By William Price, Certified Lead CMMC Assessor (LCCA) — A³ Vallum CMMC Advisory
Most CMMC MSP vetting advice you will read online is generic. Look for experience. Ask about credentials. Get references. All true. But all unhelpful when you are sitting across from a confident sales engineer.
The more useful version of this advice is the one nobody writes down, the specific things MSPs say in discovery calls that should make you put your pen down. These are the patterns I see show up in client horror stories, and in conversations where a contractor realizes mid-engagement that their MSP was learning on their dollar.
The “you must hire our person as a W2 employee” claim
A real example. An MSP told their client that to comply with CMMC Level 2, the client had to hire the MSP’s ISSM engineer as a part-time W2 employee, or take over the monitoring themselves. There is no such requirement in the rule.
Continuous monitoring under CA.L2-3.12.3 can be performed by an External Service Provider, documented in the SSP and Customer Responsibility Matrix per 32 CFR, and assessed accordingly. The W2 demand is either a misunderstanding of the rule or a billing strategy dressed up as a compliance requirement.
What this tells you about the MSP: they have not actually read the assessment guide carefully, or they have read it and are using it to push you into a contract structure that benefits them. Either way, the next claim they make should be checked twice.
The “compliance in a box” pitch
If the sales pitch promises a packaged solution that “takes care of 100% of the controls” – usually some combination of a hardened VDI, an SIEM, and a managed M365 tenant – your skepticism should engage. CMMC Level 2 has 110 controls and roughly 320 assessment objectives in NIST SP 800-171A. No box covers all 320. The objectives that depend on documented procedures, training, incident response exercises, HR practices, and policy enforcement are not technical configurations and cannot be just dropped in.
A defensible MSP pitch acknowledges this. “Our platform addresses approximately X out of Y assessment objectives directly, and here is the list of objectives that remain your responsibility.” That sentence is the difference between an MSP who has done the work and one who has bought a marketing slide.
The “no GRC tool needed” claim
Sometimes true. Sometimes a tell.
An MSP can deliver a small CMMC engagement without a dedicated GRC platform, and they should not be billing you for a tool you do not need. But “we don’t need a GRC tool” said too quickly often means “we are going to track everything in a shared spreadsheet.” The spreadsheet works for one client. It does not work for five.
The right question is not whether they use a GRC tool. It is what their evidence pipeline looks like and how they will produce 320 objectives’ worth of artifacts on demand. If the answer is shrugging, your answer is no.
The “we’ll figure out the SSP later” timeline
Another real example. An MSP told the client they would deliver a CMMC Level 2 implementation roadmap, then spent months on “we are finishing it up” without producing it. The client was new, did not push hard, and lost a whole business quarter to vapor.
A defensible roadmap with a real gap analysis typically lands in two to four weeks. Past that window, you are watching an MSP either struggle with the scope or stall to keep billing the discovery phase. Either way, the conversation needs to escalate to whoever signed the SOW.
The “your existing tools cannot be used” pitch
This one is from a specific case where an MSP told a small contractor they had to get rid of a Synology NAS because the logs could not be ingested by the MSP’s SIEM. The real issue was the MSP’s preferred SIEM did not have a connector and the MSP did not want to build one. The contractor was being asked to throw away storage to save the MSP development effort.
This is a category – MSP recommendations driven by the MSP’s stack convenience rather than by the assessment guide. Watch for it whenever the recommendation is “rip out your existing tool and use ours” without a specific NIST SP 800-171A objective tied to it.
The “everyone needs GCC High immediately” claim
Most CMMC Level 2 environments handling CUI end up on GCC High. But not all of them. The analysis matters. An MSP that quotes you GCC High before they have scoped your CUI flows is selling licenses, not compliance. The right scoping conversation includes how much CUI you actually receive, where it lives today, who touches it, and whether the alternatives (like a non-Microsoft purpose-built CUI platform) would work for your specific environment.
How DIBFI handles this
Every red flag here traces back to the same root: the MSP cannot map the recommendation to a specific assessment objective. DIBFI keeps every control implementation tied to NIST SP 800-171A objectives, with evidence and a Compass-driven decision trail — so when an MSP recommends something, you can see immediately whether it is the rule talking or the sales pitch.
The “we are CMMC compliant” sales line
Compliance with CMMC is a binary state established by a C3PAO assessment, not a self-declared status. An MSP saying “we are CMMC compliant” without naming the assessment, the certifying C3PAO, the level achieved, and the assessment date is using the word loosely. Press for specifics. If they cannot produce them, the right phrasing is “we are working toward CMMC certification” or “we are positioned to be assessed in our clients’ scope.” The conversation should be honest about it.
What does the inverse look like?
A defensible MSP discovery call sounds different. Specific scoping questions before any pricing. A willingness to put a CCP or CCA on the engagement. An offer to share a redacted Customer Responsibility Matrix from a real client or their default proposed version. A clean answer about which assessment objectives their tooling addresses and which remain the client’s. A roadmap commitment with a fixed delivery window measured in weeks or months, not “soon.”
The bar is not perfection. The bar is honest specificity.
Frequently Asked Questions
Is “we’ll have you compliant in 60 days” ever true? For a Level 1 self-assessment with FCI only, possibly. For Level 2 with CUI, no. A defensible Level 2 readiness engagement is six to twelve months when starting from zero for most mid sized or larger environments, and longer is common.
Can an MSP guarantee my CMMC certification? No. Any MSP that does is overpromising. The C3PAO makes the certification decision based on assessor judgment per the CMMC Assessment Process v2.0. The MSP can put you in the best possible position to pass, but the guarantee is not the MSP’s to give.
What if the MSP refuses to sign the Customer Responsibility Matrix? Walk. Without a signed CRM, you have no documented allocation of responsibility, no clean evidence trail, and no defensible answer when the assessor asks who owns what.
How do I verify an MSP’s CCP or CCA credentials? The Cyber AB maintains a marketplace and credential lookup. CCPs and CCAs are listed by name. Ask which named individual will be on your engagement and verify them.
Is being on the Cyber AB Marketplace a guarantee of quality? No. It is a baseline of accountability. The MSPs that pass clients through C3PAO assessments cleanly are usually on the marketplace. The marketplace listing alone is not a quality bar.
Closing thought
The contractors that we’ve seen get burned are the ones who skipped due diligence. They simply did not know which questions to ask. Every red flag above showed up because someone trusted the sales pitch over the assessment guide. Before your next MSP discovery call, which two of these would you actually surface in the first conversation?
A³ Vallum helps defense contractors vet CMMC MSPs and provide a white-label CMMC backend for MSPs that want to deliver real CMMC services without bluffing through a discovery call.
About DIBFI
DIBFI is a guided CMMC readiness platform that takes contractors from scoping through certification on a phased, gated journey — real-time guidance, all 320+ Level 2 objectives tracked, an interactive SSP Builder, and “Ask an Assessor” when you need a CCA’s read on a specific control.
Sources
- 32 CFR Part 170 — CMMC Program rule, particularly § 170.19(c)(2)
- CMMC Assessment Process (CAP) v2.0, December 2024, The Cyber AB
- NIST SP 800-171 Revision 2
- NIST SP 800-171A — assessment objectives
- Cyber AB Marketplace and RPO/CCP/CCA credentialing
