By William Price, Certified CMMC Assessor (CCA) — A³ Vallum CMMC Advisory
This is the question that lands in primes and subs across the defense industrial base every quarter, usually right after a flowdown email arrives or an MSP renewal hits the desk. The short answer is MSPs do not necessarily need to be CMMC certified. But it is more nuanced than the marketing pages suggest. The longer answer is the one that actually keeps your contract.
Does the rule require my MSP to be CMMC certified?
No. 32 CFR does not require External Service Providers to hold their own CMMC certification. What 32 CFR § 170.19(c)(2) requires is that the MSP either be certified at the same level as the contractor, or be assessed as part of the contractor’s assessment, or fall outside scope entirely if they do not touch CUI or security-protection assets.
So three legitimate paths exist. The MSP holds its own Level 2 certification. The MSP is assessed alongside you when your C3PAO does your assessment. Or the MSP is genuinely out of scope because they only do non-CUI work and have no security-protection role. The Scoping Guide also carves out a fourth case as an exception: an ESP used as staff augmentation, where the Organization Seeking Assessment (OSA) provides all processes, technology, and facilities.
Which path applies to your specific MSP?
Whichever one is documented in your System Security Plan and reflected in your Customer Responsibility Matrix. That is the operational answer. The legal answer is whichever one is supported by what the MSP actually does in your environment.
If your MSP runs your firewall, manages your endpoints, holds privileged credentials in their credential vaults, or ingests logs from your CUI environment, they are touching Security Protection Assets as defined by the CMMC Scoping Guide. They are in scope. The only question is which of the first two paths they are on.
If your MSP does other tasks like printer setup and break-fix on non-CUI workstations, they may genuinely be out of scope. That conclusion needs to be defensible in writing though.
What happens if my MSP is in scope but not certified and not assessed alongside me?
You fail.
The C3PAO reviews the environment, finds that the MSP touches Security Protection Assets, asks for the evidence, and you cannot produce it because there is nobody documented who owns what. Whatever objectives the MSP was supposed to support become findings against you.
This is the failure mode we see most often, and it is the one that is most preventable. The fix is not necessarily the MSP’s certification status. The fix is documentation — an explicit declaration in the SSP of which path the MSP is on, a Customer Responsibility Matrix (CRM) mapping the assessment objectives, and a written commitment from the MSP that they will produce evidence to the C3PAO. The MSP only has to provide evidence for the controls they handle and any of their systems that are used.
How DIBFI handles this
DIBFI builds the SSP, CRM, and evidence trail that proves the path your MSP is on — mapped to the actual NIST 800-171A assessment objectives, not a marketing matrix.
Are primes starting to require certified MSPs?
Yes, but unevenly. Some primes — particularly the larger primes with mature CMMC compliance teams — are starting to require subs to use CMMC-certified MSPs as a flowdown clause under DFARS 252.204-7021. Most are silent, and the requirement just inherits from the underlying CMMC rule.
What that means in practice: if your contract or master subcontract agreement is going to be renewed or modified in the next twelve months, read the flowdown carefully. The clause “subcontractor shall ensure all external service providers are CMMC certified at the appropriate level” is a different requirement than the underlying rule. Complying with it requires either a certified MSP or a renegotiated scope.
Is my MSP “CMMC compliant” or “CMMC certified”?
Different things. “Compliant” is a marketing word that an MSP can claim about itself. “Certified” is a status conferred by a C3PAO after a Level 2 assessment, listed on the Cyber AB Marketplace.
If your MSP says they are “CMMC compliant” but cannot give you a certifying C3PAO name, an assessment date, and a Cyber AB Marketplace listing, they are not certified. They may still be a perfectly defensible MSP under the second path — assessed alongside you in your scope. The language matters because the language ends up in your SSP, in your contract response, and eventually in front of an assessor.
What should I actually ask my MSP?
Here are three questions to get answers to in writing from an MSP or one that you are considering.
- Which of the three paths under 32 CFR § 170.19(c)(2) are you on for our environment?
- Will you contractually commit to producing evidence to our C3PAO during our assessment, including the evidence required to test the objectives you implement and participate in interview or testing requirements?
- When did you last review the CRM for our environment, and can you walk me through it?
If the answers are clean, the MSP is probably fine and the certification question is largely a marketing distraction. If the answers are vague, have a documentation problem that no piece of paper from a C3PAO will solve.
What if I want a certified MSP anyway?
This is a reasonable ask. The benefits are real.
A certified MSP simplifies your assessment because the C3PAO has fewer parties to coordinate with, simplifies your contract response because flowdown clauses get easier to satisfy, and signals to your prime that you have addressed the supplier risk.
The cost is real too. Certified MSPs charge premiums of fifteen to forty percent over uncertified equivalents. Supply is constrained as well at this time. Switching MSPs mid-engagement can cost four to twelve weeks of operational disruption. The decision should weigh those costs against the marginal compliance benefit relative to a well-documented in-scope arrangement with your existing MSP.
Frequently Asked Questions about MSPs Needing to be CMMC Certified
Will my CMMC assessment fail if my MSP is not certified? Not because they are uncertified. It will fail if the MSP is in scope and the documentation does not allocate responsibility cleanly, or if the MSP cannot or will not produce evidence to the C3PAO.
How do I verify an MSP’s CMMC certification? The Cyber AB Marketplace lists certified organizations. If the MSP is not on the marketplace as an RPO and cannot name a certifying C3PAO and an assessment date, they are not certified.
Can an uncertified MSP support multiple Level 2 contractors? Yes, by being assessed alongside each client under 32 CFR § 170.19(c)(2), governed by a customer responsibility matrix specific to that client’s environment. This is the most common model in the market right now.
My prime is requiring a certified MSP. Do I have to switch? Not necessarily — you may be able to negotiate the flowdown clause, document a path where your existing MSP becomes certified during your contract term, or transition to a certified provider for the in-scope portion of your environment only. Read the clause carefully and respond before the renewal deadline.
Does using GCC High mean my MSP is automatically compliant? No. GCC High is one piece of the architecture. The MSP still needs to be on one of the three paths above. The documentation still has to allocate responsibility for the assessment objectives.
Closing thoughts
The question “does my MSP need to be CMMC certified” is the wrong question for most contractors. The right question is “which of the three legitimate paths is my MSP on, and is it documented well enough to survive an assessor.” Which of those three paths is your MSP currently sitting on, and when did you last open the SSP to confirm it?
A³ Vallum helps defense contractors evaluate MSP scope decisions and walks their SSP and CRM with a CCA’s eye. We also offer a white-label CMMC backend for MSPs that want a clean third path. Reach out if you want a read on your specific situation.
About DIBFI
DIBFI is a guided CMMC readiness platform that takes contractors from scoping through certification on a phased, gated journey — real-time guidance, all 320+ Level 2 objectives tracked, an interactive SSP Builder, and “Ask an Assessor” when you need a CCA’s read on a specific control.
Sources
- 32 CFR Part 170 — CMMC Program rule, particularly § 170.19
- CMMC Assessment Scope – Level 2, v2.13 (September 2024), DoD CIO (DoD-CIO-00006)
- NIST SP 800-171 Revision 2
- NIST SP 800-171A
- DFARS clause 252.204-7012
- DFARS clause 252.204-7021
- Cyber AB Marketplace (cyberab.org)
