Does my MSP need CMMC? Scope rules for MSPs, MSSPs and cloud providers

Start with the service. “MSP,” “MSSP,” and “SOC” describe a business or function, but they do not settle the assessment boundary.

An outsourced help desk, security monitoring service, and hosted application may require different treatment even when one company sells all three. Draw those services separately before asking whether the provider has a certificate.

The provider scope table

32 CFR 170.19(c)(2) uses two questions: whether the provider is a cloud service provider, and whether its service handles CUI or security protection data, commonly shortened to SPD.

Table 4 scopes the relevant services. This does not automatically place every system in the provider’s business inside the customer’s boundary.

SPD needs attention even when a provider says it never reads contract drawings. The DoW CIO FAQ, section E, addresses separate MSP and MSSP arrangements. Security services can matter to the assessment without holding the underlying CUI.

For the boundary record itself, use the CUI scoping guide.

Does the MSP need its own CMMC assessment?

A non-cloud MSP isn’t required to obtain its own CMMC assessment merely because it provides an in-scope service. Section E-A3 of the DoW CIO FAQ allows the MSP to elect its own assessment and explains how its services are addressed when it hasn’t done so.

The current FAQ’s E-A3 is explicit:

The MSP is not required to have its own CMMC assessment

Evidence is still needed. A provider’s lack of a standalone certificate does not remove the service from scope, and a certificate cannot describe every service sold under that provider’s brand.

Before relying on a provider’s assessment, compare the assessed boundary and services with the work being purchased. Record any gaps. The RPO, MSP and C3PAO role guide can help separate implementation support from assessment roles.

When is an MSP also a cloud provider?

The DoW CIO FAQ’s E-A5 looks at the relationships among the customer, MSP, and cloud provider. If the cloud tenant is subscribed or licensed to the organization seeking assessment, the MSP is not the CSP merely because it resells the service. If the MSP contracts with the CSP and modifies the basic cloud service, it may be a CSP.

“May” matters here. Classify the arrangement from the contract and service design. A reseller invoice alone is insufficient.

Request the subscription owner, service description, contract chain, and a diagram showing who operates each component. Then determine whether the organization is buying administration of its own tenant or a distinct cloud service from the MSP.

Cloud services holding CUI

DFARS 252.204-7012(b)(2)(ii)(D) requires the contractor to require and ensure that a cloud provider handling covered defense information meets security requirements equivalent to the FedRAMP Moderate baseline. The clause also addresses the provider’s compliance with paragraphs (c) through (g), covering incident reporting and related cooperation.

The CMMC FAQ identifies authorization and the Department’s equivalency requirements as routes to meeting the cloud baseline. A sales statement that a platform is “government ready” is insufficient evidence.

Identify the exact offering, boundary, and applicable supporting evidence. Customer configuration responsibilities still need owners.

Worked example: three providers, one contractor

This hypothetical example shows why the contract name alone is insufficient.

A manufacturer subscribes to a cloud tenant in its own name. An MSP administers the tenant. A separate MSSP receives security monitoring data. Assume the tenant stores CUI and the monitoring service handles SPD without CUI.

This is a starting classification, not a completed scope determination. If investigation shows that monitoring records contain CUI, the third row needs reconsideration.

In Deep Fathom’s view, the useful discovery question is “What information does this service actually receive?” Ask the operator who can demonstrate the data flow.

Build the responsibility record before the assessment

The program rule calls for the service relationships and responsibilities to be documented. Use a customer responsibility matrix with the system security plan. Our suggested working fields are:

1. Service and boundary, including the information handled.
2. Security requirement and the party operating the implementation.
3. Customer configuration or oversight duties.
4. Evidence the provider will make available, and how access will work.
5. Incident contacts, response duties, and escalation arrangements.
6. Changes that trigger a scope review, such as a new tenant or data feed.

The shared responsibility guide develops that allocation. A contract that says only “security included” leaves the practical questions open.

An offshore provider or international support team needs a separate review of access permissions, applicable export restrictions, and contract conditions. The CMMC scope table alone cannot establish whether a particular cross-border arrangement is permitted.

The pause does not answer the provider question

As of September 30, 2026, the DoW CIO program page says Phase II is suspended and the program remains in Phase I. That status belongs in assessment scheduling decisions. It does not establish that a contractor’s cloud, safeguarding, or incident-response obligations have disappeared.

Keep reviewing services against the contract and information flows. For a discussion with Deep Fathom, send a non-sensitive outline through contact: services used, tenant ownership, information categories, and the unresolved scope question. Don’t include CUI or credentials.