Why CMMC Reaches Your MSP
CMMC reaches a long way down the supply chain. A machine shop with a defense subcontract is in scope, which means the MSP running its network is too, because your tools and your admins touch the systems where controlled information lives. The requirement arrives as a condition of the client keeping work they already have, not as a new opportunity, and the program rule that sets it up took effect in December 2024.
For an MSP that means two questions at once: can you help the client get ready, and does your own environment hold up when an assessor asks how your remote access into theirs is controlled.
Timing matters too. Requirements appear in contracts in phases, starting with self assessments and moving to certification, so a client who is fine today may need an assessor next year. Ask defense clients which level their contracts will call for and when, and put the answer on the roadmap you review with them, because remediation on a mature network takes longer than most owners expect.
How the Levels Differ
| Level | What is assessed | Who assesses |
|---|---|---|
| Level 1 | Basic safeguards for federal contract information | The contractor, as a self assessment |
| Level 2 | The NIST SP 800-171 requirements for controlled unclassified information | Self assessment or an accredited third party, depending on the contract |
| Level 3 | Additional NIST SP 800-172 requirements | Government assessors |
Most defense work that involves controlled information sits at Level 2, and the jump from self assessment to third party assessment is where the real cost lands, for the client and for the MSP supporting them.
The Mistakes That Make It Expensive
The common trap is scoping late. What is in scope depends on where controlled information actually lives, and a flat network that has never been segmented puts everything in scope by default. MSPs that do the segmentation first assess a small enclave; MSPs that leave it assess the whole estate.
- Scope first: map where controlled information is stored, processed and sent before buying anything.
- Tighten your own access: shared admin logins fail quickly, so remove them early (see why shared admin accounts go first).
- Document as you go: assessors want evidence that controls operated, not a policy written the month before.
- Price it as a project plus a higher run rate, because the evidence keeps being produced after the assessment.
Many of the controls overlap with zero trust and SOC 2 work, so an MSP building one practice can often reuse the evidence habits for the others.
Common Questions
Does my MSP need its own CMMC certification?
It depends on whether your systems store, process or transmit the client's controlled information and on what the contract requires. Many MSPs serving defense clients are asked to show they meet the same level.
Can I use commercial Microsoft 365 for CUI?
This is a contract and data question to settle with the client and their assessor. Many defense clients move controlled information into a government cloud tenant to simplify scope.
Is CMMC the same as NIST SP 800-171?
No. NIST SP 800-171 defines the requirements; CMMC is the program that checks whether a contractor actually meets them.
How should I price CMMC readiness work?
As a scoped project for gap assessment and remediation, followed by a higher monthly rate for the ongoing evidence and control operation.