DoD’s final-rule analysis estimated that most of the Defense Industrial Base — on the order of 63% — falls under Level 1 self-assessment, with roughly 35% needing Level 2 (C3PAO) certification and small shares for Level 2 self-assessment and Level 3. It’s a useful gut check on where most contractors, and their ESPs, will land.

Level 2 (Self) vs. Level 2 (C3PAO): where the evidence goes

Self-assessment scores are submitted to the Supplier Performance Risk System (SPRS). C3PAO results are uploaded into the CMMC instance of eMASS and flow to SPRS. The ESP evidence expectation is the same in spirit — a current CRM, documented services, and defensible controls — but a third-party assessment means an assessor may test those CRM inheritance claims directly.

Level 3 ESP scope

The Level 3 CMMC Assessment Scope must be equal to or a subset of your Level 2 scope, and any Level 2 POA&M items must be closed before the Level 3 certification assessment begins (32 CFR § 170.19(e)). Level 3 adds 24 enhanced requirements selected from NIST SP 800-172 on top of Level 2. If your ESP touches the Level 3 enclave, its services are assessed against the applicable Level 2 and Level 3 requirements.

Why the timing matters right now

The CMMC Program Rule (32 CFR Part 170) took effect December 16, 2024. The DFARS acquisition rule that puts CMMC into contracts became effective November 10, 2025, kicking off a four-phase, three-year rollout under 32 CFR § 170.3(e).

• Phase 1 (November 10, 2025 – November 9, 2026): DoD includes Level 1 (Self) or Level 2 (Self) in applicable solicitations and contracts, and may at its discretion require a Level 2 (C3PAO).
• Phase 2 (begins November 10, 2026): DoD intends to include Level 2 (C3PAO) certification in applicable new solicitations as a condition of award, though it may delay to a contract option period.
• Phase 3 (November 10, 2027): Across-the-board “all applicable” Level 2 (C3PAO) requirement, plus Level 3 (DIBCAC).
• Phase 4 (November 10, 2028): Full implementation.

That timeline is not a marketing countdown — it’s a capacity problem. DoD estimated roughly 8,350 medium and large entities alone would need a Level 2 (C3PAO) assessment as a condition of award, part of a far larger pool of CUI-handling contractors. As of March 2026, the Cyber AB Marketplace listed 103 authorized C3PAOs to assess all of them. Assessment slots fill from the front of that line, and getting your ESP scope clean is what lets you get in it.

How should you scope tools like GRC, SIEM, EDR, RMM, and backup?

Follow the data, not the product name. If the tool stores your CUI, the CUI/CSP analysis applies. If it stores logs, configurations, admin credentials, vulnerabilities, or alerts for your CUI environment, it’s likely handling SPD and is treated as a Security Protection Asset. If it handles neither, it may not be a CMMC ESP at all (32 CFR § 170.19, Table 4).

• GRC platforms. Great for organizing evidence — but the moment CUI screenshots land in a non-authorized GRC cloud, you’ve created a CSP/CUI problem. Keep CUI out unless the platform is FedRAMP-appropriate.
• SIEM and SOC tooling. SPD by nature; expect Security Protection Asset treatment and evidence for the requirements the service actually supports.
• EDR / RMM / admin tooling. Map telemetry, privileged access, and configuration state. The console is in scope even when CUI never touches it.
• Backup and disaster recovery. Separate backup metadata from stored CUI. Cloud backup of encrypted CUI still triggers the CSP/FedRAMP analysis — encryption doesn’t exempt it.
• Vulnerability scanning and pen-test artifacts. Scan results and findings are security-sensitive and generally SPD. Store and share them accordingly.

A reminder worth its own line: software alone does not make you CMMC compliant. A GRC tool or an EDR agent is a supporting layer, not the whole program. The 110 requirements and 320 objectives are yours to meet and prove.

What should you ask a provider before you hire?

Ask category-specific questions about scope, evidence, and role separation — not a generic “are you CMMC compliant?” The right questions surface whether the provider’s work reduces or creates assessment risk.

What we actually verified

We built this page from primary and authoritative sources, and cross-checked the tricky parts against each other. Here’s exactly what we confirmed and when. (See our editorial standards and methodology for how we source and date every claim.)

What we did not verify for this page: the current Cyber AB Marketplace status, service scope, or any compensation relationship for any named provider. For that reason, this page routes to provider categories, not named vendors. When you’re ready to compare specific providers, verify each one’s status live on the Cyber AB Marketplace.

Frequently asked questions about CMMC external service provider assessment