CMMC Training for MSPs: What Your Technicians Actually Need to Know

An MSP technician doesn’t need a CMMC certificate to cause a CMMC finding. Remoting in without the second factor, leaving a vendor to work unsupervised, or switching off antivirus to finish an install can each do it, if nobody can show the work was handled the way the client’s SSP says it is.

That’s the real training gap for MSPs. This post covers what the rule requires of your people (less than many expect), the everyday tickets that carry CMMC weight, and when a formal credential is worth the time.

No credential is required. Your work is still assessed.

The CMMC rule doesn’t require any MSP technician to hold a CMMC credential. What it does is pull your services into your client’s assessment. If you’re not a cloud provider and you don’t handle CUI, you “do not require CMMC assessment or certification,” but “services provided by an ESP are in the OSA’s assessment scope” (89 FR 83127). If your tools hold Security Protection Data, such as logs, configurations or admin credentials, your services “shall be assessed as Security Protection Assets” (32 CFR § 170.19(c)(2)(i), Table 4).

Your relationship with the client and the services you provide “need to be documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix” (§ 170.19(c)(2)(ii)). We walk through that matrix in the MSP shared responsibility matrix.

And your people may be in the room. When an assessment involves an ESP, the CMMC Assessment Process expects the provider’s people to be “present and actively participating” (CAP v2.0, 1.6). Your technicians can end up answering an assessor’s questions about work they did months ago.

The tickets that carry CMMC weight

Most of a technician’s CMMC exposure isn’t in a project. It’s in routine tickets. Here’s an ordinary week for a technician supporting a Level 2 client, with the NIST SP 800-171 requirement each ticket touches:

A few of these deserve a closer look, because the requirement is stricter than the habit.

Remote sessions. NIST SP 800-171 requires multifactor authentication “to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete” (3.7.5). Leaving a session open after the fix is the part that gets missed.

Vendors. The discussion for 3.7.6 names who it means: “information technology manufacturers, vendors, consultants, and systems integrators” who may need privileged access, sometimes with little notice. A technician who lets a vendor work alone on a CUI system has skipped a requirement, whatever the ticket says.

Disabling protection. Under 3.1.7, “circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions.” Doing it may be fine. Doing it from an account that shouldn’t be able to, or without a log entry, isn’t.

Onboarding. Personnel have to be screened “prior to authorizing access to organizational systems containing CUI” (3.9.1). If the account goes live before the client has screened the new hire, the order is wrong.

Your technicians are “personnel” too

The two training requirements in NIST SP 800-171 don’t distinguish employees from service providers. Awareness training covers “managers, systems administrators, and users of organizational systems” (3.2.1). Role-based training requires that “personnel are trained to carry out their assigned information security-related duties and responsibilities” (3.2.2), with content based on “the assigned duties, roles, and responsibilities of individuals” and “the systems to which personnel have authorized access.”

When your technicians administer a client’s systems, they’re the systems administrators. Who provides that training, and who keeps the records, belongs in the responsibility matrix, not in an assumption.

What each technician should know

For most MSPs, the training that matters isn’t a credential course. It’s a short, specific briefing for everyone who touches a Level 2 client:

• Which clients are Level 2, and where their CUI lives. A technician can’t protect a boundary nobody showed them. Scope is where every assessment starts, as we explain in enclave vs. enterprise.
• What the client’s SSP says you do. If the SSP says the MSP reviews logs weekly, someone has to, and be able to show it.
• Which tickets need a second step. The four above are a good start: remote sessions, vendors, privileged changes, and access.
• How to leave evidence. A closed ticket with the who, what, when and approval is the difference between “we do that” and something an assessor can verify.
• What to say, and not say, to an assessor. Answer what you did, show the record, and don’t guess about another team’s work.

When a credential is worth it

Some of your people will want more than a briefing, especially if your MSP is advising clients on CMMC, not just running their IT. Three options fit different goals:

Registered Practitioner (RP or RPA). The Cyber AB’s designation for implementers. RPs “are trained and tested against the Levels based on the CMMC Framework” and provide “consultative preparation services” to the companies seeking certification. The Cyber AB describes Registered Practitioner Organizations as “consultative organizations or MSPs.” It suits a technician who’ll help clients prepare.

CMMC Certified Professional (CCP). The first rung of ISACA’s assessor pathway. It goes deeper into the assessment methodology, needs a Tier 3 background investigation, and is the prerequisite for the assessor credential. It suits a technician who wants to understand exactly how an assessor will test the environments they run.

CMMC Certified Assessor (CCA). Only for people who’ll actually assess. Remember the independence rule: anyone who prepared a client can’t join its certification assessment for three years (§ 170.8(b)(17)(ii)(G)). A CCA on your bench can’t assess the clients your MSP helped get ready.

Every credential holder is bound by the CMMC Code of Professional Conduct, including its bar on guaranteeing assessment results. That’s worth knowing before a sales conversation, too.

Train the habits, then the credentials

For most MSPs, the order is simple. Brief every technician who touches a Level 2 client on scope, the tickets that matter, and evidence. Put training responsibilities in the matrix. Then send the people who advise clients through formal training, so the expertise sits inside your team.

If your clients are asking for CMMC help you’d rather not build yet, a referral partnership can cover the readiness work while your team grows into it. See how our partnerships work, or read what an RPO referral partnership looks like.

Sources: 32 CFR Part 170, § 170.8(b)(17)(ii)(G) and § 170.19(c)(2)(i)–(ii) and Table 4; 89 FR 83092 (October 15, 2024), preamble at 83127; NIST SP 800-171 Revision 2, requirements 3.1.7, 3.2.1, 3.2.2, 3.7.5, 3.7.6 and 3.9.1 with their discussions; Cyber AB, CMMC Assessment Process v2.0 (December 2024), 1.6; Cyber AB, Ecosystem Roles page (checked November 2026); ISACA, CMMC credentialing page; Cyber AB, CMMC Code of Professional Conduct v2.0 (December 2024).