The cybersecurity landscape for Managed Service Providers (MSPs) supporting government contractors is rapidly changing. With the CMMC framework becoming the benchmark for securing Controlled Unclassified Information (CUI), MSPs can no longer afford to approach compliance as an afterthought. Instead, understanding the regulatory framework, technical expectations, and assessment process is essential not only to protecting clients but also to secure your own future in the federal supply chain.
NIST 800-171 Is Still the Foundation
At the core of CMMC compliance lies NIST 800-171, the standard that outlines 110 security controls and 320 assessment objectives for safeguarding and protecting CUI. For MSPs, understanding these controls isn’t optional; it’s the baseline for helping clients achieve compliance. These requirements dictate everything from access control to incident response, forming the checklist by which organizations will ultimately be measured.
The challenge for MSPs is twofold: not only must you ensure your clients are meeting these standards, but you must also validate and demonstrate that your own operations don’t create gaps in compliance.
32 CFR and DFARS 252.204-7012
Compliance doesn’t end with NIST. There are two other critical pieces that MSPs need to be fluent in:
- 32 CFR: This regulation impacts contractors by establishing the rule set for how defense-related organizations handle CUI and comply with government-mandated security standards. It formalizes how the government enforces compliance.
- DFARS 252.204-7012: In place since 2015, this clause requires contractors (and by extension, their MSPs) to safeguard CUI and report cyber incidents. If you support clients with defense contracts, your systems, policies, and even your tools fall under the scrutiny of this requirement.
Many MSPs have relied on self-attestation, stating “we’re doing it” on behalf of their clients. Under CMMC, that approach won’t work. The days of checking a box without hard proof of implementation are over.
The MSP Challenge
CMMC is very much a fundamental shift in how MSPs must operate. Some key challenges include:
- Education: Understanding the complex web of regulations, assessment objectives, and control families is vital to understanding CMMC as a whole, as well as in practice.
- Technical Understanding: Designing networks, systems, and tools that meet the security requirements. This revolves around Conditional Access, Intune, DPL, Information Protection, Purview, etc.
- Documentation and Architecture: Understanding the inheritance flow, how these elements can be built to scale, and how they will support your clients is vital. This includes creating and maintaining a System Security Plan (SSP), Customer Responsibility Matrix (CRM), and formal agreements.
- Client Support: Not just advising, but actively helping clients prepare for assessments, implement controls, and remediate gaps. This cohesiveness is critical.
At Axiom, we learned firsthand that we could no longer operate the way we used to. Old processes and tools didn’t meet the new requirements, and continuing down the path we were used to without CMMC clients, risked pulling both us and our clients out of compliance.
The Tools You Must Say Goodbye To
One of the most significant operational shifts for MSPs is the tools you will have to leave behind. Traditional RMM tools can make compliance far more complicated because any tool that touches CUI now falls into scope for assessment. If your tool isn’t FedRAMP authorized, you’re adding unnecessary risk and complexity.
The reality is simple: FedRAMP is the ticket. Any tool interacting with CUI must be FedRAMP-compliant to keep your environment (and your clients) audit-ready. If the tool isn’t FedRAMP, you can:
- Show equivalent protections to FedRAMP Moderate (often difficult)
- Isolate the tool from any CUI; or
- Stop using it for anything CUI-related
MSPs Will Be Pulled Into the Assessment
It’s not just your clients under the microscope. As an MSP supporting defense contractors, you will be directly involved in CMMC assessments.
As stated in 32 CFR Part 170, “An OSA may use an ESP… in performance of a contract or subcontract with a requirement for the CMMC Status of Level 2 (C3PAO) under the following circumstances: (i) The use of the ESP, its relationship to the OSA, and the services provided are documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix. (ii) The ESP services used to meet OSA requirements are assessed within the scope of the OSA’s assessment against all Level 2 security requirements. (iii) … the OSA’s on-premises infrastructure connecting to the ESP’s product or service offering is part of the CMMC Assessment Scope, which will also be assessed.” You are considered a critical part of the compliance ecosystem and must be prepared to show your own adherence to security standards. The assessment process generally unfolds in two phases:
- Phase 1: Preparation and Scoping:
This phase is critical for reducing potential gaps and ensuring a smooth certification process. Clear documentation is necessary for an OSA to progress past phase 1.
- Phase 2: Evaluation by a C3PAO
Involves the actual evaluation conducted by the C3PAO to determine compliance with NIST SP 800-171’s 110 security requirements. Key activities include:
- Objective Evidence Collection
- Interviews with Key Personnel
- Technical Testing & Observations
- Assessment Findings
Having your SSP, CRM, and signed agreements in place is not optional, it’s mandatory.
Building for Scalability
For MSPs, the real key to thriving under CMMC is scalability. One-off solutions won’t work. By standardizing compliance throughout your organization, you can build a sustainable business model that scales as more clients fall under CMMC requirements.
Another thing to note is that CMMC is not always worth it for MSPs. It costs a lot of resources, time, and money to implement. Before you take it on, ask yourself these questions:
- Do you have only one or two DIB clients?
- Do you want to fully step into the space?
- Do you want to get CMMC Level Two Certified?
The Takeaway for MSPs
CMMC represents a new era for MSPs in the defense ecosystem. It’s not just about keeping clients compliant, it’s about transforming your own business model to meet federal standards, eliminate risky tools, and document every aspect of your operations. Those who invest in CMMC fully will be positioned as trusted partners in a highly regulated market. Those who don’t risk losing not only clients but their place in the supply chain.
If you have any questions, reach out to us. Or checkout our podcast for more information.