CMMC for Managed Service Providers

If your managed service provider supports defense contractors, CMMC for Managed Service Providers certification may be required for your organization. MSPs and MSSPs occupy a unique position—you are both a potential target for attackers seeking access to defense supply chain networks and a critical enabler of your clients’ compliance efforts.

MSP stands for Managed Service Provider, a company that remotely manages IT infrastructure and systems for clients. MSSP stands for Managed Security Service Provider, an MSP specifically focused on security services.

This guide explains when MSPs need CMMC certification, how to determine your required level, and strategies for serving defense industrial base clients effectively.

When MSPs Need CMMC Certification

Your CMMC obligations depend on how you interact with client data and systems.

Scenario 1: You Store or Process Client CUI

If your services involve storing, processing, or transmitting Controlled Unclassified Information on behalf of defense contractor clients, you need CMMC certification at the same level as your clients. This includes:

• Cloud services hosting client CUI
• Backup solutions storing CUI data
• Help desk services accessing CUI systems
• Email hosting containing CUI

Controlled Unclassified Information (CUI) is sensitive government information requiring protection under federal regulations.

Scenario 2: You Have Administrative Access to Client CUI Systems

Even if CUI never resides on your systems, administrative access to client environments handling CUI brings you into scope. Remote management tools, administrative credentials, and network access create security dependencies that CMMC addresses.

Scenario 3: You Provide Security Protection for CUI Systems

If you provide security monitoring, endpoint protection, or other security services for systems handling CUI, you are a Security Protection Asset provider. Your services must meet CMMC requirements.

Security Protection Assets are systems that provide security functions for CUI-handling environments, such as firewalls, SIEM systems, and endpoint protection platforms.

Scenario 4: You Only Support Non-CUI Systems

If your services are strictly limited to systems that do not handle CUI and you have no access to CUI environments, you may not need CMMC certification. However, clearly document this limitation in your service agreements.

Understanding the External Service Provider Requirements

The CMMC framework specifically addresses External Service Providers (ESPs), which includes MSPs. According to 32 CFR Part 170, ESPs providing services to contractors must implement security controls commensurate with the CUI they access or process.

External Service Provider (ESP) is CMMC terminology for organizations providing IT or security services to contractors, including MSPs, cloud providers, and security service providers.

Key requirements for ESPs:

• Must be identified in client’s System Security Plan
• Security responsibilities must be documented in service agreements
• Must achieve appropriate CMMC level if processing CUI
• Cloud services must meet FedRAMP requirements

Determining Your CMMC Level

Level 1 may be sufficient if you only handle Federal Contract Information for clients without accessing CUI. This includes basic IT support for systems outside CUI boundaries.

Level 2 is required if you:

• Store or process client CUI
• Have administrative access to CUI environments
• Provide security services protecting CUI systems
• Host cloud services containing CUI

Most MSPs serving defense contractors need Level 2 certification because their services inherently involve CUI access.

The MSP as Attack Vector

Adversaries target MSPs specifically because compromising one provider can yield access to multiple defense contractors. Recent supply chain attacks demonstrate this risk:

• Attackers gain access through MSP tools and credentials
• Single compromise affects all MSP clients
• MSPs hold privileged access across multiple environments
• Security monitoring services provide visibility into client operations

The DoD implemented CMMC partly to address supply chain risks that MSPs represent. Your compliance directly impacts your clients’ security and their ability to win contracts.

Compliance Challenges for MSPs

Multi-Tenant Environments

MSPs typically serve multiple clients from shared infrastructure. CMMC requires separation of CUI from other data and restricting access based on need-to-know. Multi-tenant architectures must ensure one client cannot access another’s CUI.

Tool and Platform Compliance

Remote monitoring and management (RMM) tools, professional services automation (PSA) platforms, and documentation systems used by MSPs must meet security requirements when they interact with CUI. Evaluate whether your operational tools can support compliant service delivery.

Personnel Access Management

MSP technicians often have broad access across client environments. CMMC requires limiting access to CUI based on job responsibilities. Implement role-based access controls that restrict technician access to only those clients and systems they support.

Shared Responsibility Clarity

Defense contractor clients need to understand which CMMC controls you handle versus which remain their responsibility. Document shared responsibilities clearly in service agreements and your clients’ System Security Plans.

Building a CMMC-Compliant MSP Practice

Step 1: Assess Your Current Services

Identify which services involve CUI access:

• Which clients are defense contractors?
• What data do you store or process for them?
• What systems do you have administrative access to?
• What security services do you provide?

Step 2: Determine Your Required Scope

Your CMMC scope includes all systems that store, process, or transmit CUI, plus systems providing security functions for those environments. This typically includes:

• RMM platform components
• Backup systems storing CUI
• Help desk and documentation systems
• Security monitoring infrastructure
• Administrative workstations

Step 3: Implement Required Controls

For Level 2, implement 110 NIST SP 800-171 controls across your in-scope systems. Key areas for MSPs include:

• Access control with multi-factor authentication
• Audit logging of administrative actions
• Encryption for CUI at rest and in transit
• Incident response procedures
• Security awareness training for all personnel
• Vulnerability management for all systems

Step 4: Document Your Security Practices

Create documentation that supports both your certification and your clients’ compliance:

• System Security Plan describing your controls
• Service agreements defining security responsibilities
• Policies and procedures for CUI handling
• Incident response and notification procedures
• Personnel security and training records

Step 5: Get Certified

Schedule your CMMC assessment with a C3PAO. Your certification enables clients to include you as a compliant ESP in their own certifications.

Competitive Advantage for Certified MSPs

CMMC certification creates significant competitive advantages for MSPs:

Market Access

Defense contractors must use certified providers. Non-certified MSPs lose eligibility to serve approximately 200,000 companies in the defense industrial base.

Premium Pricing

Certified MSPs can command premium rates for compliance-supporting services. Defense contractors budget specifically for compliant IT services.

Reduced Client Churn

Switching MSPs creates compliance complications for defense contractors. Certified MSPs enjoy stronger client retention.

Expanded Services

Certification positions you to offer compliance consulting, assessment preparation, and managed compliance services beyond traditional MSP offerings.

Key Takeaways for MSPs

MSPs serving defense contractors need CMMC certification if they store, process, or access client CUI. Most MSPs providing services to defense industrial base clients require Level 2 certification.

Your compliance directly impacts clients’ ability to win and maintain DoD contracts. Non-certified MSPs lose access to a significant market segment.

Build compliance into your service delivery model. The investment in certification creates competitive advantages that justify the cost.

---

Related Articles:

• What is CMMC Compliance?
• CMMC Level 2 Requirements
• CMMC Scoping: What Systems and Data Are Covered?
• 32 CFR Part 170 – CMMC Program Rule
• NIST SP 800-171 Rev 2
• CMMC Level 2 Scoping Guide

Official Sources: This article is based on 32 CFR Part 170 “Cybersecurity Maturity Model Certification Program” (effective December 16, 2024), specifically sections addressing External Service Providers and Security Protection Assets, and NIST SP 800-171 Revision 2.

---

Need help getting your MSP CMMC certified? Contact Greypike for expert guidance on building a compliant managed services practice.