CMMC-compliant MSPs: what the provider must meet itself

Which services put your MSP in scope

The rule does not scope an MSP as one thing. It scopes each service by what that service holds and whether it runs in a cloud. A backup of the drawings share holds CUI; the patching agent holds configuration data; the desk phones hold neither. Sort your own contract line by line before you compare providers, because the answer decides which of the questions below you need to ask.

Read the two lines together and the point is plain: the MSP's work gets assessed whether or not it holds a certificate of its own, and it gets assessed as part of yours. The same table decides how far into scope the rest of your shop sits; the CMMC enclave comparison shows how to keep that part small.

The providers against the rule

Rows inside the boundary are what the rule asks of a provider that holds your CUI or its security data. Rows outside it are what you will notice day to day. Every word was read on the provider's own pages, the FedRAMP Marketplace or the Cyber AB Marketplace on 2026-10-22.

Five things to get in writing

Each row of the table is a question for the sales call, and each answer belongs in the contract, not in a slide. The questions the sorter above writes for you draw on these five.

Its own status, and what it covers

The rule does not require an MSP to be certified. 32 CFR 170.19(c)(2)(ii) says an ESP “may voluntarily undergo a CMMC certification assessment” to reduce the effort during yours. Four of the five providers we read state a Level 2 certification of their own. A certificate covers a scope, so ask which operations it covers and when it was issued: C3, for example, names two scopes, its MSP and its MSSP operations.

Do not read a Marketplace badge as a certificate. RPO and C3PAO are roles on the Cyber AB Marketplace; the CMMC Statuses in the rule are Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC). The difference is set out in what a CMMC RPO is.

The responsibility matrix, objective by objective

Your SSP has to describe each ESP service and point to the ESP's customer responsibility matrix. A matrix that says “shared” against a whole control family will not survive an assessor. The standard to ask for is the one C3 publishes: every Level 2 assessment objective assigned to a side.

Of the 320 Level 2 assessment objectives; C3's own figures, read on its site on 2026-10-22.

US persons, if you hold ITAR data

Under ITAR, releasing technical data to a foreign person inside the United States is an export (22 CFR 120.50(a)(2)), and handing someone the password or key that lets them view it unencrypted is a release (22 CFR 120.56(a)(3)). An MSP admin with rights on the drawings share is exactly that someone. The term that matters is “U.S. person” in 22 CFR 120.62: in practice a US citizen or national, a green-card holder, or a refugee or asylee who qualifies as a protected individual.

Help with the 72-hour report, in the contract

The reporting duty in DFARS 252.204-7012 sits on you, the contractor; hiring an MSP does not move it. What the MSP can do is make the deadline possible: spot the incident, run the review the clause asks for, and preserve the evidence.

Two practical points follow. Reporting needs a DoD-approved medium assurance certificate, so get yours before the incident, not during it. And the 90 days run from your report, so the MSP's log and backup retention has to reach past them. Where the MSP's work involves covered defense information, paragraph (m) has you put the clause itself in the subcontract or similar instrument. The whole clause is walked through in DFARS 252.204-7012 explained.

The cloud it puts your CUI in

If the MSP stores, processes or transmits your CUI in a cloud, that cloud has to meet the FedRAMP Moderate baseline or its equivalent and follow the clause's incident paragraphs, (c) to (g). Most MSPs on this page build on Microsoft: on 2026-10-22 the FedRAMP Marketplace listed Microsoft 365 GCC-High and Azure Government as FedRAMP Certified at High. An MSP's own tools are a separate question, and none of the five providers here is listed itself.

What never moves to the MSP

A good MSP can carry most of the technical requirements. The ones it cannot carry are the ones the rule ties to your company by name: your score, your affirmation, your report. Even the platforms MSPs run on say so; Todyl writes that its platform cannot fulfil the PE, PS, MA or MP controls for anyone.

The providers, one by one

How we read the providers

Questions small shops ask