CMMC Requirements for MSPs: When You’re In Scope, What You Must Prove, and When Certification Isn’t Required

CMMC requirements for MSPs, in one screen

Short answer:An MSP’s obligations depend on what its own systems touch, not on whether it markets itself as “CMMC compliant.” If CUI lands on the MSP’s assets, the MSP is assessed inside the contractor’s assessment; if the MSP is a cloud provider holding CUI, FedRAMP Moderate applies. If the MSP handles only Security Protection Data, its services are assessed as Security Protection Assets. If it touches neither CUI nor SPD on its own systems, it isn’t an External Service Provider.

Sources: 32 CFR § 170.19 Table 4 and 32 CFR § 170.16(a)(2)–(a)(3). Assembled into MSP operational scenarios by The Defense Compliance Report. Verified: July 1, 2026.

Find your row before you read further.Are you the SPD-only Security Protection Asset (the most common case), the CUI-on-your-systems case, the cloud-provider case, out of scope, or the conflict-of-interest case? Hold that answer — the rest of this page tells you exactly what it means and what to do.

What are the CMMC requirements for MSPs?

Short answer: The CMMC rule does not contain the word “MSP.” It regulates managed service providers through a broader category — External Service Provider (ESP) — defined in 32 CFR § 170.4. Whether and how an MSP is covered turns on two facts: whether it is a Cloud Service Provider (CSP), and whether Controlled Unclassified Information (CUI) or Security Protection Data (SPD) is processed, stored, or transmitted on provider-owned assets.

Here’s the reframe that dissolves most of the confusion. People search “does my MSP need CMMC” as if it’s a credential question — a yes/no badge. It isn’t. It’s a scope-and-evidence question: what do your people, tools, and systems actually touch, and where does that get assessed?

The rule uses precise vocabulary, so we will too:

FCI (Federal Contract Information)

Information provided by or generated for the government under a contract, not intended for public release. When a contract requires CMMC Level 1, it applies to the contractor systems that process, store, or transmit FCI — 15 basic safeguarding requirements from FAR 52.204-21, self-assessed annually, all 15 met in full with no exceptions.

CUI (Controlled Unclassified Information)

Government information that law or policy requires be safeguarded. When a contract requires CMMC Level 2, it applies to the systems that process, store, or transmit CUI — the 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families.

SPD (Security Protection Data)

Security-relevant data such as logs, configuration files, vulnerability data, and credentials used to protect the assessed environment. You can be in scope for handling SPD even if you never touch the client’s business CUI.

ESP (External Service Provider)

External people, technology, or facilities used for a contractor’s IT or cybersecurity operations, where CUI and/or SPD is processed, stored, or transmitted on the provider’s assets.

CSP (Cloud Service Provider)

An external company providing cloud infrastructure, platform, application, or storage services.

Notice the difference between an ESP and a subcontractor. If you furnish the actual contract deliverable, you’re a subcontractor, and CMMC requirements flow down to you under DFARS 252.204-7021 and 32 CFR § 170.23. If you support the contractor’s IT and security, you’re an ESP, scoped under 32 CFR § 170.19. Many MSP relationships become ESP relationships, not subcontractor relationships.

Do MSPs need their own CMMC certification?

Short answer: Usually not. Under 32 CFR § 170.16(a)(3), a non-cloud ESP that handles CUI has its relevant services “assessed within the scope of the OSA’s assessment against all Level 2 security requirements” — meaning the MSP is evaluated inside the contractor’s assessment rather than holding a separate certificate. An MSP may voluntarily pursue its own CMMC assessment to ease client audits and win business, but the rule does not make it mandatory for a non-cloud ESP.

This is the single most misreported fact on the topic. For a non-cloud ESP that handles CUI, the rule gives the contractor a clean path: document the ESP in the System Security Plan (SSP), the ESP’s service description, and a Customer Responsibility Matrix (CRM), and then assess those ESP services insidethe contractor’s assessment. There is no requirement in the rule that such an MSP hold a standalone CMMC certificate. Voluntary certification exists; mandatory certification for a non-cloud ESP does not.

So the honest picture is a spectrum, not a switch:

• You touch no CUI or SPD on your own systems → you’re not even an ESP, and no certification is required.
• You handle only SPD (logs, alerts, configs) → no certification required; you’re a Security Protection Asset assessed inside the client’s scope.
• You hold CUI on your own non-cloud systems → no automatic certificate required either; your services are assessed inside each client’s assessment. But if you serve several DIB clients, voluntary Level 2 certification is often the cleaner, cheaper path — because with your controls already assessed and authorized, you stop having to prove them from scratch in every client’s audit. A certified MSP is also a real differentiator.
• You’re a cloud provider holding CUI → certification isn’t the mechanism at all; FedRAMP is.

When is your MSP an External Service Provider (ESP)?

Short answer: An MSP becomes an ESP when it provides external IT or cybersecurity services and CUI or Security Protection Data is processed, stored, or transmitted on the MSP’s own assets. If neither CUI nor SPD ever touches the provider’s assets, the provider does not meet the CMMC definition of an ESP under 32 CFR § 170.19.

The phrase that trips people up is “on the MSP’s own assets.” Admin access alone is not the trigger — data landing on your systemsis. But “your systems” is broader than most MSPs assume. Any of these can pull you in:

• Your RMM (remote monitoring and management) platform
• Your SIEM or SOC tooling, EDR console, and the alerts and logs they ingest
• Your backup infrastructure
• Your ticketing/helpdesk system (attachments are the usual culprit)
• Your file-transfer or remote-support tools
• Your admin workstations
• Any cloud-hosted support tools you point at the client’s environment

Here’s the pattern we see cause the most trouble: an MSP swears “no CUI touches us,” then a technician pastes a CUI document into a support ticket, or a nightly backup sweeps up a CUI file share, or the SIEM ingests logs full of Security Protection Data. Now provider-owned systems are handling covered data, and the “we’re out of scope” story collapses on assessment day.

The five-question ESP self-check

Run your relationship through these before you tell a client anything. Answer honestly, then map yourself to a row in the matrix in the next section.

1. Does your own system process, store, or transmit CUI?
2. Does your own system process, store, or transmit logs, configuration data, alerts, vulnerability data, or other SPD?
3. Do you provide security functions for the client’s assessed environment (firewalling, monitoring, identity, patching)?
4. Do you own or modify the cloud service, or only administer the client’s own tenant?
5. Can you produce a service description and a Customer Responsibility Matrix?

What changes if the MSP handles CUI, Security Protection Data, or neither?

Short answer: CUI, SPD, and neither produce three different outcomes. If the MSP is a cloud provider handling CUI, FedRAMP Moderate applies; if it’s a non-cloud ESP handling CUI, its services are assessed inside the contractor’s assessment. If it handles only SPD, its services are assessed as Security Protection Assets against the specific Level 2 requirements they support. If it handles neither on provider-owned systems, it isn’t an ESP. This split comes directly from 32 CFR § 170.19 Table 4.

The MSP CMMC Scope, Evidence & Exposure Matrix

Source: 32 CFR § 170.19; 32 CFR § 170.16(a)(2)–(a)(3); CMMC FAQ v5; DoD FedRAMP Moderate Equivalency guidance. Assembled by The Defense Compliance Report editorial team. Last verified: July 1, 2026.

Three separate things people constantly blur

Almost every argument about “CMMC for MSPs” mashes three separate things into one. Pull them apart and the fog lifts:

• Track A — Your own certification. Voluntary, or driven by your own DoD contract. Relevant if you hold CUI on non-cloud systems and want to stop being re-assessed in every client’s audit, or if you’re also a DoD subcontractor whose own contract requires a CMMC status. Not automatically mandatory.
• Track B — FedRAMP Moderate (or equivalent). Only relevant if you act as a cloud provider for CUI.
• Track C — Being in scope for your client’s assessment as a Security Protection Asset. This one hits many MSP and MSSP relationships that touch zero business CUI but do process, store, or transmit Security Protection Data — logs, configs, alerts, vulnerability data, credentials — on provider-owned assets. It requires a CRM referenced in the client’s SSP.

You can owe Track C and not Track A or B. That’s the normal case. Getting this straight is worth more than any certificate.

When does an MSP need FedRAMP Moderate?

Short answer: An MSP does not need FedRAMP just for providing IT support. FedRAMP becomes the gating requirement when the MSP acts as a Cloud Service Provider whose offering stores, processes, or transmits CUI. Per 32 CFR § 170.16(a)(2) and DFARS 252.204-7012, that cloud offering must be FedRAMP Moderate Authorized or FedRAMP Moderate Equivalent.

Equivalency is not a marketing claim. Under the DoD’s FedRAMP Moderate Equivalency guidance (the December 21, 2023 memo), the cloud offering must be assessed by a FedRAMP-recognized Third-Party Assessment Organization against the full FedRAMP Moderate baseline — roughly 325 controls, about three times CMMC Level 2’s 110 — and backed by a Body of Evidence. A SOC 2 report, an ISO 27001 certificate, or a vendor questionnaire does not satisfy it. For more on this, see our full CMMC cloud service provider requirements guide.

Whether you’re even a CSP is its own question. The rule points to the NIST definition of cloud computing (on-demand self-service, broad network access, resource pooling, rapid elasticity, and location independence). Using cloud toolsto deliver your service does not make you a CSP. Here’s the line, three ways:

Sources: 32 CFR § 170.16(a)(2); DoD FedRAMP Moderate Equivalency guidance; CMMC FAQ, External Service Providers section.

The practical move, stated plainly. Standing up and continuously maintaining your own FedRAMP-equivalent CUI environment is a major compliance program in its own right — heavy on 3PAO assessment, documentation, and continuous monitoring — not an MSP shortcut. The cleaner route for most MSPs is to keep client CUI inside an already-authorized environment — Microsoft’s GCC High carries a FedRAMP High authorization and GCC a FedRAMP Moderate authorization; verify current status on the FedRAMP Marketplace — and architect your services around it. If that boundary decision is where you’re stuck, that’s exactly what a CUI enclave or GCC High implementation partner exists to solve.

What CMMC actually costs — and why your MSP is already in DoD’s math

Short answer: The DoD’s own cost estimates assume contractors will pay an External Service Provider to help them prepare for and participate in a Level 2 assessment — the analysis breaks out ESP support as its own labor line. For a small entity, DoD estimated a Level 2 self-assessment and affirmations at roughly $37,000 over three years, and a Level 2 C3PAO certification at $101,752 for the initial assessment ($104,670 over three years). Level 1 runs about $6,000.

We went to the source — the CMMC Program rule’s Regulatory Flexibility Analysis filed with the rulemaking. The numbers for a small entity:

Source: DoD Regulatory Flexibility Analysis, filed with the CMMC Program rule. See also our full CMMC Level 2 cost breakdown for market vs. DoD estimate comparison.

The part that matters for the MSP conversation: DoD’s model prices in labor “for a company (and any ESP support) to prepare for and participate in the assessment,” as a distinct line from in-house IT and management. In plain terms: the government built the cost of your MSP’s involvement into its official estimate of what CMMC costs a contractor.Your role in a client’s assessment isn’t a footnote the DoD forgot. It’s a line item.

Two honest caveats: these are DoD’s estimates, not market quotes — real engagements vary widely by size, scope, and starting maturity. And DoD’s Level 2 figures deliberately exclude the cost of actually implementingthe 110 controls, because the government considers that a pre-existing obligation under DFARS 252.204-7012 since 2017. That implementation and remediation work is usually the expensive part: across the market, the C3PAO audit fee itself is commonly only about 20–30% of a contractor’s total cost, with readiness, remediation, and technology the larger share.

What to demand from your MSP before an assessment

Short answer: A CMMC-ready MSP should give you documentation, not promises. At minimum, expect a service description, a Customer Responsibility Matrix, SSP inputs, a CUI/SPD data-flow map, a tool and subprocessor list, a privileged-access model, an evidence-export process, and a written commitment to support assessment interviews and artifact requests. 32 CFR § 170.19 requires the ESP relationship, services, SSP reference, and CRM to be documented.

It is still common to find an MSP that has never produced a Shared Responsibility Matrix. If yours hasn’t, you may have to demand one — and if they can’t build it, that tells you something before assessment day does. Use this as your request list, whether you’re the contractor asking or the MSP getting ahead of it:

Two contract terms are worth singling out. Get the assessment-cooperation and CRM-delivery commitments in writing — including update frequency — because a helpful MSP in the sales cycle can become an unreachable one during an audit. And watch the subprocessor question hard: if your MSP outsources help desk, NOC, or engineering to third parties who can reach CUI systems, that exposure can flow into your scope. Offshore or non-U.S.-person access is a special hazard for ITAR/EAR data and needs to be locked down contractually before it becomes an assessment finding.

Which NIST SP 800-171 Rev. 2 controls your MSP usually affects

Short answer:An MSP does not “own CMMC” for the contractor, but it typically influences the controls that decide whether an environment can be assessed cleanly. Within the 110 requirements, the heaviest MSP-touched areas are access control, identification and authentication, audit and accountability, configuration management, incident response, maintenance, risk assessment, system and communications protection, and system and information integrity.

This is the shortlist of families where an MSP’s tooling and procedures make or break the client’s evidence, plus the failure we see derail assessments in each one.

If your MSP can produce clean evidence across these families, you’re in good shape. If they go quiet when you ask for a patch dashboard or an access-review log, you’ve found your gap. See our NIST SP 800-171A assessment objectives guide for the full 320 objective-level breakdown.

Keep, supplement, or replace your MSP?

Short answer: Keep the MSP if it can map scope, produce evidence, support your SSP and CRM, control CUI/SPD flows, and cooperate with your assessment. Supplement it if the IT is strong but the documentation, monitoring, or CMMC interpretation is weak. Replace it if it refuses responsibility mapping, mishandles CUI/SPD, guarantees certification, hides its subprocessors, or wants to both prepare and assess the same environment.

Most contractors assume the answer is “fire the MSP and hire a defense specialist.” Sometimes. But often you don’t need a new MSP — you need a different category layered on top. Diagnose before you rip anything out.

The trap to avoid: replacing a competent generalist MSP with an expensive specialist when all you actually needed was a readiness firm to write the SSP and a matrix. Match the category to the gap.

MSP vs. MSSP vs. RPO vs. GRC platform vs. CUI enclave vs. C3PAO

Short answer:These are different jobs, and hiring the wrong one first is how contractors overspend and still aren’t ready. An MSP runs IT, an MSSP monitors security, an RPO/RP helps you prepare, a GRC platform organizes your evidence, a CUI enclave shrinks your scope, and a C3PAO performs the formal Level 2 certification assessment. Only a C3PAO can conduct the Level 2 certification assessment; Level 3 certification is a government (DIBCAC) assessment.

One rule the Cyber AB takes seriously, and so should you: under 32 CFR § 170.8(b)(17)(ii)(G) and the CMMC Code of Professional Conduct, an ecosystem member who served as a consultant to prepare an organization for any CMMC assessment cannot participate in that organization’s Level 2 certification assessment for three years. Separate the builder from the assessor, and don’t let a single vendor blur the line. Software alone doesn’t satisfy CMMC either — a GRC tool organizes your evidence; it doesn’t implement your controls or pass your assessment.

When does all of this actually hit?

Short answer: The CMMC Program rule (32 CFR Part 170) took effect December 16, 2024. The acquisition rule that puts CMMC into contracts — DFARS 252.204-7021 — took effect November 10, 2025, starting a four-phase, three-year rollout. Per the DoD’s CMMC FAQ, the first 12 months focus primarily on self-assessments; beginning November 10, 2026, CMMC Level 2 third-party (C3PAO) assessments will be required for applicable contractors.

• Phase 1 is live now (November 10, 2025 forward). Contracting officers are inserting Level 1 and Level 2 self-assessment requirements — and they have discretion to require a Level 2 C3PAO certification on select contracts even in Phase 1.
• From November 10, 2026: third-party Level 2 certification becomes a condition of award for applicable CUI contracts, and the requirement broadens through the remaining phases as the rollout completes by 2028.

Why that matters for the MSP timeline: a Level 2 certification program commonly runs 12 to 18 months once you count scoping, remediation, documentation, and getting on a C3PAO’s schedule — treat that as a planning range, not a promise, and confirm it against your own scope and required assessment type. There’s no grace period for new bidders — you need the required status at award. If your clients wait for the clause to appear before they fix their MSP relationship, the math doesn’t work. Neither does yours.

What we actually verified

For this page, The Defense Compliance Report Editorial Team verified the following against primary sources, in July 2026:

• The ESP scoping logic — 32 CFR § 170.19, Table 4, checked on eCFR — and that the rule regulates MSPs through the term “ESP,” not “MSP” (32 CFR § 170.4).
• The certification question — 32 CFR § 170.16(a)(3): a non-CSP ESP handling CUI has its services assessed within the contractor’s assessment, not via a mandatory standalone certificate — corroborated by the DoD CMMC FAQ, External Service Providers section.
• The CSP/FedRAMP requirement — 32 CFR § 170.16(a)(2) and DFARS 252.204-7012 on acquisition.gov, plus the DoD FedRAMP Moderate Equivalency guidance.
• The cost figures — DoD’s Regulatory Flexibility Analysis: small-entity Level 2 C3PAO at $101,752 initial / $104,670 over three years, Level 1 at $5,977, and the explicit “(and any ESP support)” labor line.
• The timeline — DFARS 252.204-7021 effective November 10, 2025; the phase schedule tied to 32 CFR § 170.3(e); Level 2 third-party assessments required for applicable contractors beginning November 10, 2026.
• The conflict-of-interest rule — the three-year prohibition in 32 CFR § 170.8(b)(17)(ii)(G) and CoPC v2.0.
• NIST SP 800-171 Revision 2 as the assessed Level 2 standard, held in place by a DoD class deviation to DFARS 252.204-7012 pending future rulemaking to incorporate Revision 3.

What we did not verify, and won’t assert: we did not independently confirm the internal ESP-labor sub-totals within DoD’s cost tables — sources that cite specific figures describe them as inferred and disagree with one another — so we’ve stated only the confirmed totals. We do not rank or endorse named MSPs on this page. Last verified: July 1, 2026.

Frequently asked questions about CMMC requirements for MSPs