Hiring an MSP does not hand off the obligation
A managed service provider can run your help desk, your firewall and your endpoint tools, and that may be the only practical way for a firm with no security staff to meet NIST SP 800-171. It cannot take the assessment or the affirmation off your hands. The CMMC rule decides how far your assessment reaches into your provider's work, and that is worth understanding before you sign anything.
The Affirming Official must be a senior level representative from within your own organization. When your provider's tools fail a requirement, your score carries the deduction and your official signed for it. The rest of this guide is about making that arrangement one you can defend.
What the rule means by External Service Provider
32 CFR 170.4 defines an External Service Provider as external people, technology or facilities used to provide and manage IT or cybersecurity services on your behalf. It then adds the test that matters: CUI or Security Protection Data must be processed, stored or transmitted on the provider's assets for it to count as one.
Security Protection Data is broader than most owners expect. The rule lists configuration data, log files, data on the configuration or vulnerability status of in-scope assets, and passwords that grant access to the in-scope environment. A provider with a remote management agent on your servers and a ticketing system full of your configurations is holding Security Protection Data, even if it has never opened a drawing.
The four scoping outcomes
The rule asks two questions: is the provider a Cloud Service Provider, and what does it handle? For a Level 2 assessment, Table 4 in 32 CFR 170.19 gives these answers.
| The provider handles | If it is a cloud provider | If it is not a cloud provider |
|---|---|---|
| CUI, with or without Security Protection Data | Must meet the FedRAMP requirements in DFARS 252.204-7012 | Its services are in your scope and assessed as part of your assessment |
| Security Protection Data, no CUI | Its services are in your scope, assessed as Security Protection Assets | Its services are in your scope, assessed as Security Protection Assets |
| Neither | Does not meet the definition of an External Service Provider | Does not meet the definition of an External Service Provider |
Security Protection Assets are assessed against the Level 2 requirements relevant to the capabilities they provide. A provider that is not a cloud service and handles your CUI goes further: its services are assessed within your assessment against all Level 2 requirements.
When your MSP is inside your assessment
An MSP that patches your machines, watches your logs and holds administrator credentials lands in the second row. That puts its services in your scope, and your assessor can ask how they work. Your on-premises infrastructure connecting to the provider's service is part of the scope as well.
Scope follows the data and the access, whatever the marketing says. A provider that calls itself security-only still holds your logs, and a help desk that never touches a server still holds passwords when it resets them for your users.
A 60-person fabricator with an MSP-run file server in the MSP's own data center may land in the first row instead. Classify each service separately, because one provider can sit in several rows at once.
Cloud providers follow a different rule
If a cloud service stores or processes CUI, DFARS 252.204-7012 requires the contractor to "require and ensure" that the provider meets security requirements equivalent to the FedRAMP Moderate baseline and complies with the clause's incident reporting, malicious software, media preservation, forensic access and damage assessment paragraphs. The CMMC rule accepts a FedRAMP Moderate (or higher) authorization or an equivalent under DoD policy.
The DoD memo of December 21, 2023, sets a high bar for "equivalent." Published summaries describe an evaluation by a FedRAMP-recognized assessor and 100 percent compliance with the Moderate baseline. A vendor's statement that it is "FedRAMP-aligned" does not meet that test. Ask for the Marketplace listing or the body of evidence.
The customer responsibility matrix is the working document
The rule requires that your use of the provider, your relationship and the services provided be documented in your system security plan and described in the provider's service description and customer responsibility matrix. The requirements from that matrix must be documented or referred to in your plan.
A useful matrix goes requirement by requirement and states who does what, on which system, with what tool, and where the evidence is. A matrix full of the word "shared" with no division of labor tells an assessor nothing. Read yours with one question in mind: for each requirement, could we show an assessor who performs it and hand over the proof?
A requirement marked "shared" with no division of labor is a requirement nobody owns.
A requirement marked "shared" with no division of labor is a requirement nobody owns.
Working with the MSP you already have
Most firms reading this already have a provider, and switching is expensive. Start by finding out what you have. Ask for the list of tools, the accounts technicians use and the data each tool holds, then classify each service against the table above.
Next, sit down with the provider's lead engineer and walk the 110 requirements together. Mark each one as yours, theirs or split, and for every split item write down exactly who does which part. That working session usually produces your first honest matrix, and it shows you quickly whether the provider can support the program at all.
Finally, test one requirement end to end. Pick account removal: have the provider show you the ticket, the disabled account and the log entry for the last person who left. If that takes a week to assemble, you have learned what an assessment would feel like, with time left to fix it.
What your MSP should be able to show you
- A service description and customer responsibility matrix covering the Level 2 requirements
- Every tool that holds your CUI or Security Protection Data, where it is hosted and its FedRAMP status
- How technician access is granted, secured with multifactor authentication, logged and removed
- Patch, vulnerability and endpoint reports for your environment specifically
- A written incident process with a named contact and an after-hours path
- A commitment to take part in your assessment and produce evidence on request
Contract terms that matter
Check your managed services agreement for each of these, and put what is missing in writing.
- Incident reporting. DFARS 252.204-7012 requires reporting to DoD within 72 hours of discovery. The contract should make the provider notify you immediately, with enough detail for you to report. You need your own DoD-approved medium assurance certificate to file.
- Preservation. The clause requires images of affected systems and relevant monitoring data to be preserved for at least 90 days from the report. Your provider has to be able to do that for what it runs.
- Forensic access. The clause gives DoD access to additional information and equipment needed for forensic analysis, so the provider must agree to support it.
- Evidence rights. Logs, reports and configuration exports on request and at termination, kept in a form that supports the six-year retention period for assessment artifacts.
- Subcontracted tools. Advance notice before the provider changes any tool or vendor that holds your data.
- Termination. Return of configuration data and credentials, removal of agents and accounts, and written confirmation.
The tools your MSP buys from someone else
An MSP's remote management platform or log system is often another company's product. Those products are usually cloud services, and a cloud service processing your Security Protection Data is in your scope, assessed as a Security Protection Asset. That means the vendors behind your vendor are part of the picture. Ask for the list, and ask to be told when it changes.
Whether the MSP should hold its own certification
The rule says an External Service Provider "may voluntarily undergo a CMMC certification assessment to reduce the ESP's effort required during the OSA's assessment." A provider that has done so can make your assessment easier. The rule states that the minimum assessment type for the provider is dictated by your contract requirement, and your plan and matrix still have to describe the service.
Answers that should stop you
- "We are CMMC compliant" with no matrix behind it, since a provider's status does not describe your environment
- "The tool vendor handles that" with no vendor list or FedRAMP information
- "All our techs use one admin account", which fails identification and authentication on your systems
- "We can't export your logs", which leaves you with no evidence and no incident response
- "We've never been asked for that", on a question this guide treats as routine
Frequently asked questions
No. It can provide many of the capabilities, but your firm remains the organization being assessed, and your own people, policies and facilities are still in scope.
No. The rule defines the Affirming Official as a senior level representative from within your organization who is responsible for compliance and has authority to affirm it.
The rule defines a cloud provider by the cloud computing model: on-demand network access to a shared pool of configurable resources with minimal provider interaction. Classify each service against that definition, because one company can offer both kinds.
Level 1 scoping tells you to consider external service providers that process, store or transmit FCI. The customer responsibility matrix language appears in the Level 2 and Level 3 scoping rules.