NeoSystems Closure
What public reports say happened at NeoSystems on Friday, May 1, 2026 — and how A³ Vallum is set up to assist DIB contractors affected by the fallout. No inside information, no legal advice.
Does Your MSP Need to Be CMMC Certified to Keep Your DoD Contract?
An MSP serving a DoD contractor with CMMC requirements is not required by 32 CFR Part 170 to hold its own CMMC certification. The rule requires the contractor's SSP to document the ESP relationship, describe the services, and reference a Customer Responsibility Matrix per 32 CFR § 170.19(c)(2) — not ESP certification. Most MSPs land on one of three viable paths: hold the cert (when serving multiple CMMC clients), get assessed as part of the customer's assessment (the common path), or remain genuinely out of scope (narrow). Pick the path that fits the engagement, document it cleanly, and you keep the contract without the six-figure preemptive cert work.
