Outsource CMMC Compliance: What “Turnkey” and “Done-for-You” CMMC Can (and Can’t) Do
If you typed outsource CMMC compliance into a search bar, you’re not looking for a lecture on cybersecurity maturity. You’re looking for someone to take this off your plate. Here’s the bottom line before you scroll any further: you can outsource most of the work of CMMC, but you cannot outsource your way to a certificate. A managed provider, a Registered Provider Organization, or a Managed Security Service Provider can implement controls, write your documentation, and operate your security tools — but the independent certification assessment, the SPRS affirmation signed by a senior official inside your company, and the accountability for getting your compliance status right all stay with you.
That last point is where the six-figure mistakes happen. Below, we draw the exact line — using the rule text we read ourselves — between what you can hand off and what stays yours, what each outsourcing model actually costs, and the one provider trap that can quietly cause you to fail an assessment you paid a fortune to pass.
The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.
Who this page is for
For: DIB contractors trying to reduce internal CMMC workload — small suppliers without a security team, Level 2 contractors weighing an MSSP or a CUI enclave, and anyone comparing “turnkey CMMC” offers and trying to tell the real ones from the risky ones.
Not for: If you’re already assessment-ready and just need to book a C3PAO, go to our C3PAO selection guide. If you’re brand new to CMMC, start with our CMMC provider categories overview. We don’t publish named “best provider” rankings — and we’ll explain why that’s a feature, not a gap.
Key qualifier: Your contract clause and your CUI/FCI scope drive every answer on this page. Under the CMMC Program Rule, the requiring activity selects the CMMC level based on the sensitivity of the information involved, and the requirement flows down to subcontractors (32 CFR Part 170). The clause sets your level — not a checklist, and not a salesperson.
The 30-second answer: what you can outsource, and what you can’t
Here’s the whole page in one table. Everything below is the detail behind it.
| CMMC workstream | Can you outsource it? | What stays yours | Best-fit provider category |
|---|---|---|---|
| Figuring out your required level | No — contract decision | Reading the clause and flow-down (with help) | RPO/RP or federal-contracts attorney to interpret |
| FCI/CUI scoping | Shared | The truth of where your CUI actually lives | RPO, vCISO, enclave architect |
| Building a secure environment / enclave | Yes, technically | Boundary, users, CUI workflows | CUI enclave, MSP/MSSP, cloud implementer |
| Security tools + operations (identity, logging, monitoring) | Yes, mostly | Oversight, decisions, evidence ownership | MSP/MSSP |
| SSP and POA&M drafting | Yes, supportable | Accuracy, approval, upkeep | RPO, GRC platform |
| Evidence collection + organization | Yes | Producing real evidence on assessment day | GRC platform + MSP/RPO |
| SPRS score + annual affirmation | Support only | Your Affirming Official signs it | Internal owner, advisor support |
| The Level 2 certification assessment | No — independent only | Being ready before you book it | Authorized/accredited C3PAO (a separate firm) |
| Ongoing compliance | Yes, operationally | Continuous control ownership | MSP/MSSP, GRC, vCISO |
The one line to remember: you can outsource the labor. You cannot outsource the accountability, the independent assessment, or the signature.
The right CMMC provider isn’t the same for every contractor— the category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist. Because a general answer can’t resolve those for you, use the Find My CMMC Path tool to map your situation to the right provider category before you request quotes.
Map my CMMC provider category.
Find My CMMC Path →Can you outsource CMMC compliance? The honest answer
You can outsource the work, but not the accountability.Providers can carry control implementation, security operations, evidence management, documentation, and readiness — but your company still owns the truth of your scope, the accuracy of your System Security Plan (SSP), your SPRS posting and affirmation, and your participation in any assessment. “Done-for-you CMMC” is real and useful. It just has a hard ceiling.
Three things can never leave your building:
- The assessment. For a Level 2 (C3PAO) requirement, only an independent, Cyber AB–authorized or –accredited CMMC Third-Party Assessment Organization (C3PAO) can perform the certification assessment (32 CFR § 170.9). Level 3 is assessed by the government (DIBCAC). Your readiness vendor cannot also be your assessor — and any provider that claims otherwise has a structural conflict you need to resolve before the assessment, not during.
- The affirmation. Under 32 CFR § 170.22, the Affirming Official — the senior-level representative from withinyour organization with the authority to affirm continuing compliance — must personally attest in SPRS that your organization “has implemented and will maintain implementation of all applicable CMMC security requirements.” That affirmation is due upon achieving a status, annually after, and at POA&M closeout. No vendor can be your senior official. No provider can submit that attestation for you.
- The accountability. The rule places the assessment, the SSP, the affirmation, and the continuing-compliance obligation squarely on the Organization Seeking Assessment (OSA). Providers can support the work; your CMMC status and your annual affirmation remain your obligations (32 CFR § 170.22; DFARS 252.204-7021).
The damaging admission: if a provider tells you they’ll make CMMC “100% hands-off” or “guarantee” you a certificate, that is not a shortcut — it’s a red flag. No one can sell you a CMMC certificate.
Why this page is different
We didn’t summarize vendor marketing. We read the rule. The Affirming Official requirement is defined at 32 CFR § 170.22; the C3PAO’s independence obligations sit at 32 CFR § 170.9(b)(2) and the Cyber AB Code of Professional Conduct; the cost figures come straight from the CMMC Program Rule’s Regulatory Impact Analysis. Every source is listed at the bottom — so you can verify each claim, not take our word for it.
Before you take a single vendor call, map your own boundary. The Find My CMMC Path tool takes your level, CUI scope, assessment type, environment, and timeline and routes you to the provider category that fits the work you actually need — readiness, managed operations, enclave, GRC, or assessment.
What can you outsource — and what must you keep?
Technical implementation and monitoring are highly outsourceable; governance, scope decisions, the assessment, and the affirmation are not.The matrix below maps every major CMMC obligation to whether you can outsource it, what a provider can actually do, what stays yours, the evidence to demand before you sign, and the controlling authority. This is the asset most “turnkey CMMC” pitches don’t want you to have.
| Workstream | What a provider CAN do | What stays YOURS | Evidence to demand before you sign | Source anchor |
|---|---|---|---|---|
| Required level & assessment type | Help read the solicitation and flow-down; advise on the likely path | Confirm the binding requirement; make the call | Written assumption log; clause references; RP/counsel review note | DFARS 252.204-7021 / -7025; 32 CFR § 170.3 |
| FCI/CUI scoping | Facilitate data-flow mapping and asset categorization | Accuracy of what CUI you actually handle and where | Scope memo; CUI data-flow diagram; asset inventory | 32 CFR § 170.19 |
| Enclave / secure collaboration | Build and operate a narrower CUI environment | User behavior; CUI that leaks outside the enclave | Architecture diagram; service description; CRM | § 170.19; DFARS 252.204-7012 |
| MSP/MSSP operations | Run identity, endpoint, logging, patching, monitoring, backup | Oversight; escalation decisions; control ownership | Monthly evidence package; log-retention proof; IR escalation SLA | NIST SP 800-171A; DFARS 252.204-7012 |
| System Security Plan (SSP) | Draft, organize, update, map controls | The truth and approval of the system description | SSP with named boundary, version/date, control owners | 32 CFR § 170.24(a)(5); § 170.17 |
| POA&M | Track remediation owners, dates, evidence | Closure within the window; POA&M eligibility | POA&M eligibility screen; closure evidence; dates | 32 CFR § 170.21 |
| ESP/CSP documentation | Provide a service description and responsibility matrix | Including the provider’s duties in your SSP and evidence | Customer Responsibility Matrix; FedRAMP proof where applicable | 32 CFR § 170.19(c) |
| Training & policy enforcement | Provide content, templates, tracking | Whether employees actually follow policy daily | Training records; policy acknowledgments; role matrix | NIST SP 800-171 AT/AC/PS families |
| Physical & personnel controls | Template procedures; advise | Your facility, visitors, employees, discipline process | Visitor logs; facility procedures; role assignments | NIST SP 800-171 PE/PS families |
| Incident response | Monitor, alert, support triage | The reporting decision and customer communication | IR plan; escalation runbook; 72-hour reporting workflow | DFARS 252.204-7012 |
| SPRS score & affirmation | Calculate/support; prepare the packet | Your Affirming Official submits and attests | SPRS packet; evidence index; named affirmation owner | 32 CFR § 170.22; DFARS 252.204-7019/-7020/-7025 |
| C3PAO assessment | Conduct it — only if an authorized/accredited C3PAO that didn’t prep you | Engaging the assessor; making people/evidence available | Cyber AB Marketplace status; conflict-of-interest documentation | 32 CFR § 170.9; Cyber AB CAP |
| Artifact retention | Set up the evidence repository | Keeping records at least six years from your CMMC status date | Retention process; owner; access controls | 32 CFR § 170.9(b)(9) |
| Subcontractor flow-down | Provide templates and a risk process | Flow-down decisions and verifying your suppliers | Supplier list; flow-down language; supplier evidence requests | DFARS 252.204-7021; 32 CFR § 170.23 |
The pattern, once you see it: anything that is implement or monitor is largely outsourceable. Anything that is decide or sign stays with you. A good provider makes that split explicit in writing. A risky one leaves it vague — and “vague” is exactly what gets scored against you in an assessment. Jump to the 12-point provider due-diligence checklist to turn this table into the exact things to ask before you sign.
Which CMMC controls can a provider handle for you?
The 110 Level 2 requirements live in 14 NIST SP 800-171 Revision 2 control families, and an MSP/MSSP or enclave can do most of the technical lifting in the access, identity, audit, configuration, and system-protection families. You stay involved everywhere a decision gets made — who gets CUI access, which risks you accept, whether your SSP reflects reality. No family is 100% hands-off, because every family produces evidence you must be able to defend.
| Family (abbreviation) | # of requirements | Mostly handled by | Where you stay involved |
|---|---|---|---|
| Access Control (AC) | 22 | MSP/MSSP, enclave/CSP | Who needs CUI access; approving roles |
| Awareness & Training (AT) | 3 | Training provider / MSSP | Ensuring completion; keeping records |
| Audit & Accountability (AU) | 9 | MSSP/SOC, SIEM provider | Which events matter; retention calls |
| Configuration Management (CM) | 9 | MSP, enclave/CSP | Approving baselines and changes |
| Identification & Authentication (IA) | 11 | MSP/MSSP, enclave/CSP | MFA policy decisions |
| Incident Response (IR) | 3 | MSSP / SOC-as-a-service | The reporting decision stays yours |
| Maintenance (MA) | 6 | MSP | Authorizing maintenance and personnel |
| Media Protection (MP) | 9 | MSP, enclave/CSP | Physical media handling policy |
| Personnel Security (PS) | 2 | HR + consultant | Screening; offboarding |
| Physical Protection (PE) | 6 | Facilities + consultant | Your premises; visitor control |
| Risk Assessment (RA) | 3 | Consultant/GRC, scan provider | Accepting or treating risk |
| Security Assessment (CA) | 4 | RPO/consultant, GRC | Owning and approving the SSP/POA&M |
| System & Communications Protection (SC) | 16 | MSP/MSSP, enclave/CSP | Architecture and scoping decisions |
| System & Information Integrity (SI) | 7 | MSSP / SOC | Acting on alerts; remediation calls |
| Total | 110 | — | Governance, scope, and evidence in every family |
Those 110 requirements are assessed against 320 assessment objectives— the discrete “determination statements” in NIST SP 800-171A, where every objective must be met to satisfy a requirement. That granularity is why “we’ll handle the controls” is not the same as “we’ll pass your assessment.” Each objective needs evidence with your name on it.
One accuracy point that quietly trips up buyers: Rev. 2, not Rev. 3
If a provider’s readiness package is built around NIST SP 800-171 Revision 3, ask a hard question. CMMC Level 2 currently maps to NIST SP 800-171 Revision 2 — its 110 requirements across 14 families — which 32 CFR Part 170 incorporates by reference, and a DoD class deviation keeps Revision 2 the controlling baseline for DFARS 252.204-7012 even though NIST finalized Revision 3 in May 2024. Revision 3 reorganized the framework (to roughly 97 requirements) and added new control families, but it is notthe CMMC Level 2 assessment basis unless and until DoD amends the rule. A vendor preparing you to Revision 3 today could leave Revision 2 requirements showing as “not met” on assessment day.
Who actually certifies you — and why it can’t be your readiness provider
For Level 2 (C3PAO), only an independent, authorized or accredited C3PAO can perform the certification assessment — and it cannot be the same firm that did your readiness or remediation. Level 3 is assessed by the government (DIBCAC). And whatever model you choose, the Affirming Official inside yourcompany must sign the SPRS affirmation, which carries False Claims Act exposure. That signature is the one thing a “turnkey” vendor can never do for you.
The firewall: your consultant can’t grade their own homework
C3PAOs must comply with the Cyber AB’s Conflict of Interest policy, Code of Professional Conduct, and Ethics requirements (32 CFR § 170.9(b)(2)). In practice, that means the firm that prepares you cannot be the firm that certifies you. The whole point of an independent assessment is that someone who didn’t build the environment checks it.
A formal “non-certification” (mock) assessment is different from consulting — but if a provider gives you advice, remediation help, policy templates, or implementation guidance, that can create a conflict that prevents that firm from performing your Level 2 certification assessment. If a provider tells you they’ll “prepare you and certify you” in one bundle, treat that as a serious warning sign — and ask them, in writing, how they handle conflicts of interest. See our RPO vs. C3PAO guide.
The Affirming Official: a named human inside your company, on the hook
32 CFR § 170.22 defines the Affirming Official as the senior-level representative from within your organization, with the authority to affirm continuing compliance. That person submits an affirmation in SPRS upon achieving a CMMC status, annually thereafter, and at POA&M closeout. DFARS 252.204-7025 ties a current CMMC status and a current affirmation in SPRS to award eligibility for covered solicitations. A provider can prepare the packet. It cannot be your senior official, and it cannot make a false statement true. See also: SPRS score — what it is and how to post one.
Why this is now a legal issue, not just a compliance one
Under the False Claims Act (31 U.S.C. § 3729), “knowingly” includes actual knowledge, deliberate ignorance, or reckless disregard — no intent to defraud is required. When you certify compliance as a condition of award or payment and that certification is false, your company has exposure.
This is not theoretical. The Department of Justice announced at least seven cybersecurity-related False Claims Act settlements in 2025, totaling roughly $51 million. Two are directly instructive for anyone thinking about outsourcing:
- Swiss Automation Inc. — $421,234 (December 2025), reported as the first FCA settlement with a defense supply-chain subcontractor. DOJ alleged the precision-machining company failed to adequately protect the technical drawings it received from DoD prime contractors.
- Raytheon, RTX, and Nightwing Group — $8.4 million (2025), which resolved allegations of noncompliant cybersecurity across 29 DoD contracts and named the acquiring company, Nightwing, as a successor in liability even though it bought the business years after the conduct. Translation: cyber-compliance exposure can follow a company through an acquisition.
The point is simple: outsourcing the work to a capable, DIB-experienced provider is one of the best ways to make sure your affirmation is accurate— but the exposure doesn’t move to the vendor just because the vendor did the work. Your company still owns the certification and affirmation it submits.
A primary-source trust note
In January 2025, the DoD Office of Inspector General published Report No. DODIG-2025-056, which found the DoD did not effectively implement the process for authorizing C3PAOs. Reviewing 11 C3PAOs, the OIG found two were authorized without a signed C3PAO Agreement and Code of Professional Conduct, and four without verified certification of their quality-control leads. The practical lesson: verify your assessor’s authorization and team credentials directly on the Cyber AB Marketplace, and record the date you checked. Don’t take a badge on a website at face value.
Get matched with readiness & managed-compliance options — kept separate from your assessor.
Find My CMMC Path →How much does it cost to outsource CMMC compliance?
There’s no single price — it depends on whether you buy ongoing managed service, a fixed-scope readiness project, or a do-it-yourself-plus-tools mix, and on your size, scope, and starting maturity. As a June 2026 reference: managed/MSSP service runs roughly $2,000–$7,000 per month for small businesses, a fully outsourced Level 2 readiness project runs roughly $50,000–$150,000 for a mid-sized firm, and the separate independent C3PAO assessment runs roughly $30,000–$150,000+. The assessment is always its own line item — it cannot be bundled into the firm that prepped you.
Outsourcing shifts the labor. It does not erase the cost. The ranges below are planning figures reported across 2026 industry cost analyses — not quotes, and not official DoD figures.
| Model | What it is | Typical reported ranges (2026) | What it does NOT include |
|---|---|---|---|
| Managed CMMC / CMMC-as-a-Service | Ongoing managed security + compliance ops, often on a secured platform or enclave | MSSP ~$2,000–$7,000/mo for small businesses (~$24k–$84k/yr); CUI enclave ~$300–$400/user/mo or ~$3,000–$4,000/mo flat | The independent C3PAO assessment; your affirmation; your governance and scope decisions |
| RPO fixed-scope readiness project | A defined “gap-to-assessment-ready” engagement | Mid-sized fully outsourced Level 2 readiness ~$50,000–$150,000; ~$250–$400/hr if hourly | Ongoing operations; the assessment; the affirmation |
| DIY + tools + selective help | You drive it, buying tools and targeted help | Level 1 self-assessment ~$5k–$20k; SIEM ~$1k–$5k+/mo; MFA tokens ~$15–$50/user | Most of the heavy lift — you absorb the internal labor and the risk |
| The C3PAO assessment (always separate) | The independent Level 2 certification | ~$30,000–$150,000+ depending on size and scope | — |
Reality check on first-year budgets: small contractors commonly report first-year Level 2 totals in the $50,000–$150,000+ range, with mid-sized firms higher. Scope is the single biggest lever — a 10-person company with a tightly bounded CUI enclave has a fundamentally different bill than a 200-person company with CUI everywhere.
The official DoD numbers — and the fine print that matters
DoD’s own published estimate for a Level 2 (C3PAO) assessment cycle is roughly $104,670 for a small entity and about $117,690 for a larger entity over three years — with the C3PAO assessment engagement itself modeled at about $31,234 (small) and $52,056 (other-than-small) (CMMC Program Rule Regulatory Impact Analysis, 89 FR 83092, Oct. 15, 2024). Read the fine print: DoD’s estimate explicitly excludes implementation costs, because it assumes you were already required to meet NIST SP 800-171 under DFARS 252.204-7012 since 2017. It is not a turnkey budget.
Don’t compare quotes until you unbundle them
Force every quote into these line items before you compare:
| Cost item | Often bundled? | Should be a separate line? |
|---|---|---|
| Scoping workshop | Yes | Yes |
| Gap assessment | Yes | Yes |
| SSP / POA&M support | Yes | Yes |
| Remediation engineering | Sometimes | Yes |
| MSP/MSSP operations | Sometimes | Yes |
| CUI enclave build | Sometimes | Yes |
| Cloud licensing (e.g., GCC High) | No | Yes |
| GRC platform | Sometimes | Yes |
| C3PAO assessment fee | Should be separate | Always |
| Legal / contract review | No | Always |
| Annual compliance support | Sometimes | Yes |
The all-inclusive test: if a quote says “all-inclusive CMMC” but doesn’t separately identify readiness, remediation, managed operations, cloud licensing, GRC software, the C3PAO assessment, legal review, and annual support, it isn’t all-inclusive. It’s just unitemized. For the full breakdown, see our CMMC consulting cost guide and CMMC Level 2 cost guide.
Does outsourcing put your MSP in your assessment scope?
Often, yes — and this is the trap almost no “turnkey” pitch mentions. If your provider processes, stores, or transmits your CUI or Security Protection Data, 32 CFR § 170.19 requires you to determine whether it’s a Cloud Service Provider (CSP) or a non-CSP External Service Provider (ESP). Non-CSP ESP services that process CUI are in your assessment scope; a CSP that handles CUI must meet FedRAMP requirements. If a control is assigned to your provider but the provider can’t produce evidence for it, that control is scored not met — against you.
Outsourcing to an MSP feels like it reduces your risk. Done wrong, it can add assessment risk.
How an MSP lands in your scope
| If your MSP… | …the CUI/SPD implication | …the assessment-scope consequence | Document to request |
|---|---|---|---|
| Stores or processes your CUI on its systems | It’s a non-CSP ESP handling CUI | Its services are assessed within your scope | Service description + Customer Responsibility Matrix |
| Provides a cloud offering that handles your CUI | It’s a CSP handling CUI | Must meet FedRAMP Moderate (authorized or equivalent) | FedRAMP authorization or DoD equivalency evidence |
| Handles only your log/config (Security Protection) data | It’s handling SPD | Assessed as a Security Protection Asset | SRM/CRM describing the shared responsibilities |
| Has admin access but no CUI on its systems | Still in scope as a security-relevant provider | Documented in your SSP; responsibilities mapped | CRM + access/role documentation |
The document that decides who’s responsible: the CRM
32 CFR § 170.19requires that the use of an ESP, its relationship to your organization, and the services it provides be documented in your SSP and described in the ESP’s service description and Customer Responsibility Matrix (CRM). This isn’t optional paperwork. It’s what an assessor uses to decide whether each control has a responsible party and real evidence.
Why your MSP can be the reason you fail
If the CRM assigns a control to your provider and the provider can’t show evidence it’s implemented, the assessor scores it against you. In March 2025, defense contractor MORSECORP agreed to a $4.6 million False Claims Act settlement after DOJ alleged, among other things, that it failed to ensure its third-party email host met required security standards. (The settlement resolves allegations and is not an admission.) A DIB-experienced provider that hands you a clean CRM and producible evidence is worth far more than the cheapest monthly rate.
If a Cloud Service Provider stores, processes, or transmits your CUI, 32 CFR Part 170 requires its offering to be FedRAMP Authorized at Moderate (or higher) or to meet FedRAMP Moderate–equivalent requirements per DoD policy. “We’ll just use our normal commercial cloud” is not a CMMC answer when CUI is involved. See: CUI enclave vs. enterprise compliance.
Which provider should you outsource to: RPO, MSP/MSSP, enclave, GRC, or C3PAO?
Match the category to your situation before you shortlist a single vendor. If you have little or no in-house IT, start with a CMMC-focused MSP/MSSP. If you mainly need assessment readiness, an RPO fixed-scope project fits. If evidence and workflow are the gap, a GRC platform helps. If your scope is sprawling, a CUI enclave can shrink it. The independent C3PAO is always a separate, later step.
Provider categories in plain language:
- RPO / RP (Registered Provider Organization / Registered Practitioner): non-certified advisory and readiness help — gap analysis, SSP/POA&M, scoping. The Cyber AB describes RPOs as providers of non-certified advisory services who do not conduct certified assessments.
- MSP / MSSP: runs your security operations — identity, endpoint, logging, monitoring, patching, backup.
- CUI enclave: a dedicated, secured environment for the systems and people that actually handle CUI, used to shrink your assessment boundary.
- GRC platform: software to track controls, evidence, POA&M, and reporting. It organizes the work; it does not implement controls by itself.
- C3PAO: the independent firm authorized or accredited to perform your Level 2 certification assessment. Not a consultant. Not your readiness vendor.
This is The CMMC Path Framework — our logic for matching your situation to the provider category you actually need:
Match your situation to the right starting category
| If your real problem is… | Start with | Don’t start with | Why |
|---|---|---|---|
| “We don’t know our CUI scope” | RPO/RP or vCISO | A C3PAO | You’re not assessment-ready yet |
| “We have no internal IT/security capacity” | CMMC-focused MSP/MSSP | A GRC tool alone | Tools don’t operate controls |
| “CUI is scattered everywhere” | CUI enclave + readiness advisor | A policy-only consultant | Scope drives cost and assessment burden |
| “We need our evidence organized” | GRC platform + RPO | A C3PAO | Evidence must exist before assessment |
| “We’re ready for a formal Level 2 assessment” | A C3PAO | Another readiness retainer | Stop buying readiness once evidence is done |
| “Our flow-down language is unclear” | Federal-contracts attorney + RP/RPO | An MSP | This is a contract problem first |
| “We might be Level 3” | Advanced readiness, then the Level 2 C3PAO path | Any vendor claiming commercial “Level 3 assessment” | Level 3 is DIBCAC-assessed by the government |
The clean sequence for most Level 2 contractors
- Confirm the contract clause and assessment type.
- Scope your FCI/CUI honestly.
- Decide whether an enclave will shrink your scope.
- Engage RPO/readiness support.
- Add an MSP/MSSP for technical operations.
- Add a GRC platform if the evidence burden is heavy.
- Schedule a C3PAO only when you’re truly ready.
- Affirm in SPRS and maintain continuous evidence and annual affirmations.
Match by company profile
| Your situation | Likely path | First provider category | Avoid |
|---|---|---|---|
| FCI only, no CUI | Level 1 self-assessment | Internal owner + light RP/RPO support | A C3PAO assessment you don’t need |
| Small Level 2, narrow CUI | Scoped readiness + possible enclave | RPO + enclave/MSP | A whole-enterprise tool rollout |
| Small Level 2, no IT team | Managed operations + readiness | MSP/MSSP + RPO | A policy-only consultant |
| Mid-sized DIB, existing IT | Program readiness + evidence workflows | RPO/vCISO + GRC + MSSP | Random tool purchases |
| Manufacturer with shop-floor / OT systems | Scope first, then segmented implementation | RPO + OT-aware security architect + MSSP | Treating OT like office IT |
| Prime with subcontractor flow-down | Enterprise program + supplier process | vCISO/RPO + GRC + legal | Ignoring subcontractor evidence |
| Assessment-ready Level 2 | Formal assessment | A C3PAO | More readiness retainers |
| Level 3 candidate | Final Level 2 first, then the DIBCAC path | Advanced readiness support | Any commercial “Level 3 assessor” claim |
A disqualifier: if you’re FCI-only at Level 1, you probably don’t need a six-figure managed program. And if you already have a capable internal IT lead, a fixed-scope RPO project may beat an open-ended monthly subscription. If you’re already assessment-ready, see our independent framework for choosing a C3PAO instead of buying more readiness.
CMMC Phase 1 runs from through , with the first 12 months focused primarily on Level 1 and Level 2 self-assessment requirements; Phase 2 begins and adds the Level 2 (C3PAO) requirement (32 CFR § 170.3(e)). The urgency is real — but that urgency is not a reason to sign the first “turnkey” package that calls you back. Move quickly on readiness; move carefully on vendors. See: CMMC Phase 1 and Phase 2 explained.
Why “category first” is the trustworthy answer
Most pages on this topic are published by a single provider, so “which provider” always somehow ends at them. We have no service to sell, so we can do the thing a vendor structurally can’t — point you to the category that fits the work you actually need, even when that category isn’t the one paying for ads.
Tell us your level, scope & timeline — get matched with source-checked provider options.
Find My CMMC Path →When is a CUI enclave the closest thing to “done-for-you” CMMC?
A CUI enclave can be the closest practical version of “done-for-you CMMC” when your CUI workflows are narrow enough to isolate. It concentrates your controls and shrinks your assessment boundary — but it does not automatically solve users, policies, external systems, supplier flows, incident response, or your SPRS affirmation. An enclave reduces scope. It does not erase responsibility.
Good fit for a CUI enclave
- A small contractor with a limited number of CUI users
- Engineering files moving through a defined collaboration workflow
- CUI currently scattered across commercial email and file shares
- Leadership that wants a bounded environment before C3PAO readiness
Poor fit for a CUI enclave
- CUI is pervasive across production or shop-floor/OT systems
- Many subcontractor data exchanges in and out
- Users who will keep copying CUI outside the enclave anyway
- A provider that can’t produce a clear CRM and service description
What to verify before you sign an enclave deal:
- CUI workflow assumptions, in writing.
- User count and access model; identity/MFA architecture.
- A boundary diagram and data-export controls.
- A service description and a Customer Responsibility Matrix.
- FedRAMP Moderate authorization or DoD equivalency where a CSP handles CUI (32 CFR § 170.19).
- An incident-escalation workflow, evidence exports, and an exit plan.
The common environments you’ll hear named — Microsoft 365 GCC High, Azure Government, AWS GovCloud — are platforms, not finished compliance. They can support your scope and controls, but the policies, training, evidence, incident response, and affirmation are still on you. See our enclave vs. enterprise compliance comparison and CUI enclave cost guide.
What should a CMMC-as-a-service provider prove before you sign?
A credible CMMC-as-a-service provider should prove role clarity, evidence output, CUI boundary assumptions, responsibility sharing, Cyber AB status where relevant, conflict-of-interest handling, and secure data intake. If a provider can’t show a service description, a Customer Responsibility Matrix, evidence samples, and a clear statement of what youstill own, don’t treat it as turnkey — treat it as ambiguity you’re paying for.
Ask for these twelve things in writing. A serious provider will have them ready; a risky one will get defensive. Items marked regulation-stated are expected by the rule; buyer-verified is what good proof looks like.
- A written provider category and role statement (RPO? MSP/MSSP? enclave? GRC? assessor?). Buyer-verified.
- Cyber AB Marketplace status if they claim an RPO, C3PAO, or credentialed role — verified by you, with the date recorded. Regulation-stated for C3PAOs (§ 170.9).
- A service description. Regulation-stated for ESPs (§ 170.19).
- A Customer Responsibility Matrix mapping the 110 requirements to provider / you / shared. Regulation-stated (§ 170.19).
- An explicit NIST SP 800-171 Revision 2 mapping (not Rev. 3). Buyer-verified.
- The exact SSP support scope. Buyer-verified; SSP must be current at assessment (§ 170.24(a)(5)).
- The exact POA&M support scope. Buyer-verified; POA&M limits at § 170.21.
- A sample evidence package (sanitized). Buyer-verified.
- An incident-response escalation workflow with timing. Buyer-verified; 72-hour reporting under DFARS 252.204-7012.
- A data-handling / no-CUI-intake policy. Buyer-verified.
- An independence / conflict-of-interest statement — especially if they mention assessment. Regulation-stated for C3PAOs (§ 170.9(b)(2)).
- A written list of exclusions and separately billed items. Buyer-verified.
Verify status directly. For C3PAOs, the Cyber AB Marketplaceis the registry where you confirm an assessor’s authorization or accreditation status. Don’t stop at a badge or a logo on a vendor’s site — confirm the specific role they claim and write down the date you checked. As DODIG-2025-056 showed, even the authorization process itself has had gaps; your own verification is the backstop.
Red flags that mean a provider is overselling “done-for-you CMMC”
Walk away from any provider that:
- Claims “Guaranteed” CMMC certification.
- Promises “100% outsourced — nothing required from your team.”
- Offers to “prepare you and certify you” with no conflict-of-interest discussion.
- Has no Customer Responsibility Matrix, no service description, no NIST Rev. 2 mapping.
- Provides no SSP deliverable and no sample evidence.
- Can’t explain who owns the SPRS affirmation.
- Has no Cyber AB Marketplace status for a claimed RPO or C3PAO role.
- Can’t explain FedRAMP / equivalency where cloud CUI handling is involved.
- Treats NIST SP 800-171 Revision 3 as the current Level 2 assessment basis.
- Asks you to upload CUI, drawings, or contract details through a generic web form.
Request scoped quotes from matched provider categories.
Find My CMMC Path →What we actually verified for this report
We’d want to see the receipts, so here they are. Last verified: .
What we read and cross-checked:
- 32 CFR Part 170 (the CMMC Program Rule), current eCFR text and the Federal Register final rule (89 FR 83092, effective December 16, 2024) — including the C3PAO definition and roles (§ 170.4, § 170.9), the Affirming Official and affirmation rules (§ 170.22), ESP/CSP scoping (§ 170.19), SSP requirement (§ 170.24(a)(5)), POA&M handling (§ 170.21), and six-year record retention (§ 170.9(b)(9)).
- DFARS 252.204-7021, 252.204-7025, 252.204-7019/-7020, and 252.204-7012 on Acquisition.gov.
- The phased timeline (Phase 1: Nov 10, 2025–Nov 9, 2026; Phase 2 begins Nov 10, 2026), per DoD CMMC program materials and 32 CFR § 170.3(e).
- CMMC Level 2’s mapping to NIST SP 800-171 Revision 2 (110 requirements across 14 families) and the 320 assessment objectives in NIST SP 800-171A; Revision 2 remains the controlling baseline for CMMC.
- The Cyber AB Code of Professional Conduct and C3PAO conflict-of-interest obligations at 32 CFR § 170.9(b)(2).
- DoD OIG Report No. DODIG-2025-056 (Jan. 10, 2025) on weaknesses in the C3PAO authorization process.
- DOJ cybersecurity False Claims Act settlements announced in 2025 (Swiss Automation; Raytheon/RTX/Nightwing; MORSECORP), and the False Claims Act at 31 U.S.C. § 3729.
- DoD’s published cost estimates in the CMMC Program Rule Regulatory Impact Analysis.
What we did not do, on purpose:
- We did not rank named providers. This page routes to categories.
- Cost model ranges are planning figures, not quotes. The DoD figures are from the Federal Register RIA and exclude implementation costs.
Frequently asked questions
Can you outsource CMMC compliance completely?
No. You can outsource most of the implementation, security operations, evidence management, and readiness support, but the contractor still owns scope accuracy, the truth of the SSP, the SPRS posting and affirmation, and participation in any assessment. Under 32 CFR Part 170, those obligations rest with your organization.
Is “CMMC as a service” a real thing?
It’s a market phrase, not an official CMMC status. It usually describes a bundle of managed services, an enclave, readiness support, and compliance operations. It can be genuinely valuable, but it does not replace the independent assessment or your obligations as the contractor.
Can my MSP make me CMMC compliant?
An MSP can operate important controls and produce evidence, but it cannot certify you, decide your binding contract requirement, or submit your senior affirmation. And if your MSP handles your CUI, its services fall within your assessment scope under 32 CFR § 170.19 — so a provider that isn’t DIB-experienced can actually add risk.
Do I need an RPO or a C3PAO first?
If you’re not assessment-ready, you need readiness support first. A Registered Provider Organization (RPO) provides non-certified advisory and readiness help; a C3PAO performs the independent Level 2 certification assessment. They are different roles. See our RPO vs. C3PAO comparison.
Can the same firm prepare us and assess us?
Treat same-firm “prepare and certify” as a major conflict-of-interest issue. C3PAOs must comply with the Cyber AB’s conflict-of-interest and Code of Professional Conduct requirements (32 CFR § 170.9(b)(2)); giving you advisory, remediation, or implementation help can conflict a firm out of performing your certification. Keep readiness and the formal assessment with separate firms.
Does GCC High make us CMMC compliant?
No. Microsoft 365 GCC High (or Azure Government, or AWS GovCloud) can support your scope and control implementation, but it does not by itself satisfy your policies, training, evidence, incident response, SSP, or affirmation obligations. A compliant environment is a tool, not a finished program.
Is a CUI enclave enough for Level 2?
Sometimes it’s enough to shrink and concentrate your scope, but it’s not the whole program. You still need correct CUI scoping, an accurate SSP, real evidence, user controls, policies, incident response, and the required assessment path.
Who submits the SPRS affirmation?
Your Affirming Official — the senior-level representative from within your organization with the authority to commit it — submits and attests to the affirmation in SPRS under 32 CFR § 170.22. A provider can prepare supporting materials, but it cannot be the affirming authority.
What is a Customer Responsibility Matrix?
A Customer Responsibility Matrix (CRM) maps which security responsibilities belong to the provider and which belong to you. It’s required when an External Service Provider or Cloud Service Provider supports systems that process, store, or transmit your CUI (32 CFR § 170.19), and assessors rely on it.
Does CMMC Level 2 use NIST SP 800-171 Rev. 2 or Rev. 3?
Revision 2 today. CMMC Level 2 currently maps to NIST SP 800-171 Revision 2 (110 requirements, 14 families), which 32 CFR Part 170 incorporates by reference; a DoD class deviation keeps Revision 2 controlling for DFARS 252.204-7012 even though NIST finalized Revision 3 in 2024. Don’t let a vendor sell a Revision 3–only package as if it’s the current assessment basis unless DoD amends the rule.
Can we use POA&Ms instead of finishing everything?
Sometimes, but not as a blanket substitute. Level 1 does not permit POA&Ms; Level 2 POA&Ms are limited by the scoring rules and carry a defined closeout window under 32 CFR § 170.21. A POA&M buys you a Conditional status, not a free pass. See: CMMC SSP and POA&M services.
Need help deciding what type of CMMC provider you need?
Find My CMMC Path →Primary sources
Find My CMMC Path
The right CMMC provider isn't the same for every contractor. The category you need — a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave — depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. (The contract clause sets your level, not a checklist.) Because a general answer can't resolve those for you, use The Defense Compliance Report's Find My CMMC Path tool to map your situation to the right provider category before you request quotes.
- What it asks: your required CMMC level, FCI vs CUI handling, assessment type, IT/cloud environment, and contract timeline
- What you get: the provider category that fits your situation and the readiness steps to get there, with the questions to ask before requesting quotes
- Educational triage only: free · 2-minute assessment · no obligation · do not submit CUI, drawings, or sensitive contract details