CMMC Managed Service Providers: When Your MSP Is In Scope — and When It Isn’t
Here’s the short version, because you came here to decide something, not to read a definition.
CMMC managed service providers (MSPs and MSSPs) do not automatically need their own CMMC certification — and they are not automatically out of your assessment scope either. Under the CMMC Program rule (32 CFR Part 170, effective December 16, 2024), your provider enters your assessment scope when its own assets process, store, or transmit your Controlled Unclassified Information (CUI) — or your Security Protection Data (SPD), the logs, configuration files, alerts, and vulnerability data your provider’s tools collect to protect your environment. If none of that lands on provider-owned assets, the provider may not be in scope at all.
So the real question is not “is my MSP CMMC certified?” It’s “what does my MSP touch, is that documented, and can it prove it?”
That distinction is the whole game — and it’s where most of the internet is still wrong. A lot of pages still tell you every MSP handling CUI must hold its own certification. That was the proposedrule. The final rule changed it. Other pages tell you your MSP is fine because “no CUI ever goes to them” — which ignores Security Protection Data entirely. We read 32 CFR Part 170, the DoD’s official CMMC FAQ, and the FedRAMP equivalency memo directly so we could give you the version that actually matches the current rule.
The CMMC MSP Scope & Evidence Matrix
Find the row that matches your provider relationship. Sources: 32 CFR Part 170 (§ 170.4, § 170.17, § 170.19, Subpart C); DoD CMMC FAQ Section E; DoD CIO FedRAMP Moderate Equivalency memo, December 21, 2023; DFARS 252.204-7012.
| Your provider situation | Likely CMMC classification | In your assessment scope? | Needs its own CMMC assessment or external authorization? | Evidence to demand before you sign or renew | The red flag | Best next move |
|---|---|---|---|---|---|---|
| MSP stores or processes your CUI on its own non-cloud systems | External Service Provider (ESP), not a CSP | Yes | No — its services are assessed inside your Level 2 scope. It may self-certify to reduce your assessment effort (DoD CMMC FAQ, §E). | Service description, Customer Responsibility Matrix (CRM), SSP inputs, asset inventory, access-control and backup evidence | “You’re our client, so you inherit our compliance automatically.” | Keep only if they produce a real CRM and evidence; supplement with readiness if documentation is weak; replace if they store CUI in commercial cloud without a plan |
| MSSP/SOC ingests your logs, alerts, config data, vulnerability data, EDR/SIEM telemetry — but no CUI | ESP handling Security Protection Data → assessed as a Security Protection Asset (SPA) | Yes, generally | No (DoD CMMC FAQ, §E) | SIEM/EDR architecture, log-retention policy, alert-handling workflow, privileged-access procedures, CRM | “No CUI touches us, so we’re never in scope.” | Keep if they can support the evidence; supplement if they only hand you generic log exports; replace if they won’t participate in your assessment |
| MSP administers your own Microsoft 365 GCC High, Azure Government, or AWS GovCloud tenant | MSP/ESP — not a CSP if the tenant is licensed to you | Depends on CUI/SPD touched | No (the MSP is not a CSP merely for administering or reselling your tenant — DoD CMMC FAQ, §E) | Proof the tenant is licensed to you, admin-role list, MFA/conditional-access evidence, CRM | “GCC High means you’re already compliant.” | Verify the cloud boundary and the MSP’s admin responsibilities; document privileged access in your SSP |
| MSP contracts with the cloud provider and modifies the service before delivering it to you | The MSP may itself be a CSP | Yes | This is a FedRAMP issue: if the provider is acting as the CSP for CUI, the cloud offering must hold FedRAMP Moderate authorization or equivalency (DoD CMMC FAQ, §E; DoD CIO memo, Dec. 21, 2023) | Written CSP/ESP determination, cloud-offering boundary, FedRAMP authorization or equivalency Body of Evidence | “We’re FedRAMP-equivalent” without a 3PAO Body of Evidence. | Require written FedRAMP authorization or a 3PAO-attested equivalency Body of Evidence — no POA&Ms permitted for that 3PAO assessment |
| MSP runs RMM, remote support, ticketing, file transfer, or backup connected to your CUI environment | Likely an ESP if CUI or SPD lands on its assets — fact-specific | Likely, but prove it | Not automatically — depends on what the tools actually process, store, or transmit | Tool data-flow map, file-transfer settings, ticket-redaction rules, admin-access logs, backup encryption, CRM | “Our RMM is standard commercial software, so it doesn’t count.” | Treat as in scope until a data-flow map proves otherwise; document tool access in your SSP |
| Provider that gave you readiness/consulting now wants to assess you | RPO/consultant and would-be assessor | Not an asset-scope question — a C3PAO independence / conflict-of-interest question | A CMMC ecosystem member cannot participate in the Level 2 certification assessment for an organization it served as a consultant within the prior 3 years (32 CFR Part 170, Subpart C) | Cyber AB Marketplace status, written conflict-of-interest disclosure, consulting engagement dates | “We do both — one shop is easier.” | Get a separate, independent C3PAO; document the consulting relationship and its dates |
| Provider needs only temporary access — penetration test, incident response, forensics, vulnerability scan | Usually not an ESP | Usually no | Confirm whether the provider’s own assets process, store, or transmit CUI or SPD; if they don’t, it’s not an ESP relationship | Scope-of-work and access duration | “We’ll need standing admin access indefinitely.” | Fine for genuinely temporary work; document the access and its limits |
| Pure staff augmentation where you supply all equipment, facilities, and procedures | Not an ESP if no CUI or SPD lands on provider-owned assets | No | No | Confirmation they use your equipment and policies | “We’ll bring our own laptops and tools.” | Keep it clean — your gear, your policies |
Not sure which row you’re in?
Before you request a single quote, run your current provider through our free MSP Scope & Evidence Checker— it walks you through CUI, Security Protection Data, cloud tenancy, and tooling in about two minutes and tells you the likely classification and what evidence to request. Don’t enter CUI, contract numbers, credentials, or network diagrams — it’s a classification tool, not a place for sensitive data.
Run the MSP Scope & Evidence Checker →Is my MSP even in scope for CMMC?
An MSP or MSSP is in your CMMC assessment scope when its own assets process, store, or transmit your CUI or your Security Protection Data while providing IT or cybersecurity services. Security Protection Data — the logs, configuration files, alerts, vulnerability data, and credentials your provider’s tools collect — is what pulls most providers into scope, even when no CUI ever reaches them. This is the single most misunderstood point in the entire topic.
Here’s why it trips people. Contractors reason like this: “We don’t send our MSP any CUI, so they’re outside the boundary.” It feels logical. It’s also wrong, and the DoD said so plainly. In Section E of its CMMC FAQ, the DoD posed exactly this scenario — IT support handled by one ESP, security tools handled by another, no CUI sent to either— and answered: yes, both are ESPs, and both are assessed as part of your assessment scope. The mechanism is Security Protection Data.
Your MSP’s SIEM ingests your logs. Their EDR holds detection telemetry. Their RMM tool has privileged access to your machines. Those tools are Security Protection Assets, and when those assets sit on the MSP’s infrastructure, the provider becomes an ESP whose applicable services get assessed within yourassessment scope. 32 CFR § 170.19 governs this, and it’s not ambiguous.
So the test isn’t “does CUI touch them?” The test is broader: what data, what security functions, and what access does this provider’s own infrastructure actually handle? You answer that by mapping the data flow, not by assuming.
The flip side is real too. A provider whose own assets process, store, or transmit neitherCUI nor Security Protection Data does not meet the ESP definition (32 CFR § 170.4). A vendor needing only temporaryaccess — a penetration tester, an incident-response or forensics firm, a one-time vulnerability scan — usually isn’t an ESP, because nothing persists on its infrastructure. Neither is pure staff augmentation where you provide the equipment, the facilities, and the procedures.
Not sure which row of the matrix you’re in?Run your current provider through the Checker before you request quotes — it returns a likely classification and the exact evidence to request. No CUI, credentials, or diagrams — classification only.
Check my provider’s scope classification →Does my MSP need its own CMMC certification?
In most cases, no. The DoD’s CMMC FAQ (Section E) states that an MSP storing your CUI in a non-cloud system is not required to hold its own CMMC assessment, though it may elect one. Instead, the provider’s in-scope services are assessed within your Level 2 assessment against the applicable NIST SP 800-171 Revision 2 requirements. If the provider does choose to get certified to streamline your assessment, the DoD says its certification level and type must equal or exceed what your contract requires.
This is where the internet is most out of date
The proposed CMMC rule would have required External Service Providers to hold their own CMMC certification before your assessment. The defense industrial base pushed back hard, and the DoD listened. The finalrule — 32 CFR Part 170, effective December 16, 2024 — dropped that requirement. Now, for ESPs that handle CUI or Security Protection Data, certification is no longer required in advance; their services are assessed in-scope as part of yourcertification. If you read a page telling you “every MSP that touches CUI must be CMMC Level 2 certified,” you’re reading the old rule.
There’s a worthwhile nuance in the rule’s own language that’s worth resolving, because it looks like a contradiction and isn’t. The rule says ESPs that only handle Security Protection Data “do not require CMMC assessment or certification” — and alsosays those services are assessed as Security Protection Assets within your scope. Both are true. The reconciliation: your provider doesn’t need an independent certificate, but its in-scope services doget assessed — inside your assessment. That’s a critically different sentence than “you don’t have to think about it.”
Why would a provider ever certify voluntarily? Three honest reasons: it serves many DIB clients and wants to stop re-proving the same controls in every client’s assessment; it wants to prove its own control maturity as a market differentiator; or a prime or customer demands it commercially even though the rule doesn’t. A provider’s own certification can reduce friction in yourassessment. It just doesn’t transfer responsibility to them.
Is my MSP secretly a Cloud Service Provider? (The FedRAMP trap)
It depends on who owns the cloud. The DoD’s CMMC FAQ says an MSP is not a Cloud Service Provider simply because it administers — or even resells — a cloud tenant that is licensed to you. But if the MSP contracts with the cloud provider directly and modifies the basic service before delivering it to you, the MSP may itself be a CSP, and any CSP that stores, processes, or transmits CUI must meet FedRAMP Moderate authorization or FedRAMP Moderate equivalency.This is the trap that catches small contractors most often, because the distinction hinges on a contract term — who is the licensed tenant — that most people have never read.
Path one: you own the tenant
Your company is the licensed subscriber of the Microsoft 365 GCC High, Azure Government, or AWS GovCloud environment. Your MSP logs in and administers it for you. Per the DoD CMMC FAQ (Section E), the MSP is nota CSP in this arrangement, even if it resold you the licenses. It’s still an ESP — its administrative access and the security functions it operates put it in your scope — but the FedRAMP obligation rides on the cloud offering, which is already authorized. This is the cleaner setup, and it’s the one most small contractors should aim for.
Path two: the MSP owns and modifies the service
The MSP contracts with the cloud provider, wraps or modifies the offering, and delivers a product to you under its own name. Now the MSP may be acting as the CSP. If CUI lives in that environment, it must be FedRAMP Moderate authorized (listed on the FedRAMP Marketplace) or meet FedRAMP Moderate equivalency. Per the December 21, 2023 DoD CIO memo, equivalency means 100% of the latest FedRAMP Moderate baseline implemented and assessed by a FedRAMP-recognized 3PAO, documented in a Body of Evidence — with no POA&Ms permitted from that 3PAO assessment.
Encrypting CUI does not get it out of FedRAMP scope
The DoD’s November 2025 CMMC FAQ reaffirms that CUI remains CUI even when encrypted, citing 32 CFR Part 2002 — encrypted CUI keeps the same control designation as its plaintext counterpart. You cannot park encrypted CUI in a commercial, non-FedRAMP cloud and call it handled.
The practical move is short. Ask your provider, in writing: Who is the licensed tenant — us or you? Do you modify the cloud service, or just administer it? Is the cloud offering FedRAMP Moderate authorized or equivalent, and can you produce the Body of Evidence? Where do backups, logs, and support-ticket data actually live? If the answers are fuzzy, that’s your signal.
If your CUI is sitting in commercial Microsoft 365 or a non-FedRAMP cloud right now, you have a migration ahead of you — and it’s better to learn that now than from a C3PAO. We can match you with verified providers in the CUI enclave and GovCloud-implementation categories that fit your environment and timeline.
Get matched with providers that fit your scope →MSP vs. MSSP vs. RPO vs. C3PAO: which one do you actually need?
These are four different jobs, and conflating them is how contractors overspend or stall. An MSP runs your IT operations. An MSSP runs your security monitoring and operations. An RPO (Registered Practitioner Organization) is a Cyber AB-listed advisory firm that prepares you for certification. A C3PAO (Certified Third-Party Assessment Organization) is the only entity authorized to perform your Level 2 certification assessment and issue your status.Hire one role and expect it to do another, and you’ll either pay twice or fail an assessment.
| Role | What it does | Authorized by | Can it certify you? | When you need it |
|---|---|---|---|---|
| MSP | Help desk, endpoints, identity, network, patching, backup, tenant administration | Commercial (no CMMC authorization required) | No | You have little or no internal IT team |
| MSSP | SIEM, SOC monitoring, EDR/MDR, vulnerability monitoring, incident-response support, log retention | Commercial | No | You have IT but no real security operations |
| RPO / readiness consultant | Gap assessment, SSP and POA&M support, control interpretation, evidence organization | Listed on the Cyber AB Marketplace | No | Your documentation and readiness are weak |
| C3PAO | The formal Level 2 certification assessment and status determination | Authorized/accredited by the Cyber AB | Yes | Your scope, SSP, CRM, and evidence are mature |
A few honest pairings. If you have no internal IT and you handle CUI, you likely need a CMMC-capable MSP plus readiness help. If you have IT but no monitoring, you need an MSSP or MDR provider with real CMMC evidence support, again paired with readiness. If your operations are solid but your paperwork is thin, you mostly need an RPO. And when your environment is genuinely ready, you engage a C3PAO — and only then.
Cyber AB Ecosystem Snapshot — last checked May 27, 2026
| Metric | Figure | Source | Why it matters |
|---|---|---|---|
| Authorized C3PAOs | ~103 | March 2026 Cyber AB Town Hall | These are the only firms that can certify you at Level 2 |
| Final Level 2 Certificates of CMMC Status issued | ~1,074 | March 2026 Cyber AB Town Hall | The DIB is early — most contractors are not yet certified |
| Organizations expected to need Level 2 | ~80,000 | Publicly reported DoD estimate | Demand far exceeds the number certified so far |
The constraint here is not just assessor supply — it’s also contractor readiness, and the part you can control right now is your scope, your evidence, and your provider relationships. Industry reporting has described C3PAO calendars booking out well into and beyond 2026, so the contractors who get organized early are the ones who hold the early assessment slots.
Trying to figure out which category fits your situation?Tell us your level, your CUI environment, and your current provider’s role, and we’ll point you to the provider category that fits.
Compare provider categories and get matched →The honest part: an MSP can’t take your compliance off your shoulders
A managed service provider — no matter how good — cannot own your CMMC responsibility. You remain the accountable party for your assessment scope, the accuracy of your System Security Plan (SSP), your annual affirmation in the Supplier Performance Risk System (SPRS), and your CMMC status. A provider can operate controls, collect evidence, and carry most of the technical weight. It cannot sign your affirmation or make your scoping decisions for you.
If you were hoping to write a check and make CMMC someone else’s problem, that’s the bad news. Now the good news, because this actually works in your favor. Once you accept that the responsibility stays with you, the decision gets simpler, not harder. You’re no longer shopping for a savior. You’re shopping for a provider that makes you defensible — one that documents its role, produces a Customer Responsibility Matrix, and shows up cooperatively when the C3PAO asks questions. The right MSP is the one whose evidence you could hand an assessor without flinching. The wrong one is the one that says “don’t worry, we’ve got it” and can’t produce a single artifact when you ask.
The independence rule you cannot afford to get wrong
The firm that builds or remediates your environment generally cannot be the C3PAO that assesses it — for three years.Under 32 CFR Part 170 (Subpart C), the Accreditation Body’s conflict-of-interest policy prohibits CMMC ecosystem members from participating in the Level 2 certification assessment process for an organization they served as a consultant to prepare for any CMMC assessment within the prior three years. C3PAOs also have to meet ISO/IEC 17020 independence standards (§170.9). When a provider pitches “we’ll prepare you andcertify you,” that’s not a convenience — it’s a conflict, and it can invalidate the assessment. Keep your builder and your grader separate.
If your current provider is a strong general IT shop but has never operated a DoD environment, they may quietly put your certification at risk — not because they’re bad at IT, but because CMMC scope is a different discipline. Supplementing or switching isn’t an upsell; it’s cheaper than failing an assessment.
Get matched with providers built for DoD scope →What a CMMC-ready MSP must give you before you sign
A CMMC-ready provider gives you more than uptime promises and reassuring security language. At minimum, it should produce a service description, a Customer Responsibility Matrix (CRM), inputs to your System Security Plan, a data-flow explanation, an evidence-support process, and contract terms that back up your DFARS and CMMC obligations.32 CFR Part 170 specifically requires that an ESP’s use be documented in your SSP and described in the provider’s service description and CRM (§ 170.19) — so a provider that can’t produce a CRM literally cannot be documented the way the rule expects.
The Customer Responsibility Matrix is the centerpiece. A real CRM maps responsibility for the applicable NIST SP 800-171 Revision 2 requirements — all 110 of them, organized into 14 control families— to one of three owners: the provider, you, or shared with the split spelled out. It is not optional, and it is not a one-page marketing handout. When a C3PAO assesses an environment that includes your MSP, the CRM is one of the first artifacts it examines to see who is responsible for what.
The evidence package a serious provider should be able to hand you:
- A written service description and a complete CRM mapped to the requirements they touch
- SSP inputs for the responsibilities they own, written to match what they actually do
- Asset inventory inputs and a data-flow / network diagram showing where CUI and Security Protection Data go
- The admin-access model — who has privileged access, and how it’s controlled
- How RMM, ticketing, file transfer, and backup handle data (and whether file transfer can be disabled)
- Log-retention and monitoring details, and the incident-response support process
- Vulnerability and patch management workflow
- A written commitment to cooperate with your C3PAO assessment, including interviews
- Disclosure of sub-processors and tooling that touch your environment
- For any cloud they provide, FedRAMP authorization or equivalency evidence
On the contract side, your agreement should require CRM delivery and updates, assessment cooperation, evidence retention, incident notification, defined data locations and cloud boundaries, restrictions on where CUI and Security Protection Data can go, sub-processor disclosure, and transition support if you part ways. It should notcontain a guarantee of certification — and you should be wary of any provider that offers one. Remember the flow-down obligation too: under DFARS 252.204-7021 and 32 CFR § 170.23, you must flow the appropriate CMMC requirements down to subcontractors and suppliers that will process, store, or transmit FCI or CUI (commercial off-the-shelf items are excepted).
Documentation that doesn’t match reality is worse than missing documentation
A polished CRM describing controls your provider doesn’t actually operate gives you false confidence walking into an assessment — and a C3PAO is specifically there to test whether the paper matches the practice.
Keep, supplement, or replace your current MSP?
Keep your provider if it can explain your CMMC scope, produce a CRM, support your SSP and evidence, and cooperate with the assessment. Supplement it if it’s operationally strong but weak on CMMC documentation, security monitoring, or readiness experience. Replace it if it refuses to map responsibilities, can’t control where CUI and Security Protection Data go, confuses the CMMC levels, or wants to both prepare and assess you.
Keep them when they can:
- Explain the difference between an ESP and a CSP without stumbling
- Produce a real CRM and SSP inputs
- Show you a data-flow map for CUI and Security Protection Data
- Use appropriate environments (your FedRAMP-authorized tenant, not commercial cloud for CUI)
- Disclose their tools and sub-processors
- Commit, in the contract, to support your assessment
Supplement them when:
- The day-to-day IT is good but documentation is thin — add an RPO
- There’s no security monitoring — add an MSSP/MDR
- You need to shrink your CUI footprint — add an enclave specialist
- You’ll need a C3PAO later and want the evidence built first
Replace them when you see the dealbreakers:
- They refuse to provide a CRM
- They “guarantee certification”
- They store CUI in commercial cloud with no FedRAMP path
- They can’t tell CUI from FCI, or don’t know what Security Protection Data is
- They won’t participate in your assessment
- They hide their tooling or sub-processors
- They want to prepare you and assess you
The question we hear most: what if my MSP says they’re “not pursuing CMMC”?Don’t panic, and don’t assume they must be certified — most don’t have to be. First classify the relationship using the matrix above. Then send them this, in writing: “Please provide your current CMMC support position, a service description, a Customer Responsibility Matrix for the services you provide to our CUI environment, and a list of any provider-managed tools that process, store, or transmit CUI or Security Protection Data.”If they engage and can support the evidence, you may be fine. If they go quiet or refuse the basics, your problem was never their certification status — it’s that they can’t support your assessment, and that’s a replace signal.
If your provider can’t give you a clear CRM or evidence path, timing matters.Phase 2 certification requirements expand on November 10, 2026, and C3PAO calendars are already tight. Don’t make a rushed switch; make an informed one.
Get matched before your assessment window closes →What do CMMC managed service providers cost?
There’s no fixed price, and you should treat any universal number with suspicion — cost is a scoped quote, not a sticker. The one official anchor is the DoD’s modeled estimate, published in the Federal Register, that a Level 2 third-party (C3PAO) assessment-and-affirmation cycle runs $104,670 for a small entity over three years (roughly $105,000–$118,000 across entity sizes). Everything else — managed services, readiness, enclaves — is market-observed and varies widely by your scope, your starting maturity, and your environment. We label the official figure and the market ranges separately on purpose, because conflating them is how people build bad budgets.
The DoD estimate excludes remediation — by design
The $104,670 figure covers the triennial C3PAO assessment plus two annual affirmations. It explicitly excludes the cost to implement the 110 security requirements or remediate POA&Ms — DoD’s stated assumption is that contractors have already been meeting NIST SP 800-171 since December 2017 under DFARS 252.204-7012. For most under-prepared small businesses, remediation is the single largest line item. Your MSP choice directly attacks that cost: a provider that produces evidence and shrinks scope reduces what you spend getting ready.
What the market actually charges
- Gap / readiness assessment: ~$3,500–$20,000+
- Documentation (SSP, policies, POA&M): ~$3,000–$60,000
- Remediation / implementation: ~$10,000–$250,000+ (often several times the assessment fee)
- C3PAO assessment fee: ~$30,000–$75,000 for many small businesses
- Managed services + tooling (EDR, SIEM, backups, monitoring): commonly ~$20,000–$80,000/year
- A first Level 2 cycle, all-in: frequently ~$75,000–$300,000+, driven mostly by starting maturity
A quote you can trust is scoped to your CUI, not to a generic package. Get pricing matched to your real environment.
Request scoped quotes from matched providers →Sources we read
- 32 CFR Part 170— CMMC Program (eCFR): definitions (§170.4), Level 2 assessment (§170.17), scoping (§170.19), C3PAOs and conflict of interest (§170.9 and Subpart C), applicability and phases (§170.3), flow-down (§170.23). Last verified May 27, 2026.
- Federal Register, October 15, 2024— CMMC Program final rule (effective December 16, 2024), including the Regulatory Impact Analysis cost estimates.
- DoD CMMC Frequently Asked Questions, Section E (External Service Providers)— DoD CIO CMMC resources, dodcio.defense.gov/CMMC.
- DoD CIO memorandum, FedRAMP Moderate Equivalency for CSP Cloud Service Offerings, December 21, 2023— 100% FedRAMP Moderate baseline, 3PAO-assessed Body of Evidence, zero assessment POA&Ms permitted.
- DFARS 252.204-7021 (CMMC clause), 252.204-7012 (safeguarding / cloud), 252.204-7019 (NIST 800-171 DoD Assessment notice), and 252.204-7020 (NIST 800-171 DoD Assessment methodology and SPRS posting) — Acquisition.gov.
- NIST SP 800-171 Revision 2(110 requirements, 14 families) and NIST SP 800-171A — NIST CSRC. CMMC Level 2 currently incorporates Rev. 2.
- CMMC Level 2 Scoping Guide— DoD CIO, dodcio.defense.gov/CMMC.
- Cyber AB— Ecosystem Roles, Town Hall reporting (ecosystem counts, March 2026), and the Marketplace. cyberab.org.
Frequently asked questions
What is a CMMC managed service provider?
A CMMC managed service provider is an MSP or MSSP that supports the IT or security operations of a defense contractor preparing for or maintaining CMMC status. It may manage endpoints, identity, cloud tenants, backups, logging, monitoring, or security tools, but the contractor still owns its CMMC scope, SSP, affirmations, and status.
Does my MSP need to be CMMC certified?
Not in most cases. The DoD CMMC FAQ (Section E) states that a non-cloud MSP storing your CUI is not required to hold its own CMMC assessment, though it may elect one. Its services are documented in your SSP and assessed inside your Level 2 scope.
Are MSPs and MSSPs in scope for CMMC?
They can be. Under 32 CFR Part 170, the test is whether the provider’s own assets process, store, or transmit CUI or Security Protection Data, and whether it acts as a Cloud Service Provider. An MSSP handling logs or security telemetry can be in scope even if no CUI is sent to it.
What is Security Protection Data?
Security Protection Data is information such as logs, configuration data, alerts, vulnerability data, and credentials used to protect your assessed environment. If your provider handles it on its own assets, the provider’s services are assessed as a Security Protection Asset during your assessment, even without CUI.
Is my MSP a Cloud Service Provider under CMMC?
Not automatically. Per the DoD CMMC FAQ, an MSP is not a CSP if the cloud tenant is licensed to you, even if the MSP resells and administers it. The MSP may be a CSP if it contracts with the cloud provider and modifies the underlying service, which triggers FedRAMP Moderate authorization or equivalency requirements.
Can encrypted CUI be stored in a non-FedRAMP cloud?
No. The DoD November 2025 CMMC FAQ confirms encrypted CUI remains CUI under 32 CFR Part 2002, so a Cloud Service Provider storing it for contract performance must still meet FedRAMP Moderate or equivalency requirements.
Are VDI endpoints in scope if CUI stays inside the virtual desktop?
They can be out of scope only if the endpoint is configured so it does not process, store, or transmit CUI beyond keyboard, video, and mouse traffic. If the endpoint can copy, save, print, screenshot, or otherwise process CUI locally, it becomes a CUI Asset and is in scope.
What is a Customer Responsibility Matrix?
A Customer Responsibility Matrix (CRM) documents which CMMC responsibilities belong to you and which belong to your provider for the services in use. 32 CFR Part 170 requires that an ESP’s services be described in a service description and CRM and documented in your SSP (§ 170.19).
Can my readiness consultant also be my C3PAO?
No, not within three years. Under 32 CFR Part 170 (Subpart C), CMMC ecosystem members are prohibited from participating in a Level 2 certification assessment for an organization they served as a consultant to prepare for any CMMC assessment within the prior three years.
Can an MSP guarantee CMMC certification?
No. A provider can support readiness, operations, evidence, and remediation, but no MSP can guarantee an assessment outcome or assume your CMMC responsibility. Treat any guarantee of certification as a red flag.
What should I ask a CMMC MSP before signing?
Ask for a service description, a CRM, SSP inputs, a CUI and Security Protection Data data-flow explanation, a tool and sub-processor list, cloud-boundary and tenant-ownership details, FedRAMP evidence where applicable, incident and log support, written assessment-cooperation language, and references from DIB and CMMC work.
What if my current MSP refuses to provide a CRM?
Treat it as a serious red flag. Without a CRM or equivalent responsibility mapping, you cannot reliably show which requirements your provider supports, which evidence it maintains, or where the gaps are — which is exactly what a C3PAO will probe.
Need help deciding what type of CMMC provider you need?
Answer a few scope questions — your level, your CUI environment, your current MSP/MSSP role, and your timeline — and we’ll route you toward the provider category that fits, then connect you with verified providers who can respond. Do not submit CUI, contract numbers, credentials, network diagrams, or sensitive security details.
Get matched with verified providers in 60 seconds →Related reading
- Best CMMC MSP for Defense Contractors (2026 Buyer Checklist)
- CMMC RPO vs C3PAO: Which One Do You Need?
- CMMC Level 2 Self-Assessment vs C3PAO: 2026 Decision Guide
- Best C3PAO for CMMC Level 2: The Independent Selection Framework
- How to Find an Authorized C3PAO
- CMMC RPO Consultants: How to Vet, Compare, and Choose
- CMMC Readiness Checklist