MSPs Don’t Have to Be CMMC Certified: The ESP Paths Under the Rule
MSPs are not required to hold their own CMMC certification to serve DoD contractors. Per 32 CFR § 170.19(c)(2), the rule requires the OSC's System Security Plan to document the ESP relationship, describe the services, and reference a Customer Responsibility Matrix — not require ESP certification. An MSP can land on one of four scoping paths: (1) own Level 2 cert, (2) assessed as part of the customer's assessment, (3) genuinely out of scope, or (4) the staff-augmentation exception under the CMMC Scoping Guide Level 2. Most MSPs fit Path 2 — clean CRM, customer-led assessment, no separate certification.
