CMMC for MSPs and ESPs: Rules for Service Providers
By Shaheer Malik · Updated Oct 28, 2026
An MSP becomes an External Service Provider (ESP) under CMMC when it processes, stores or transmits your CUI or your security protection data, such as logs and configurations. Its services are then part of your assessment scope and are assessed as part of your assessment. Cloud providers holding CUI must also meet FedRAMP Moderate or equivalent.[1][2]
Is your provider an ESP?
The rule defines an ESP as external people, technology or facilities used for IT or cybersecurity services, and adds that “CUI or Security Protection Data … must be processed, stored, or transmitted on the ESP assets to be considered an ESP.”[1] A provider that handles neither is not an ESP.[1]
How ESPs are treated
| The provider handles | If it is a cloud provider | If it is not |
|---|---|---|
| CUI | Must meet the FedRAMP requirements in DFARS 252.204-7012 | Its services are assessed as part of your assessment |
| Security data only | Assessed as Security Protection Assets | Assessed as Security Protection Assets |
| Neither | Not an ESP | |
From Table 4 to 32 CFR 170.19(c)(2)(i).[1]
Using an MSP for CUI at Level 2 (C3PAO)
You may use a non-cloud ESP for CUI if its use and services are documented in your SSP and in the ESP’s service description and customer responsibility matrix, and its services are assessed within your scope against all Level 2 requirements.[1]
How to choose a CMMC MSP
- Ask for the customer responsibility matrix: which of the 110 requirements they perform, share or leave to you.
- Ask which of their tools store your logs or CUI, and the FedRAMP status of any cloud among them.[2]
- Ask whether their own environment has been assessed, and by whom.
- Ask how they will support your assessment day and your annual affirmation.
Many CMMC consultants also offer managed services. Browse firms by state or get up to 3 quotes. Are you an MSP? List your firm.
FAQ
Do MSPs need to be CMMC compliant?
If an MSP handles a client’s CUI or security protection data it is an External Service Provider, and its services are assessed as part of the client’s CMMC assessment. A cloud provider holding CUI must meet FedRAMP Moderate or equivalent.
What is an ESP in CMMC?
An External Service Provider: external people, technology or facilities providing IT or cybersecurity services that process, store or transmit CUI or security protection data.
What is a customer responsibility matrix?
A document from a provider showing which security requirements it meets, which are shared, and which remain the customer’s. CMMC expects it for ESPs used with CUI.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
More on hiring help
- C3PAO vs RPO: Who Does What in CMMC
- How to Choose a CMMC Consultant
- How to Become a CMMC Assessor: CCP and CCA Requirements
- How to Choose a C3PAO for Your CMMC Assessment
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.