Your MSP can be secure and still not be CMMC-ready

A defense contractor tells us their MSP "handles security." Often that's true. The MSP patches on schedule, runs EDR on every endpoint, watches the logs and restores backups when something breaks. The environment is genuinely well run.

Then the contractor tries to complete a CMMC Level 2 self-assessment, and the picture changes.

Security and readiness answer different questions

Good security operations answer: are we protected? CMMC Level 2 readiness answers a narrower and more demanding question: can we show, requirement by requirement, that the 110 security requirements of NIST SP 800-171 Revision 2 are met for the systems that handle controlled unclassified information (CUI)? (DoD CIO)

The difference lives in four places.

Scope. Your MSP protects everything it manages. CMMC asks which people, systems and providers actually touch CUI, and expects you to define that boundary before you assess anything. A well-secured network with no defined boundary is still unscoped.

The non-technical requirements. Many of the 110 requirements cover policy, training, personnel, physical access and planning. Those belong to the business, not to the tooling, and most MSP contracts don't cover them.

Evidence. Running a control well and showing it are different jobs. Each requirement needs something you can show: a configuration, a log, a procedure, a record. Most MSPs have simply never been asked to produce those artifacts in a form an assessment can use, so it's worth agreeing on them together early.

Ownership on paper. If your MSP stores or processes CUI, or security protection data such as log files and configuration data, its services are in your assessment scope. (32 CFR 170.4, 32 CFR 170.19) The rule also expects that relationship to be documented in your system security plan (SSP), and described in the provider's service description and a customer responsibility matrix. In most of the environments we see, neither document exists yet.

The affirmation is yours, not your MSP's

This is the part that surprises people. Under the CMMC rule, a senior official from your organization (the "affirming official") affirms your compliance in the government's Supplier Performance Risk System (SPRS). (32 CFR 170.4, DoD CIO) Your MSP can do excellent work and still not be the one signing. That's why the responsibility split has to be explicit before anyone affirms anything.

Five steps to close the gap with your MSP

1. Confirm what's driving the question. Start from the actual contract clause or customer request, and what information you really receive. Don't assume a level.
2. Draw the boundary. List the users, systems, locations and providers that handle CUI, and mark which of them your MSP touches.
3. Split every requirement three ways. For each of the 110: does the MSP own it, do you own it, or is it shared? Implementing a control and producing its evidence are often different jobs, so name an owner for both.
4. Gather the evidence together. Work with your MSP on the artifacts behind the requirements it owns. What exists today, and what would have to be created?
5. Write it down. Put the split into your SSP, and into the MSP's service description and responsibility matrix, so the agreement and the assessment say the same thing.

None of this is a criticism of your MSP. In our experience the best MSPs welcome it, because an explicit split protects them from being blamed for requirements they were never contracted to meet.

Where to start

If you already know you handle CUI, the Level 2 Readiness Assessment does exactly this: it confirms the boundary, maps all 110 requirements to an owner and an evidence status, and brings your MSP into the room as a partner from the first session. Not sure yet? The free Level 2 Self-Check gives you a readiness band and your top gaps.

Sources

1. DoD CIO: About CMMC (checked Nov 2, 2026)
2. 32 CFR 170.4: Acronyms and definitions (checked Nov 3, 2026)
3. 32 CFR 170.19: CMMC scoping (checked Nov 3, 2026)

General information, not legal advice. Your contracts decide which requirements apply to you.