CMMC RPO vs MSP: What Each Does, Which to Hire First, and Whether Your MSP Is in Scope
By The Defense Compliance Report Editorial Team · Published June 15, 2026 · Last verified: June 15, 2026
The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We don’t sell CMMC services. We read the rules, check the sources, and route readers to source-checked provider options when they ask. (Full disclosure at the bottom.)
If you’re weighing CMMC RPO vs MSP, here’s the short version before you scroll: they are not two versions of the same hire. A Registered Practitioner Organization (RPO) is a Cyber AB–registered advisor that prepares you for CMMC. A Managed Service Provider (MSP) — or a security-focused Managed Security Service Provider (MSSP) — runs and secures your systems and implements the controls. Neither one can certify you; only an authorized C3PAO (Certified Third-Party Assessor Organization)can do that — and it has to be a different firm from the one that prepared you.
Which do you hire first? Start here.
| If this is your situation | Hire first |
|---|---|
| "We're not sure of our CUI boundary, our level, or our assessment path" | An RPO / readiness advisor |
| "We know the target, but no one can operate the controls day to day" | A CMMC-capable MSP or MSSP |
| "Our MSP runs everything but doesn't really know CMMC" | Keep the MSP, add an RPO — if the MSP will cooperate |
| "Our MSP just told us they won't support CMMC" | An RPO to triage scope first, then replace or supplement the MSP |
| "We need both the documentation and the daily operations" | A hybrid RPO/MSP, or an RPO + MSP/MSSP pair |
| "We've implemented everything and need the certificate" | A C3PAO — kept separate from whoever prepared you |
Not sure which row is you? That’s the most common place to be, and it’s the reason this page exists.
Find your CMMC provider path. Tell us your level, CUI scope, current MSP situation, and timeline. We’ll map the provider categoryyou actually need — RPO, MSP/MSSP, hybrid managed compliance, CUI enclave, GRC software, or C3PAO — before you start requesting quotes.
Map My Provider Path →RPO vs MSP vs C3PAO: the 30-second version
An RPO advises, an MSP/MSSP implements and operates, and a C3PAO independently assesses.The same company can both advise and implement — many MSPs are also registered RPOs — but the company that prepares you cannot be the one that certifies you. That separation is not optional.
We read the Cyber AB’s own ecosystem-roles definitions to confirm this, and the language is unusually blunt: an RPO delivers non-certified advisory services and may itself be a consulting firm or an MSP — but it does notconduct certified CMMC assessments. So “RPO vs MSP” is the wrong frame. The right frame is a three-seat team:
| Role | What it actually is | Cyber AB / CAICO status | Advises? | Implements & operates? | Can it certify you? |
|---|---|---|---|---|---|
| RPO (Registered Practitioner Organization) | A firm registered with the Cyber AB to give non-certified CMMC advice through its Registered Practitioners | Cyber AB registration (background check + Code of Professional Conduct + at least one RP). It's a registration, not a competency audit. | Yes — its core job | Sometimes (many RPOs are also MSPs) | No |
| RP / CCP / CCA (individuals) | Credentialed people. RP = entry advisory; CCP / CCA / Lead CCA = assessment-track credentials | RP/RPO via Cyber AB; CCP, CCA, Lead CCA and CCI now administered by ISACA as the credentialing body (CAICO) | Yes (RP, CCP) | No (people, not operators) | No (only a C3PAO organization certifies) |
| MSP (Managed Service Provider) | An IT operations firm: networks, Microsoft 365, endpoints, patching, backups, helpdesk. Not a CMMC credential. | None inherent. May also be a Cyber AB RPO — verify that separately. | Only if also an RPO or staffed for compliance | Yes — its core job | No |
| MSSP (Managed Security Service Provider) | A security-focused MSP: SOC, SIEM, monitoring, incident response, vulnerability management | None inherent (same as MSP) | Sometimes | Yes — security controls | No |
| MSP/MSSP + RPO (hybrid) | One firm that both runs/secures your IT and holds RPO registration | Cyber AB RPO, sometimes plus its own CMMC Level 2 for the services it provides | Yes | Yes | No — still needs an independent C3PAO |
| CUI enclave / GCC High provider | Builds or licenses the bounded environment where CUI actually lives to shrink scope | None inherent; usually delivered by an MSP/RPO | Sometimes | Yes — the environment | No |
| GRC / compliance software | Tooling for your SSP, POA&M, evidence, and control tracking | None (it's software, not a Cyber AB role) | No | Supports work; does not implement controls for you | No |
| C3PAO (Certified Third-Party Assessor Organization) | The only organization the Cyber AB authorizes to run official CMMC Level 2 certification assessments | Cyber AB-authorized; staffs Lead CCAs; must meet ISO/IEC 17020 | Only outside an assessment engagement (conflict rules) | No — independent evaluator | Yes — Level 2. (Level 3 assessed by government / DIBCAC.) |
Read the table top to bottom and the panic usually drains out of the question. You’re not choosing one vendor. You’re staffing a small team, and most of the confusion comes from companies that sell two or three of these seats and have a reason to blur the lines between them.
What’s the difference between a CMMC RPO and an MSP, really?
What a CMMC RPO does
A strong RPO owns the work that lives in spreadsheets, policies, and judgment calls:
- Scoping — deciding which assets, people, and facilities are in scope, and which can be carved out.
- Gap assessment against the 110 security requirements of NIST SP 800-171 Revision 2.
- SSP authoring or validation — the document an assessor reads first.
- POA&M planning — what's open, who owns it, and when it closes.
- Control interpretation — turning a requirement into a specific configuration or procedure.
- Evidence mapping — what artifact proves each of the 320 assessment objectives in NIST SP 800-171A (not just the 110 parent controls).
- Mock readiness and assessment-day support.
What a CMMC MSP (and MSSP) does
An MSP runs the environment. In a CMMC context, that typically means:
- Managed identity, multi-factor authentication, and conditional access
- Endpoint management and encryption
- Patch and vulnerability management
- Security logging, monitoring, and alerting (this is where an MSSP specializes)
- Backups and restoration testing
- Firewall and network administration
- Operating a Microsoft 365 GCC High, Azure Government, AWS GovCloud, or enclave environment
- Producing logs, configs, and reports as evidence for the controls it runs
The shorthand: an MSP manages IT; an MSSP manages security. Plenty of CMMC-focused firms do both. The label matters far less than the responsibility split, the evidence they can produce, and whether they understand they may be sitting inside your assessment scope. See Best CMMC MSP for defense contractors for our vetting guide.
Where neither one replaces a C3PAO
Which should you hire first — an RPO or an MSP?
| Your bottleneck | Hire first | Why |
|---|---|---|
| Unknown CUI boundary | RPO | A wrong boundary inflates cost and breaks the assessment |
| Unknown contract / assessment type | RPO | The contract decides Level 2 self-assessment vs C3PAO |
| Weak SSP, no real POA&M | RPO | Documentation has to match reality, or you fail on evidence |
| No IT/security capacity | MSP/MSSP | Someone has to actually run the controls, continuously |
| MSP is cooperative but new to CMMC | RPO + your MSP | RPO interprets; MSP executes |
| MSP is unwilling | RPO triage, then replace | Don't switch blind — find out what it touches first |
| You're deciding on an enclave or a tool | RPO / enclave advisor first | Don't buy architecture before you've scoped |
| Assessment is scheduled | RPO/MSP cleanup, then C3PAO | Your C3PAO is not your prep consultant |
When an RPO is the right first hire
- Your scope is fuzzy — you handle CUI but can't draw the boundary or separate Security Protection Assets from out-of-scope systems. An RPO earns its fee here in the first two weeks.
- Your SSP and POA&M are thin or aspirational. A beautiful SSP that describes a system you don't actually run is worse than none.
- Your internal IT team can execute, but needs direction. You may not need to replace your MSP at all.
- You need to know 'are we ready?' — not 'can we keep this running?' Readiness is an RPO question.
When an MSP is the right first hire
- You can't run the controls. No one to own MFA, conditional access, EDR, patch cadence, logging, backups, and incident response.
- You need a managed secure environment — Microsoft 365 GCC High, Azure Government, AWS GovCloud, or a CUI enclave.
- Your 'compliance problem' is really an operations problem. A POA&M doesn't patch anything. GRC software doesn't monitor your network.
- You need to maintain status between assessments. CMMC runs on a three-year cycle with annual affirmation in SPRS — an MSP keeps you from drifting out of compliance.
Does your MSP need its own CMMC certification?
We went to the source — the DoD CIO’s official CMMC Program FAQ — and read the External Service Provider answers directly. Three of them settle the question:
The simple rule: stop asking “Is the MSP certified?” Ask “What does the MSP touch?”
If the MSP: MSP stores CUI on its own (non-cloud) systems
Those systems fall in your scope; the MSP doesn't need a separate certificate but its security must be at least equal to your required level, and it may elect its own assessment.
If the MSP: MSP/MSSP doesn't handle CUI but manages your security (logs, configs, RMM, SIEM, endpoints, firewall)
It's still an ESP, and its services are assessed as Security Protection Assets during your assessment.
If the MSP: MSP only has temporary access (vulnerability assessment, pen testing, incident response/forensics)
Not treated as an ESP and not deemed to handle CUI — stated in the rule's Federal Register response. Same for staff augmentation where you provide the equipment.
If the MSP: MSP merely uses cloud tools to deliver its service
That alone does not make it a Cloud Service Provider.
If your MSP touches CUI, logs, configs, RMM, SIEM, or admin access, don’t guess and don’t switch blind. Tell us what your provider actually touches and we’ll help you see whether you need RPO-led scope triage, a replacement MSP, MSSP support, or a tighter CUI enclave.
Map My MSP Scope Risk →Is your MSP in your CMMC assessment scope? The ESP rule (32 CFR 170.19)
We read the scoping section of the rule, 32 CFR §170.19, directly. It requires you (the Organization Seeking Assessment) to ask two questions about every ESP: is it a Cloud Service Provider, and does it handle CUI and/or Security Protection Data?
| What your provider does | In your assessment scope? | FedRAMP implication | What to verify |
|---|---|---|---|
| Pure advisory (RPO), no CUI/SPD on its systems | No | None | Marketplace listing; named practitioner; no conflict with your future assessor |
| MSP/MSSP that touches your CUI or SPD (logs, config) | Yes — assessed within your scope. No separate certificate required (final rule). | If on-prem/your enclave, no FedRAMP trigger from them | A Customer Responsibility Matrix mapped to all 320 NIST SP 800-171A objectives, not just the 110 controls; whether their admin tools meet the controls; willingness to stand with you during the assessment. |
| MSP/MSSP that does not touch CUI/SPD on its assets | Likely out of the ESP definition — but admin access often involves SPD, which pulls it back in. Make this determination deliberately. | None inherent | Get the scoping decision documented (this is where an RPO earns its fee) |
| Cloud Service Provider storing/processing/transmitting your CUI | In scope via the cloud boundary | Must meet FedRAMP Moderate — authorization or DoD equivalency — under DFARS 252.204-7012 | FedRAMP Moderate status or an equivalency body-of-evidence; that it's authorized at the boundary you'll use |
| Provider with temporary access only (pen test, IR, vuln scan) | No — not an ESP | None | Scope the engagement and access tightly |
| C3PAO | Not an ESP — it assesses, it doesn't operate your systems | n/a | Authorized and current on the Cyber AB Marketplace; that it didn't also prepare you |
The decision in plain language
Map your MSP scope risk before you switch anything. If your MSP touches CUI, logs, configs, RMM, SIEM, or admin access, tell us what your provider actually touches and we’ll help you see whether you need RPO-led scope triage, a replacement MSP, MSSP support, or a tighter CUI enclave.
Map My MSP Scope Risk →When do you need both an RPO and an MSP?
The fastest way to waste money on CMMC is to buy these roles in the wrong order, or to let one vendor quietly own all of them.We’ve watched it happen two ways. A contractor pays an RPO to write a gorgeous SSP, then discovers its MSP can’t produce the evidence to back a single control — so it pays again. Or a contractor signs an all-in-one “managed compliance” firm and finds that leaving, or even getting a straight answer, is painful once everything lives inside one vendor.
That’s not an argument for buying less help. It’s an argument for getting the sequence and the responsibility split right before you sign.Before you’re locked in, get these in writing:
Who owns what (the split that prevents double-paying)
| Workstream | RPO leads | MSP/MSSP leads | You still own |
|---|---|---|---|
| CUI boundary & scoping | ✔ | support | ✔ accountability |
| Assessment-type interpretation | ✔ | support | ✔ |
| SSP structure & narrative | ✔ | input | ✔ |
| POA&M planning | ✔ | input | ✔ |
| Control interpretation | ✔ | support | ✔ |
| Evidence requirements | ✔ | — | ✔ |
| Evidence production for operated controls | — | ✔ | ✔ |
| Technical remediation | support | ✔ | ✔ |
| Ongoing control operation & monitoring | — | ✔ | ✔ |
| Mock assessment | ✔ | support | ✔ |
You can outsource the work. You cannot outsource accountability — DFARS 252.204-7025 ties your eligibility for award to your own current CMMC status in SPRS for any system that will handle FCI or CUI.
Worried about paying twice or getting locked in? Get the split right first. Before you hire an RPO, replace your MSP, or sign a managed-compliance contract, get a neutral read on which workstream belongs with which provider category.
Check Whether You Need RPO, MSP, or Both →What if your current MSP isn’t CMMC-ready?
| If your MSP touches… | Ask them for… | If they can’t produce it… |
|---|---|---|
| CUI on their systems | A service description, where CUI resides, and their security level vs. your required level | They may be enlarging your scope without the controls — escalate or replace |
| Logs / config / SIEM / RMM (SPD) | A Customer Responsibility Matrix mapped to the 320 objectives | They're an in-scope ESP that can't evidence its part — high risk |
| Identity / MFA / endpoints | Conditional-access policies, device-compliance and patch reports | Core controls aren't demonstrable — remediation or replacement |
| Backups containing CUI | Backup configuration and restoration-test records | Recovery evidence is missing — a likely finding |
How RPOs, MSPs, MSSPs, GRC software, enclaves, and C3PAOs fit together
Most CMMC programs need a small stack, not one magic vendor.The usual sequence: scope and readiness first, technical implementation second, evidence operations continuously, and a C3PAO assessment last — only when you’re ready and the contract requires it.
| Category | Best used for | Not for | Key risk to watch |
|---|---|---|---|
| RPO / readiness consultant | Scope, SSP, POA&M, evidence plan, mock readiness | Daily IT operations; formal certification | Treating 'RPO' as a quality guarantee |
| MSP | IT operations: identity, endpoint, cloud, backup, patching | Independent assessment | Weak CMMC evidence; scope confusion |
| MSSP | SOC, logging, monitoring, incident response | Owning your full documentation | SPD handling and evidence ownership |
| GRC software | Organizing evidence, workflow, control tracking | Implementing controls by itself | "The tool replaces judgment" illusion |
| CUI enclave provider | Scope reduction, secure collaboration | Whole-company compliance by default | Misread shared-responsibility split |
| C3PAO | Formal Level 2 certification assessment | Readiness consulting for the same client | Conflict of interest if it also prepped you |
| DIBCAC | Level 3 / government-led assessment | General readiness help | Assessment-readiness bottleneck |
What does CMMC RPO vs MSP help cost — and how long does it take?
The official floor. The CMMC Program rule’s own regulatory analysis (32 CFR Part 170, published in the Federal Register October 15, 2024) estimates a small entity’s Level 2 C3PAO certification assessment plus its initial affirmation at roughly $101,752, of which about $31,234 is the C3PAO assessment engagement itself. Two things to keep in mind: the analysis assumes you have already implemented NIST SP 800-171 Rev. 2, so these figures exclude readiness, remediation, MSP services, cloud or enclave migration, software, hardware, and internal labor. See our full CMMC cost breakdown.
| Cost bucket | RPO-driven? | MSP-driven? | Notes |
|---|---|---|---|
| Initial scope review | ✔ | sometimes | Depends on CUI complexity |
| Gap assessment | ✔ | sometimes | RPO or CMMC-capable MSP |
| SSP / POA&M | ✔ | sometimes | Must match the real environment |
| Technical remediation | sometimes | ✔ | Identity, endpoint, network, cloud, logging |
| Ongoing managed services | — | ✔ | Monthly, recurring |
| MSSP / SOC | — | ✔ | Often priced separately from the MSP |
| GRC software | sometimes | sometimes | Tooling, not implementation |
| CUI enclave (e.g., GCC High) | — | ✔ | Licensing plus migration |
| C3PAO assessment | — | — | A separate, independent provider |
| Internal staff time | ✔ | ✔ | The cost everyone underestimates |
Before you pay a consultant, replace an MSP, or license an enclave, get the category right. Tell us your environment and timeline and we’ll help you compare the realistic paths and request scoped quotes from matched provider categories.
Compare Scoped Paths →The biggest red flags when comparing a CMMC RPO and MSP
The single biggest red flag is a provider that blurs roles— an RPO implying it can certify you, an MSP claiming to be a “CMMC-certified MSP” without explaining what that means, or a C3PAO offering to both prepare and assess the same engagement.
| If a provider says… | It might actually mean… | Verify it by… |
|---|---|---|
| "We're a CMMC-certified MSP" | RPO status, credentialed staff, or its own voluntary assessment — or nothing | Check the Cyber AB Marketplace listing and ask which specific claim they mean and at what level |
| "We'll get you certified" | Readiness help, not certification | Only a C3PAO certifies Level 2; confirm they aren't implying they also assess you |
| "We guarantee you'll pass" | Sales language | No one can guarantee an assessor's determination — treat as disqualifying |
| "We're already on Rev. 3" | They may be ahead — or confused | CMMC Level 2 is assessed against Rev. 2 today; ask exactly how they handle the gap |
| "Compliant in two weeks" | Marketing, not engineering | Real Level 2 readiness takes months; ask what they're actually scoping |
Additional conversation-stoppers:
What to ask before you hire a CMMC RPO or MSP
The right questions force a provider to reveal whether they understand your level, scope, evidence burden, and assessment path — and whether they’re even allowed to perform the role they’re selling.
Ask an RPO
- Are you currently listed as a Cyber AB RPO? (Verify it yourself on the Marketplace.)
- Which Registered Practitioners, CCPs, or CCAs will work on our engagement, specifically?
- What exactly do you deliver — scope memo, gap assessment, SSP, POA&M, evidence plan, CRM, mock assessment?
- Do you only write documentation, or do you verify implementation?
- How do you handle the shared-responsibility split with our MSP/MSSP?
- Do you have experience with our environment — GCC High, AWS GovCloud, on-prem, enclave, a manufacturing floor?
- Will you support Level 2 self-assessment, Level 2 C3PAO, or both?
- Is there any relationship that would prevent you (or affiliated personnel) from being involved in our later assessment?
Ask an MSP / MSSP
- Do you process, store, or transmit our CUI? Our Security Protection Data?
- Which of your tools touch our CUI boundary? Do you run RMM on in-scope endpoints?
- Can you produce logs, configurations, access records, vulnerability reports, backup-restore tests, and incident-response records — on demand?
- Can you support a Customer Responsibility Matrix mapped to the 320 objectives?
- Are your cloud services FedRAMP Moderate authorized or equivalently assessed where required?
- Will you sit in a C3PAO assessment interview for the services you operate?
- What happens to our data, evidence, and admin access if we leave you?
Ask a hybrid RPO/MSP
- Which of your work is advisory and which is operational?
- Who owns the SSP, and who owns each control?
- What evidence can we export if we leave — and how fast?
- Are you using subcontractors or delivering anything through a Cloud Service Provider?
- Which of your claims are Cyber AB status, which are company-stated, and which are independently verified?
Free: the CMMC RPO vs MSP Vetting Worksheet. A one-page checklist to score any provider: category, Cyber AB status, compensation relationship, services reviewed, scope role, CUI/SPD access, evidence responsibility, CRM status, conflict-of-interest risk, and last-verified date.
Download the Vetting Worksheet →What to do before you talk to a C3PAO
Confirm the contract actually requires a C3PAO assessment.
DFARS 252.204-7025 requires the solicitation to state the required CMMC level; not every Level 2 requirement is a C3PAO requirement. The DoD has said Level 2 third-party assessments are required for applicable contractors beginning November 10, 2026. Read the clause, don't assume. Unsure which applies to you? See our CMMC self-assessment vs C3PAO guide. CMMC Level 2 self-assessment vs C3PAO →
Confirm your evidence package is real.
SSP, asset inventory, network and data-flow diagrams, Customer Responsibility Matrix, POA&M status, evidence mapped to the 320 objectives, your MSP/MSSP evidence, any cloud/FedRAMP evidence, and named internal control owners.
Confirm independence.
Whoever prepared you can't assess you within three years (32 CFR §170.8(b)(17)(ii)(G)). Pick a C3PAO with no advisory or financial relationship to your prep firm or MSP, and expect a conflict-of-interest check at kickoff. Our authorized C3PAO guide →
What we actually verified for this guide
We built this from primary and authoritative sources, then layered our editorial judgment on top of the verified facts. Regulatory facts are sourced; the routing advice is clearly ours.
| What we verified | Type | Source | Verified |
|---|---|---|---|
| RPO definition and limits (may be a consulting firm or an MSP; does not assess) | Regulatory / ecosystem | Cyber AB, Ecosystem Roles | Jun 15, 2026 |
| CMMC Program rule, scoping, and ESP definition | Regulatory | 32 CFR Part 170 / §170.19 (eCFR) | Jun 15, 2026 |
| MSP/MSSP scope, 'no separate certification,' 'may elect' assessment | Regulatory / guidance | DoD CIO CMMC FAQ (E-A3, E-A4, E-A5) | Jun 15, 2026 |
| Assessor independence: 3-year consultant/assessment prohibition | Regulatory | 32 CFR §170.8(b)(17)(ii)(G); CMMC Code of Professional Conduct v2.0 | Jun 15, 2026 |
| C3PAO ISO/IEC 17020:2012 within 27 months of authorization | Regulatory | 32 CFR §170.9 (eCFR) | Jun 15, 2026 |
| CSP must meet FedRAMP Moderate (authorization or equivalency) for CUI | Regulatory | DFARS 252.204-7012 (Acquisition.gov); FAQ E-A1 | Jun 15, 2026 |
| DFARS 252.204-7021 effective Nov 10, 2025; Level 2 third-party for applicable contractors Nov 10, 2026 | Regulatory | Federal Register (Sept 10, 2025); DoD FAQ B-A2; 32 CFR 170.3(e) | Jun 15, 2026 |
| Level 2 = 110 requirements / 14 families (Rev. 2); 320 objectives (171A); Rev. 2 controlling via class deviation | Regulatory | NIST CSRC; DoD FAQ B-A3 | Jun 15, 2026 |
| Level 2 C3PAO cost estimate (~$101,752 small entity; ~$31,234 C3PAO line item) | Cost / regulatory | 32 CFR Part 170 regulatory analysis (Federal Register, Oct 15, 2024) | Jun 15, 2026 |
| Individual credentials now administered by ISACA (CAICO) | Ecosystem | ISACA; Cyber AB; DoD FAQ A-A4 | Jun 15, 2026 |
These facts go stale. Level 2 third-party assessments begin for applicable contractors on November 10, 2026, and the rollout continues phasing in through 2028. If the DoD incorporates NIST SP 800-171 Rev. 3, several points above change. We re-verify this page quarterly and update the “Last verified” date when we do. See how we work in our editorial standards and our corrections policy.
CMMC RPO vs MSP: frequently asked questions
- What is a CMMC RPO?
- A CMMC RPO (Registered Practitioner Organization) is a firm the Cyber AB has registered to deliver non-certified CMMC advisory services through its Registered Practitioners. The Cyber AB notes that an RPO may be a consulting firm or an MSP, but it does not conduct certified CMMC assessments.
- What is a CMMC MSP?
- A CMMC MSP is a managed service provider that supports the IT or cybersecurity operations of contractors preparing for or maintaining CMMC. "CMMC MSP" is a market category, not a standalone Cyber AB credential — an MSP can become CMMC-relevant by also being an RPO, employing credentialed staff, or electing its own assessment.
- Can an MSP also be an RPO?
- Yes. The Cyber AB's own definition allows a Registered Practitioner Organization to be an MSP. The catch: you still have to verify the firm's exact Cyber AB status, the credentialed practitioners on your engagement, the services, the evidence responsibilities, and any compensation relationship — separately.
- Does my MSP need to be CMMC certified?
- Not automatically. Per the DoD CMMC FAQ, a non-cloud MSP that stores your CUI is not required to hold its own CMMC assessment (though it may elect one); what matters is that the MSP's services are covered within your assessment scope and can be evidenced. A cloud provider handling your CUI is different: it must meet FedRAMP Moderate under DFARS 252.204-7012.
- Is "CMMC-certified MSP" a real Cyber AB credential?
- No. The Cyber AB lists RPOs for advisory services and C3PAOs for assessments. An MSP may hold RPO status, employ credentialed people, or pursue its own assessment, but "CMMC-certified MSP" is not a defined Cyber AB provider label. Ask the firm to specify which claim it's actually making.
- Do I need an RPO if I already have an MSP?
- You may, if your MSP can operate systems but can't define your scope, build the SSP, structure POA&Ms, map evidence, or prepare you for assessment. If your MSP already has strong CMMC advisory capability, you may not need a separate RPO.
- Do I need an MSP if I already have an RPO?
- You may, if your RPO surfaces technical gaps your internal team can't operate or maintain. An RPO explains the requirements; someone still has to run identity, endpoints, logging, patching, backups, and monitoring.
- Can my RPO or MSP also be my C3PAO?
- No. Under 32 CFR §170.8(b)(17)(ii)(G), a CMMC Ecosystem member that served as a consultant to prepare you for any CMMC assessment is prohibited from participating in your Level 2 certification assessment within three years — and that applies to the C3PAO as a company and to every assessor on the team. Confirm the C3PAO's conflict-of-interest determination before you engage it.
- What is an ESP in CMMC?
- An External Service Provider (ESP) is external people, technology, or facilities used for IT or cybersecurity services where CUI or Security Protection Data is processed, stored, or transmitted on the provider's assets. ESPs handling your CUI or SPD are assessed within your scope and don't need a separate certificate (32 CFR §170.19).
- What is Security Protection Data?
- Security Protection Data (SPD) is supporting data — logs, configuration data, and similar security telemetry — used to protect your in-scope systems. If an MSP or MSSP handles your SPD, its services are assessed as Security Protection Assets during your assessment.
- Is an MSSP different from an MSP for CMMC?
- Yes. An MSP manages IT operations; an MSSP manages security operations — SOC, SIEM, monitoring, incident response, vulnerability management. Either becomes an ESP if it processes, stores, or transmits your CUI or Security Protection Data.
- Does CMMC Level 2 use NIST SP 800-171 Rev. 2 or Rev. 3?
- Rev. 2. The DoD has said it will incorporate Rev. 3 through future rulemaking, and in the interim it issued a class deviation keeping Rev. 2 as the standard against which contractors are assessed until Rev. 3 is incorporated into the 32 CFR CMMC rule. A provider that treats Rev. 3 as today's CMMC standard is ahead of the rule.
- What if my solicitation says Level 2 self-assessment instead of Level 2 C3PAO?
- Follow the solicitation. DFARS 252.204-7025 requires it to state the required level, and DFARS 252.204-7021 requires you to maintain that current status throughout performance. The DoD has said the first year focuses primarily on self-assessments.
- Do CMMC requirements flow down to subcontractors?
- Yes. DFARS 252.204-7021 requires contractors to apply the flow-down rules in 32 CFR 170.23 and pass the appropriate CMMC level down to subcontracts that will handle FCI or CUI.
The bottom line
CMMC RPO vs MSP was never really a fork in the road. It’s two seats on the same team — an advisor and an implementer — plus an independent assessor who has to stay at arm’s length. Fill the seat your biggest gap demands first, keep your CUI footprint small, verify every provider against the Cyber AB Marketplace, and never let one vendor own your scope, your documents, your evidence, and your exit at the same time.
Need help deciding what type of CMMC provider you need?Tell us your level, scope, and timeline, and we’ll match you with source-checked CMMC provider options — without routing a readiness problem to an assessment provider, or an operations problem to a document-only consultant.
Related reading
- CMMC Level 2 self-assessment vs C3PAO: which path your contract requires
- Best CMMC MSP for defense contractors
- CMMC RPO consultants: vetting, costs, independence
- Best CMMC providers for small business
- CMMC RPO vs C3PAO: what each does
- CMMC provider categories: who to hire first
- Who to hire first for CMMC
- What CMMC actually costs
- CMMC managed service providers overview
- CMMC flow-down requirements for subcontractors
- CMMC deadlines 2026
- CMMC phases: what each phase requires