CMMC Compliance for MSPs and IT Providers

Managed service providers occupy an awkward double position in this regime. You are the mechanism by which many contractors will reach compliance, and you are frequently in scope yourself. Both halves need answering, and they have different answers.

The question clients actually ask

“Does my MSP need to be certified?” The honest answer is that it depends on a classification most people have never heard of.

Under 32 CFR Part 170, an External Service Provider is an outside organisation providing IT or cybersecurity services within your assessment scope. The treatment turns on two questions:

• Does the provider process, store or transmit CUI? If your MSP holds your drawings, backs them up, or their staff routinely access systems containing them, the answer is yes.
• Does the provider supply security protection assets? Identity management, endpoint protection, SIEM, backup — things that protect the in-scope environment without necessarily holding CUI.

A provider that never touches CUI but supplies security protection assets is generally assessed within the client’s assessment rather than separately. One that handles CUI carries obligations of its own. The distinction matters commercially: it decides whether your clients need you certified, or need your controls documented inside their scope.

FedRAMP equivalency, precisely

Where you provide cloud services holding covered defense information, DFARS 252.204-7012(b)(2)(ii)(D) requires FedRAMP Moderate or equivalent.

“Equivalent” is not a self-declaration and not a marketing claim. It requires a body of evidence demonstrating the service meets the FedRAMP Moderate baseline, and the burden sits with the contractor relying on it — which in practice means your client will be asked for it, and will ask you.

Two practical consequences. If you are recommending commercial Microsoft 365 for a client handling CUI, you are recommending they carry that evidence burden; say so explicitly. And if you cannot produce the evidence for your own platform, GCC High or an equivalent government-community offering is the shorter path. Cost implications are on the cost guide.

Shared responsibility, written down

The failure that produces findings in real assessments is not technical. It is a client assuming the MSP covers a control, the MSP assuming the client does, and nobody having written it down.

A shared responsibility matrix maps each of the 110 requirements to an owner: you, the client, or both. It is unglamorous and it is the artefact that prevents an assessor finding a gap where each party believed the other had it covered.

Build it at objective level rather than requirement level. “MSP handles access control” is not a division of responsibility; it is an aspiration. See the fourteen families for what needs allocating.

Where MSPs bring themselves into scope

Usually through tooling rather than through deliberate handling:

• Remote monitoring and management platforms with access into client environments holding CUI.
• Ticketing systems where engineers paste configuration detail, error output, or occasionally the file that caused the problem.
• Backup infrastructure, which inherits the scope of whatever it captured.
• Documentation platforms holding network diagrams and credentials for in-scope environments.
• Engineer workstations, which are rarely as segregated as the architecture diagram suggests.

The scoping exercise is the same one your clients run, applied to yourself — see finding CUI in your environment.

Software and cloud providers

The same logic reaches SaaS vendors serving defense contractors. If your product stores customer CUI, you are a cloud service provider under 7012 and the equivalency question is yours. If it processes source code or technical data on behalf of a defense customer, the same applies.

The one distinct consideration for product companies: your own source code and technical data may be CUI in its own right where it was developed under a government contract, which brings your development environment into scope rather than only your production platform.

What the 2026 suspension changed for providers

Less than your clients may believe. The suspension removed third-party certification requirements. DFARS 252.204-7012 still applies, which means the FedRAMP equivalency obligation for cloud services is unchanged, as is the flow-down that reaches you through client contracts.

If anything the advisory position is more delicate now: clients are asking whether they can stop, and the accurate answer is that the verification stopped and the obligation did not. See program status.

Providers who want to offer ongoing compliance alongside IT operations should understand how CMMC managed services differ from running the systems themselves.