Is My MSP CMMC Compliant? A Real Checklist
Under CMMC, your managed service provider doesn't pass or fail on its own. Its services are part of your assessment. What the rule says about External Service Providers, when an MSP needs its own certification, and a checklist for the conversation.
"Is our MSP CMMC compliant?" is one of the first questions defense contractors ask when they start preparing. It's a reasonable question with a misleading premise. Under the CMMC rule, your managed service provider usually isn't assessed on its own at all. The services it provides you are assessed as part of your assessment, against your requirements, with your name on the result. So the better question is whether what your MSP does for you would hold up when an assessor looks at it.
- Your MSP is an External Service Provider if it handles your CUI or your security data, such as logs, configurations, and admin credentials.
- Its services are in your assessment scope. An MSP that isn’t a cloud provider doesn’t need its own CMMC certification; it may get one voluntarily.
- Cloud services that hold CUI must be FedRAMP Moderate authorized or equivalent, and checking that is your job.
- Get it in writing: your SSP documents the relationship, and the MSP’s customer responsibility matrix says who does what.
When does your MSP count?
The CMMC rule calls an MSP an External Service Provider (ESP): "external people, technology, or facilities that an organization utilizes for provision and management of IT and/or cybersecurity services on behalf of the organization." The definition comes with a condition: "CUI or Security Protection Data (e.g., log data, configuration data), must be processed, stored, or transmitted on the ESP assets to be considered an ESP" (32 CFR § 170.4).
Security Protection Data covers more than most people expect. The rule lists configuration data for security tools, log files, vulnerability data about in-scope systems, and "passwords that grant access to the in-scope environment." An MSP running your firewall, your endpoint protection, your patching or your admin accounts almost always handles it.
What happens next depends on what the MSP touches. The rule sets it out in a table (Table 4 to § 170.19(c)(2)(i)):
- 01 · Handles your CUIAssessed with youIts services are in your scope and assessed as part of your assessment. If it’s a cloud provider, it must meet DFARS 7012’s FedRAMP requirements.
- 02 · Security data onlyA Security Protection AssetIts services are in your scope and assessed as Security Protection Assets, against the requirements relevant to what they do.
- 03 · NeitherNot an ESPA provider that handles neither your CUI nor your security data doesn’t meet the CMMC definition.
Not every vendor qualifies. The DoD’s Level 2 Scoping Guide notes that services like HR and accounting software typically don’t count, and that an ESP used purely as staff augmentation, where you provide all the processes, technology and facilities, doesn’t need a CMMC assessment.
Does your MSP need its own CMMC certification?
Usually not. The proposed rule would have required it; the final rule dropped that. In the Department’s words, "ESPs that are not CSPs will be required to meet the CMMC requirements and be assessed as part of the scope of an acquiring OSA," and they "may voluntarily request a C3PAO assessment" (89 FR 83092, at 83106).
That cuts both ways. Your MSP doesn’t need a certificate to support you, so a provider without one isn’t automatically a problem. But a provider with one hasn’t answered the question for you either, because its services still sit inside your assessment. The preamble calls a non-cloud ESP an extension of your environment, and the rule assesses its services “against all Level 2 security requirements” within your scope (§ 170.17(c)(6)(ii)).
One open point: the CMMC contract clause flows down to subcontracts and other instruments that require processing FCI or CUI. Whether a particular MSP agreement is one of those instruments isn’t settled, so don’t assume your MSP will never be asked for a CMMC status. Read the clause your prime or contracting officer gives you.
What the rule asks you to document
“The use of an ESP, its relationship to the OSA, and the services provided need to be documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix (CRM)… Note that the ESP may voluntarily undergo a CMMC certification assessment.”
- 1Name the servicesWhich systems the MSP manages, and what it can reach.
- 2In your SSPThe relationship lives in your plan, not only in a contract.
- 3The CRMWho does which requirement: you, the MSP, or both.
- 4VoluntaryA certificate is optional for a non-cloud ESP.
The customer responsibility matrix is the document that matters most in practice. For each requirement, it says whether the MSP performs it, you perform it, or you share it. The rule also says the requirements from the CRM "must be documented or referred to in the OSA’s SSP." A shared requirement with no clear owner is where assessments go wrong.
Cloud services: FedRAMP, and whose job it is
If your MSP stores or processes your CUI in a cloud service, including its own platform, that cloud service must meet "security requirements equivalent to those established by the Government for the... (FedRAMP) Moderate baseline" under DFARS 252.204-7012(b)(2)(ii)(D). The clause puts that duty on you: you "shall require and ensure" it.
The rule’s preamble is direct about what that means. If you use a FedRAMP Authorized provider, you’re "not responsible for the CSP’s compliance." If the provider isn’t authorized, "the OSA is responsible for determining if the CSP meets the requirements for FedRAMP Moderate equivalency." And at assessment, "the C3PAO can only give credit to a FedRAMP Moderate Authorized or equivalent CSP."
Cloud tools that hold only security data, such as a remote monitoring platform or a hosted log service, are a gray area. The rule’s table assesses them as Security Protection Assets and attaches FedRAMP only to cloud services holding CUI, yet the preamble elsewhere says FedRAMP requirements for security data are “the same as that for handling CUI.” If your MSP’s tools work this way, settle the question with your assessor before the assessment, not during it.
At Level 1
If you only handle FCI, the rule asks you to consider External Service Providers when you scope your self-assessment (§ 170.19(b)(3)). It sets no CRM or FedRAMP requirement at Level 1. Your MSP still runs much of what the 15 requirements cover, so the checklist below is worth doing anyway.
The checklist: questions to ask your MSP
7 QUESTIONS FOR YOUR MSPLISTEN FORRED FLAG- 01What of ours do you touch?It decides which row of the rule’s table you’re in.Listen forA specific answer: our CUI, our security data (logs, configurations, admin credentials), or neither.Red flag“We’re CMMC compliant,” with no specifics.
- 02Can we see your customer responsibility matrix?The rule expects your SSP and the MSP’s matrix to say who does what.Listen forRequirement by requirement: theirs, ours, or shared, with an owner for every shared one.Red flagNo matrix, or everything marked “shared” with no owner.
- 03Which cloud services hold our data?A C3PAO can only give credit to a FedRAMP Moderate authorized or equivalent cloud service.Listen forEach service named, with its FedRAMP authorization or the evidence behind an equivalency claim.Red flag“It’s FedRAMP equivalent,” with nothing to show for it.
- 04Who on your team can reach our environment?Their accounts and access are part of your assessment.Listen forNamed people, individual accounts, and multifactor sign-in.Red flagShared admin accounts nobody can trace to a person.
- 05Will your people talk to an assessor?You’re expected to have knowledgeable people available during the assessment.Listen forA named contact who runs your services and will join the assessment.Red flag“Our team doesn’t do assessments.”
- 06Is a SOC 2 report your proof?A SOC 2 describes the provider’s own controls, not how your Level 2 requirements are met.Listen forA SOC 2 alongside a responsibility matrix mapped to the Level 2 requirements.Red flagThe SOC 2 offered as the whole answer.
- 07What happens when something changes?A new tool, subcontractor or data center can change your scope.Listen forWritten notice before anything new touches your data.Red flagYou find out after the fact.
- 08Then write it into your SSP.An MSP relationship that exists only in a contract and someone’s memory won’t survive an assessor’s questions. Put the services, the matrix and the cloud evidence where an assessor will look.
If you’re the MSP
Every one of those questions is coming from your defense customers, if it hasn’t already. A clear service description, a customer responsibility matrix mapped to the Level 2 requirements, and people who can walk an assessor through your services are what set you apart. If you want to build a CMMC practice around your defense clients, our partner program is built for MSPs and RPOs doing exactly that. And if you’re the contractor, our readiness team can walk your MSP relationship through the requirements before an assessor does.
Sources: 32 CFR Part 170, § 170.4, § 170.17(c)(6), § 170.19(b)(3) and (c)(2), Table 4; CMMC Program final rule, 89 FR 83092 (October 15, 2024), preamble at 83106, 83137 and 83139; DFARS 252.204-7012(b)(2)(ii)(D); DoD CMMC Scoping Guide, Level 2, version 2.13 (September 2024).