Table of Contents
If you run a managed service provider (MSP) with defense contractor clients, Cybersecurity Maturity Model Certification (CMMC) has already changed your business, whether you've engaged with it or not.
Your clients' contracts now carry CMMC requirements. Their assessments examine the services you deliver, and their assessors will ask questions about your tools, your access, and your systems.
The good news: the rules for service providers are clearer than the confusion around them suggests, and most MSPs need less than they fear. The better news: the demand for CMMC-literate MSPs far exceeds the supply.
This guide explains when an MSP needs its own CMMC status, when it doesn't, how you fit into a client's assessment, and how to turn compliance into a service line instead of a cost.
TL;DR
- MSPs that serve defense contractors are external service providers (ESPs) under the CMMC program, which means their services fall inside their clients' assessments.
- The final rule doesn't require most MSPs to have their own CMMC status. An MSP can instead be documented in each client's SSP and assessed as part of the client's assessment.
- The exception that matters: if you store, process, or transmit CUI on your own systems, you face Level 2 requirements yourself, and an independent assessment usually beats being examined inside every client's.
- CMMC's Phase 2 was suspended in July 2026 pending a program review. Phase 1 self-assessments continue, and so does your clients' need for help with them.
- MotherBear gives MSPs one workspace to manage CMMC work for every client: controls, evidence, documentation, and status in one place instead of one spreadsheet per client.
The CMMC Program and What It Means for Managed Service Providers
CMMC is the Department of Defense (DoD) program that verifies whether companies in its supply chain actually protect Controlled Unclassified Information (CUI) and other sensitive data their contracts expose them to.
It represents a fundamental shift: instead of trusting contractors' claims, the DoD now checks.
MSPs enter the picture through one definition. The CMMC program treats external people, technology, or facilities that provide IT or cybersecurity services to a contractor as ESPs. If your services affect how a DoD contractor protects its data, that's you.
Being an ESP doesn't automatically create CMMC obligations of your own. It means your services are part of the story a client tells their assessor, and the details of your setup decide the rest.
Which CMMC Level Applies to Your Clients
The certification level a contract requires depends on the data involved, not on company size or industry. Federal Contract Information (FCI) means CMMC Level 1 and 15 basic controls, verified by self-assessment.
CUI means Level 2 and all 110 security controls from NIST 800-171. Since most MSP clients in defense work handle CUI somewhere, Level 2 is the level that shapes an MSP's obligations in practice.
Does Your MSP Need Its Own CMMC Level 2 Certification?
The honest answer is: it depends on where your clients' data lives and what your staff can touch. Three scenarios cover most MSPs.
When You Handle CUI on Your Own Systems
If client CUI sits on infrastructure you own, the calculus changes. Hosting a client's file storage, running backups that capture CUI, or operating a virtual desktop environment for defense clients all count as handling Controlled Unclassified Information for CMMC purposes.
The rule doesn't force you to pursue certification. But without your own CMMC status, your systems get examined inside every client's Level 2 assessment, one client at a time.
That's why many MSPs in this position pursue their own certification: a Level 2 assessment conducted by a Certified Third-Party Assessment Organization (C3PAO), accredited through the Cyber AB, formerly the CMMC Accreditation Body.
One assessment of your internal environment beats a dozen partial ones. A Final Level 2 status becomes a sales asset with every defense contractor you approach.
When You Only Manage Client Systems
Most MSPs live here. You administer client systems, run patching, and manage security services like endpoint detection or a Security Information and Event Management (SIEM) platform, but client CUI never lands on your infrastructure.
In this scenario, you don't need your own CMMC status. The tools and services you operate are assessed as part of the client's scope, often as Security Protection Assets, because they protect the environment even though they don't hold CUI.
You still have homework. Your access paths, your management tools, and your staff show up in the client's assessment, so your documentation and security measures need to hold up when their assessor looks.
When You're Not an ESP at All
Some engagements fall outside the ESP definition entirely. Temporary access, such as a penetration test, a vulnerability assessment, or incident response work, doesn't make you an ESP.
The same goes for staff augmentation where your people work entirely on the client's equipment and systems. In these cases, there are no CMMC requirements aimed at your organization.
What the Final Rule Changed for External Service Providers
Earlier drafts of the CMMC rule proposed mandatory certification for service providers, and many MSPs still believe that's the requirement. The final rule, published in October 2024, landed somewhere more practical.
Under the final rule, an ESP that isn't a cloud service provider is not required to obtain its own CMMC status. Instead, the client documents the ESP's services in its System Security Plan (SSP), and those services are assessed within the client's assessment.
What makes that work is documentation of shared responsibilities. A responsibility matrix spells out which security requirements you cover, which the client covers, and which you share, so the assessor can trace every control to an owner.
For MSPs, the practical takeaway is that your paperwork is now part of your service. Clients need clean descriptions of your services and data flows to meet their own CMMC compliance requirements.
How MSPs Fit Into a Client's CMMC Assessments
A client's assessment examines everything that processes, stores, or transmits CUI, as well as the assets that protect those systems. Your services usually enter through the second door.
Mapping the Assessment Scope
Remote monitoring and management (RMM) tools are the classic example. An RMM agent on a client's CUI systems gives your platform persistent access to their environment, which makes the tool, and your controls around it, relevant to their assessment.
The same logic reaches your people. Technicians with administrative access to client systems are subject to requirements such as access control and configuration management, and the client's assessor may want evidence of how that access is secured.
None of this requires panic. It requires knowing your own data flows: what you can reach, where credentials live, and which of your tools touch CUI systems. MSPs that can answer those questions quickly make their clients' assessments shorter.
Cloud Environments and FedRAMP Requirements
Cloud services follow a stricter rule. If a cloud offering is used to process, store, or transmit CUI, it must meet the Federal Risk and Authorization Management Program (FedRAMP) Moderate requirements or an equivalent standard.
That applies to the cloud environments you resell or manage for clients, from file sharing to email. Commercial-tier cloud storage that isn't FedRAMP authorized can't hold CUI, no matter how well configured it is.
For SaaS providers and MSPs bundling cloud services, this is the first thing to verify. Putting client CUI into a non-qualifying platform creates a compliance gap no amount of remediation elsewhere can offset.
Is CMMC Required Right Now?
Yes, in its first phase. CMMC requirements began entering new DoD contracts in November 2025, starting with self-assessments at Levels 1 and 2.
The next stage is on hold. In July 2026, the DoD suspended CMMC Phase 2, which was expected to bring third-party assessments to many contracts, pending a 60-day program review.
For MSPs, the suspension changes surprisingly little. Your clients still carry Phase 1 obligations, their contracts still require accurate self-assessments backed by a CMMC self-attestation, and their underlying duty to protect CUI predates CMMC entirely.
Prime contractors aren't waiting either. Many flow security requirements down to subcontractors and ask service providers for proof, review period or not.
If anything, the pause is the preparation window. Contractors that use it to close gaps will be ready for whatever the task force recommends, and they'll need service providers who can get them there.
Turning CMMC Readiness Into a Competitive Advantage
Every rule above describes an obligation. Each one is also a service a defense contractor will pay for, because most of the Defense Industrial Base (DIB) is small businesses without security teams.
The demand side is straightforward. Contractors need gap assessments, remediation, documentation, ongoing monitoring, and someone to keep their SSP honest between assessments. Those are MSP services with a compliance label.
They also need a guide. Most contractors face these compliance standards once; an MSP that has walked the compliance journey with multiple clients knows where the traps are, and that experience is billable.
MSPs that formalize this often become a CMMC Registered Practitioner Organization (RPO), the path for organizations that advise on CMMC readiness. Others simply build CMMC-aligned service tiers for their defense clients.
Either way, the differentiator is proof. An MSP that has achieved its own status, or supported clients through real CMMC assessments, sells from experience instead of a brochure.
How MotherBear Supports MSPs and Their DIB Clients
Supporting one defense client with spreadsheets is possible. Supporting ten that way is how evidence gets lost, controls drift, and assessments go sideways.
That's why MSPs building a compliance practice standardize early on CMMC compliance tools: one system for control status, evidence, documentation, and client communication, instead of a folder structure per client.
MotherBear was built for exactly this workload. Your team works from one workspace that keeps every client's evidence, documentation, remediation items, and assessment readiness organized, with day-to-day client coordination handled from the same place the work lives.
The result is a compliance practice that scales by adding clients, not headcount. That's how compliance turns from overhead into a growth engine.
Book a demo and see how MotherBear helps you achieve CMMC compliance for your clients, at scale.
FAQs About CMMC for MSPs
Does an MSP need to be CMMC-compliant?
Not automatically. Under the final rule, most MSPs are assessed within their clients' assessments rather than needing their own CMMC status. The main exception is an MSP that stores, processes, or transmits CUI on its own systems, which faces Level 2 requirements itself and usually benefits from an independent assessment.
Do the tools an MSP uses need to be CMMC-compliant?
Tools aren't certified on their own; they're evaluated within an assessment scope. Management and security tools that touch CUI systems must support the required controls, and any cloud service that processes, stores, or transmits CUI must meet FedRAMP Moderate or equivalent requirements. Verify tooling before an assessment does it for you.
Can Macs be CMMC-compliant?
Yes. CMMC requirements attach to how systems are configured, controlled, and documented, not to the operating system. A Mac environment with encryption, access control, logging, and the other required controls implemented and documented can be part of a compliant scope, the same as Windows or Linux.
Is CMMC now required?
Yes, in phases. Phase 1 has placed self-assessment requirements in new DoD contracts since November 2025. Phase 2, which was expected to add third-party assessments for many contracts, was suspended in July 2026 pending a program review, and self-assessment obligations continue during that period.
