CMMC ESP Directory Snapshot: July 18, 2026 Analysis

What this is

This is our dated count of the MSP Collective ESP Directory, an opt-in public directory. The MSP Collective states that it validates submitted certifications with the assessing C3PAO before publishing. These are aggregate observations of a third-party directory, not a complete census of organizations holding a CMMC Status. Read the directory analysis in our parent guide for the surrounding context.

Headline figures

• 49 entries as of July 18, 2026. All 49 are Level 2 against NIST SP 800-171 Rev. 2; zero are Level 3.
• 15 entries have certification dates in 2025 Q1; nine share March 7, 2025.
• The latest published certification date is May 18, 2026: a 61-day gap at the July 18 count. This gap opened before the July 13 suspension; the snapshot cannot establish its cause.
• Eight of the 49 listed providers are MSP Collective members.

Listings by certification quarter

Source: The Defense Compliance Report count of the MSP Collective ESP Directory, July 18, 2026, using each entry’s published certification date.

Geography

Virginia has 9 listed headquarters and Maryland has 7. Together they account for 33% of listings. Listed headquarters appear in 25 U.S. states and one Canadian province. These headquarters counts do not establish service coverage or local buyer demand.

Method and inclusion/exclusion rules

Our method was to count every published directory entry on July 18, 2026, and group entries by their published certification dates. The directory is opt-in and listings are free. The MSP Collective describes eligibility as meeting the ESP definition in the final rule, not being a CSP handling CUI, and holding Final Level 2 (C3PAO) or Final Level 3 (DIBCAC) status. The source states that it validates each submitted entry with the assessing C3PAO before publishing. Those are the directory’s stated criteria, not independent eligibility checks by us.

We did not receive or retain a verified raw provider list for this standalone page, so there is no raw CSV, per-provider table, or independently repeatable row-level audit here. Beyond the directory’s stated criteria and our dated count, further review or exclusion procedures are not documented in the source material for this page.

Limitations

An opt-in listing count is not an exhaustive census of certified providers, evidence of current Cyber AB Marketplace status, a provider endorsement, or a measure of demand. We did not independently confirm listed firms’ current standing or evaluate their services. Verify a provider’s standing directly before relying on it. This page reports the July 18 snapshot; it does not claim that the directory has remained unchanged since then or promise a future verification schedule.