A good provider shortens the road to CMMC, but the shop still owns the result. See what your MSP handles and what stays with you.
-------------------------------------------------------------------------------------------------------------------
TL;DR: A managed service provider (MSP) can take a lot of the weight off a shop when it comes to Cybersecurity Maturity Model Certification (CMMC), but the shop still owns the result. Under CMMC, an MSP that touches a contractor's systems counts as an external service provider (ESP), so its work gets pulled into the contractor's assessment. A good provider shortens the road and handles the heavy lifting. It can't answer to an assessor for the shop, and it can't sign on the shop's behalf.
-------------------------------------------------------------------------------------------------------------------
A lot of defense contractors figure their MSP has CMMC covered. The provider already runs the network, manages the laptops, and handles the security tools, so it feels natural to hand over the whole project. A good MSP can do a lot, but there's a piece of CMMC it can't take on, and it's the piece with the contractor's name on it.
When the project feels like too much, it's tempting to give it to the experts and call it done. Think about hiring a personal trainer. They build the plan, show you the right form, and push you through the last set when you'd rather quit. They can't do the reps for you. Nobody ever got stronger because the trainer did the lifting. Handing CMMC to an MSP works the same way. The MSP can plan it, build it, and keep it running, but the result still belongs to you.
That matters more now that CMMC is showing up in real contracts. Assessments are real, and assessors want answers from the contractor, not just the provider. A shop that assumes its MSP has everything handled can find out otherwise in the middle of an assessment, and that's a rough way to lose a contract.
It's also part of a bigger shift in how the government looks at outside IT help. The more a provider touches a contractor's systems, the more it becomes part of what gets assessed. Under CMMC, that kind of provider has a name, external service provider, or ESP, and it comes with expectations of its own.
An MSP can be a huge help with CMMC. Knowing where the provider's job ends and the contractor's begins is what makes the partnership work.
External service provider sounds like a title somebody invented to make a simple idea sound complicated. The idea itself is simple. An ESP is any outside company that provides IT or security services to a contractor.
If an outside company helps run, protect, or support the systems that matter for CMMC, it counts. Managing the firewall counts. Patching the servers counts. Monitoring for threats, handling user accounts, running backups, and hosting the environment all count too. Most MSPs do several of those things before lunch.
So if you have an MSP, odds are good it's an ESP in CMMC terms. It doesn't matter how long you've worked together or how well the provider knows your shop. The label comes from what the provider does, not from how the relationship feels.
That label changes how an assessor sees your setup. An assessor doesn't stop at the edge of your own staff. If a provider's services are part of how you meet the requirements, those services are part of the picture.
CMMC has a lot of moving pieces, and the first post in this series shows how the provider piece fits in with the rest of them.
This is the good news, and there's plenty of it. A good MSP can take a big chunk of CMMC work off your hands, and for most small shops, that's the difference between getting started and staring at a spreadsheet for a year.
Start with the day-to-day. A provider can set up and manage the secure environment, keep systems patched, handle user accounts and multifactor logins, run endpoint protection, and keep backups going. It can set up logging and monitoring so there's a record of what happened on the systems and when. These are the tasks that eat hours every week, and they're the ones a shop with no dedicated IT person tends to let slide.
A provider can also help with the paperwork. CMMC wants a lot of it written down, from the system security plan to policies and procedures to evidence that the controls are working. An MSP that's been through this before knows what an assessor expects to see and can help pull it together.
A provider can even build and run the enclave itself, the walled-off corner of the network that keeps Controlled Unclassified Information (CUI) in one place, and the Enclave post in this series covers how that works.
Having someone who does this every day makes the whole project feel smaller. That's a lot of help. It just isn't all of it, and the next section covers the rest.
Some things stay with you no matter how good your provider is. The first is knowing what you're protecting. Your MSP can see the files, but it can't always tell which ones count as CUI. That depends on your contracts and your customers, and nobody knows those better than you.
Telling Federal Contract Information (FCI) apart from CUI is the starting point for all of it, and the FCI vs. CUI post in this series shows how.
The second is deciding who gets access. Your provider can set up the accounts, but you're the one who decides who needs to touch the sensitive information and who doesn't. Nobody else knows who actually works on what.
The third is your own people. Training, following the policies, and not forwarding a customer's drawing to a personal inbox all happen on your side of the line. A provider can send the reminders. It can't make anyone read them.
Then there's the sign-off. When it's time to say the shop meets the requirements, a senior person at the company has to put their name on it. A provider can't do that for you, and an assessor won't accept it if it tried.
Your MSP can build the system. You're the one who answers for it.
When an assessor comes to look at your shop, your provider comes along for the ride. Not in person, necessarily, but its work is part of what gets looked at. If your MSP patches the servers, the assessor wants proof that patching is happening. If it manages the logs, the assessor wants to see the logs.
That means you need to be able to explain who does what. Which requirements does your team handle? Which ones does the provider handle? Which ones do you share? Many shops put the answers in a simple chart, often called a responsibility matrix, so nobody has to guess in the middle of an assessment.
The assessor may also want to talk to people at the provider. Don't be surprised if someone from your MSP is asked to answer questions or show how a tool is set up. A provider that's used to this takes it in stride. One that isn't may get nervous, and that tells you something.
There's good news here too. An MSP that supports you generally doesn't need its own CMMC certification just because it helps. Its services get assessed as part of yours.
How the assessment itself works, including when it's a self-assessment and when a third-party assessor comes in, is covered in the Level 1 vs. Level 2 post in this series.
Either way, the proof has to exist, and somebody has to be able to find it.
Everything so far assumes the provider helps run your systems. Things change when the provider holds your CUI itself. If an outside company stores it, processes it, or sends it on your behalf, it's more than a helper. It's handling the exact thing you're trying to protect.
That happens more often than you'd think. A hosted enclave does it. So does a cloud file share, or an email service that carries CUI. In those cases, the provider is also a cloud service provider, and it has to meet a federal standard of its own, generally the Federal Risk and Authorization Management Program (FedRAMP) Moderate level or its equivalent.
That's not something to take on faith. A polished website and a long list of happy customers don't prove it. Ask for the paperwork. A provider that meets the standard can show you.
Ask where the CUI physically lives and who at the provider can get to it, too. Those answers belong in your written records alongside everything else.
The provider's setup also feeds into the score you post for your own systems, and the DFARS 7019 and 7020 post in this series explains how that number works.
Handing a provider your CUI hands it part of your risk. Make sure it can carry the weight.
Before you lean on a provider for CMMC, ask a few plain questions. The answers tell you fast whether you've got a partner or just a vendor who says yes to everything.
Start with experience. Has the provider supported a shop through a CMMC assessment before, and can it tell you how that went? A team that's been through one can talk about the evidence assessors asked for. A team that hasn't will usually talk about tools instead.
Ask what the provider will own and what it expects you to own. A good one answers without hesitating, and it'll put the split in writing as a responsibility matrix. If the answer is "don't worry, we've got it all," keep asking.
Ask whether its own setup touches your CUI, and how it's protected if so. This is where the cloud question from the last section comes back around. You want a clear answer on where the data lives and what the provider's cloud meets.
Ask how it'll help you prepare for the assessment itself. Will it gather evidence, sit in on the review, and answer an assessor's questions about its own work? Finally, ask what happens when something changes. New tools, new staff, and new contracts all affect your scope, and a good provider keeps your documents current instead of waiting for the next audit.
If a provider can answer all five without squirming, you're in good shape. If it can't, you've learned something before it costs you.
An MSP can do a lot for a shop heading into Cybersecurity Maturity Model Certification (CMMC). Once it touches your systems, it counts as an external service provider (ESP), so its work becomes part of your assessment. A good one shortens the road, builds the controls, and keeps the documents moving. What it can't do is answer for you. Scoping calls, access decisions, training, and the senior official's affirmation stay with the contractor, and so does the accountability.
Here's where shops get into trouble. The provider runs the network, so everyone assumes CMMC is in the same box. Then an assessor asks who owns a decision, and the owner points at the provider while the provider points back. Nobody wrote down who does what. Add a provider that handles CUI in a cloud that doesn't meet FedRAMP Moderate or an equivalent, and you've got a problem that no amount of good support can fix. Meanwhile, the prime keeps asking for your score, and the contract sits on hold.
CNWR works with defense contractors on managed IT, cybersecurity, and CMMC readiness, so it knows both sides of this relationship. It can serve as your provider and show you exactly where its work ends and yours begins. That means a written responsibility matrix, clear answers about where your data lives, and a team that can speak to its own work when an assessor asks. You stay in charge of your certification, and you're never left guessing what's yours.
If you want a provider who'll be plain about who owns what, team up with CNWR. Get the split on paper, and the assessment gets a whole lot calmer.
1. Does my MSP need its own CMMC certification to support me?
Not just for helping. An MSP that supports your systems is an ESP, and its services get assessed as part of your certification. The exception is a provider that handles CUI directly as a cloud service, which must meet FedRAMP Moderate or an equivalent. Either way, the certification belongs to you, not the provider. Ask what your provider meets if CUI will live on its platform.
2. Who is responsible if my provider misconfigures something?
You are, from the assessor's point of view. The provider may owe you a fix under your contract, but the contractor answers for the result. That's why a responsibility matrix matters, since it shows who owns each control and who verifies it. Review it with your provider each year and whenever tools or contracts change. Vague ownership is what leaves shops scrambling when questions come in.
3. What should I ask a provider before handing over CMMC work?
Ask whether it's supported a shop through an assessment, what it'll own versus what you own, and whether its setup touches your CUI. Ask how it'll help with evidence and assessor questions, and how it keeps your documents current when things change. Clear, specific answers point to a partner. Answers that are all reassurance and no detail point to a vendor. Trust the specifics.