If you are pursuing CMMC, your Managed Service Provider (MSP) should be leading you organization in the right direction with the right questions.
But here is an uncomfortable truth that many Organizations Seeking Certification (OSCs) are starting to realize:
If your provider isn’t asking hard, detailed, scary questions, they may not fully understand what it takes to get you across the finish line.
The Questions That Actually Matter
When OSCs begin their CMMC climb, most will be expecting discussions about pricing and timelines.
While those are important components, they do not expect being asked questions like:
- Where exactly does your CUI come from?
- Where does it live in your environment?
- Where does it go after it leaves?
- What applications touch it, even indirectly?
And these are some of the most critical questions in the entire process.
If your provider doesn’t understand your data flow, they cannot protect it properly.
If they don’t ask, they don’t know.
And if they don’t know, they can’t secure it.
The CUI Blind Spot
Many OSCs say, “We send our CUI right back to the government”.
Sounds simple enough.
In reality, if you dig a little deeper asking:
- Does it pass through email?
- Is it uploaded into third-party software?
- Does it ever touch design tools or external platforms?
- Are any of these outside the U.S.?
Things get complicated.
This is usually where we see strong, experienced MSPs separating themselves from newer ones.
They don’t stop at the surface level answers, they dig until the full picture is clear for everyone.
Because CUI isn’t just about where it begins and ends… it’s about everything it touches in between.
The Forgotten Risk of Physical Media
Here’s a catch that throws many OSCs off guard:
Physical media.
We’re talking about:
- USB drives
- Printers (even at home!)
- External hard drives
- Backup devices
These often get missed as “not a big deal”
They are a big deal.
The moment CUI exists on physical media you’ve introduced:
- Encryption requirements
- Handling procedures
- Tracking responsibilities
- Additional compliance tools
One overlooked flash drive can introduce an entirely new layer of risk.
And if your MSP isn’t asking about this, they are missing a major piece of your environment.
“CMMC Ready”? Not What You Think
Another major gap? Misunderstanding what “ready” actually looks like.
Some OSCs assume the MSP handles everything, the assessment will be quick and straightforward, and they just get to “show up” and will pass.
That’s not reality.
A proper relationship with MSPs involve:
- A shared responsibility matrix/ A customer responsibility matrix
- Active participation from both sides
- Real-time questioning from your assessor
If your provider hasn’t clearly explained that they will be in the room with you, speaking to controls, that is a red flag.
The Never-Ending Story of the Timeline
OSCs lead with the same two questions:
- How much will this cost?
- How long will this take?
These are very reasonable and fair.
But here is the issue:
If your MSP give you a fast, clean, wrapped in a bow answer without asking the critical questions first… it is probably inaccurate.
Why?
Because every environment has different hidden complexities:
- Unknown systems
- Infrastructures
- The “oh by the way” discoveries months later (Like an unexpected server in a different country)
Real timelines/cost come from real discoveries, not guess work.
And these numbers can change throughout your process.
That’s just realistic.
The Non-negotiable Document That Should Never Be Missing
The Share Responsibility Matrix/The Customer Responsibility Matrix
If you are working with an external provider, this document is required.
It clearly defines:
- What the MSP is responsible for
- What the OSC is responsible for
- Where the responsibilities overlap
Without it? You risk confusion, missed controls, and failed assessments.
Worst case scenario? Everyone assumes someone else handled something… and no one did.
If your provider hasn’t shown you this document, you need to ask why.
The Bottom Line
The right MSP doesn’t just provide answers. They:
- Ask better questions
- Challenge assumptions
- Uncover risks
- Prepare you for reality… not just the sale
If your provider doesn’t do that, you aren’t just missing guidance, you may be risking a failed assessment.
CMMC isn’t about finding the easiest path, it’s about finding the most informed one.
And it starts with asking the right questions early, often, without shortcuts.
If your MSP isn’t leading that conversation, it might be time for you to start it.
If you have any questions, feel free to reach out. Or check out our podcast channel, Climbing Mount CMMC, for more details.