This is the question that lands in my inbox almost every week, usually from an MSP whose client just had a contract drop CMMC into their lap. The MSP reads a few blog posts, listened to some FUD (Fear, Uncertainty, and Doubts) webinars, and now thinks they have to spend six figures and 18 months getting their own CMMC Level 2 certification — or lose the client. They almost never have to. The FUD marketing in the CMMC ecosystem has done a remarkable job of muddying this point.
The actual rule gives MSPs more options than the marketing pages let on. Here is what the rule says, with the citations, so you can have an honest conversation with your client about which path your engagement actually fits.
The four ESP paths at a glance
The H2 sections that follow walk each path in detail.
What the rule actually says about ESPs
The regulatory authority for MSPs in CMMC is 32 CFR § 170.19(c)(2). MSPs are External Service Providers (ESPs) under the rule — entities that provide services to an Organization Seeking Assessment (OSA) but are not the OSA itself.
The rule does not require ESPs to hold their own CMMC certification. It requires the OSA’s System Security Plan to:
- Document the use of the ESP
- Describe the relationship between the ESP and the OSA
- Reference the ESP’s service description and the Customer Responsibility Matrix (CRM)
That is the obligation. Not “the MSP must be Level 2 certified.” The obligation is documentation and CRM clarity.
Where the path-dependent expectation comes from is the Level 2 Scoping Guide. The Scoping Guide and DoD CIO guidance lay out three paths — and the staff-augmentation rule adds a fourth — for how an ESP can land in scope.
Path 1 — The MSP holds its own CMMC Level 2 certification
The cleanest path on paper. The MSP gets its own assessment, achieves Level 2 (Self-Assessment or Certification depending on Defense OIG status), and the customer’s SSP references the MSP’s certification.
When this makes sense:
- MSP serves multiple CMMC clients and wants a single assessment to cover all of them to ease the burden of participating in their client assessments
- MSP wants to differentiate in the market as a “CMMC-ready” provider
- MSP is large enough that the cost of one assessment is amortizable across the client portfolio
When it does not:
- MSP serves one or two CMMC clients and the cost is hard to justify
- MSP’s tooling and architecture are not ready and will not be for 12-18 months
- The MSP can serve clients adequately via Path 2 or 3
Path 2 — The MSP is assessed as part of the customer’s assessment
This is the common path in practice. The customer’s C3PAO assessment includes a walk-through of the MSP’s tools, processes, and people as they relate to the customer’s environment. The MSP does not get its own certificate — the customer does, and the MSP’s contribution is part of what the C3PAO evaluates.
When this makes sense:
- MSP only touches Security Protection Assets (RMM, SIEM, password vault, EDR) for the customer
- The customer’s CMMC certification is the priority; the MSP wants to support without dedicating resources to its own cert
- MSP serves CMMC clients sporadically — one or two
The trade-off is real. The MSP has to participate in every customer’s C3PAO assessment. If you have ten CMMC clients and they each have a separate assessment, you are walking through your environment ten times. That is why MSPs with significant CMMC exposure eventually move to Path 1.
Path 3 — The MSP is genuinely out of scope
The narrowest path. The MSP provides services to the customer that do not touch CUI and do not provide security protection to CUI Assets. Maybe the MSP only handles the customer’s non-CUI tenant, only does printer setup and break-fix, or only provides web design.
When this makes sense:
- MSP genuinely does not touch the CUI environment
- The customer’s CMMC scope can be drawn around the MSP’s services without including them
The risk is high though. Contractors and assessors are skeptical of “out of scope” claims. The MSP has to be ready to defend the conclusion in writing — what the MSP does, what they do not do, what tools have credentials on the CUI environment, what the access boundary actually is. Half-baked out-of-scope claims fail at Phase 1 of the C3PAO assessment.
Path 4 — The staff-augmentation exception
The Scoping Guide L2 carves out a specific exception for ESPs that function as staff augmentation — where the ESP provides labor only, and the OSA owns all the processes, technology, and facilities the ESP uses. In this case, the ESP can be treated as effectively part of the OSA’s environment, with the OSA’s controls covering the ESP’s work.
When this fits:
- MSP provides W-2 or 1099 personnel who work inside the customer’s environment
- Customer owns the laptops, the tooling, the policies, the SSP
- MSP’s role is functionally a staffing arrangement, not a managed-service arrangement
When it does not:
- MSP brings any of their own tooling — RMM, SIEM, ticketing — that breaks the staff-aug profile
- MSP runs processes the customer does not own (patch management, monitoring, IR)
This is the cleanest path for MSPs whose engagement is genuinely a staffing model. It is almost never the path for traditional managed services.
DIBFI for MSPs
DIBFI’s multi-tenant architecture supports MSPs operating across all four ESP paths — single-cert MSPs, in-scope-with-customer MSPs, and out-of-scope or staff-aug arrangements. The CRM and SSP language adapts to the path you are actually on.
How the CRM defines which path you are actually on
The Customer Responsibility Matrix is what tells the C3PAO which path the MSP is on. For each of the 320 NIST SP 800-171A assessment objectives, the CRM names the responsible party — OSA, ESP, or shared.
If the CRM says “ESP responsible” for AC.L2-3.1.5 (least privilege) and the MSP is the ESP, the MSP is in scope for that objective. If the CRM says “OSA responsible,” the MSP is not.
The CRM is the boundary contract. A vague CRM defaults the MSP into “in scope for everything,” which is the most expensive position. A precise CRM scopes the MSP exactly to what they actually do, which usually means a much smaller assessment burden.
This is the artifact a lot of MSPs underbuild. Marketing-grade CRMs that say “shared responsibility” across every row do not survive C3PAO review. Objective-level CRMs with named owners, evidence references, and dated reviews do.
Common mistakes
1. Assuming you need certification because a vendor told you so. Many CMMC vendors have a financial interest in MSPs pursuing certification. Read the rule, talk to a CCA, and pick your path based on the actual rule and the actual engagement.
2. Misclassifying as Path 3 when you are really Path 2. Most MSPs with RMM, SIEM, or password vault access touch Security Protection Assets. They are not out of scope. They are in scope as part of the customer’s assessment. The misclassification surfaces at Phase 1 of the C3PAO walk and produces weeks of delay.
3. Treating Path 4 (staff aug) as a fallback when you cannot fit Path 2 or 3. The staff-aug exception is narrow. If your MSP brings any tooling, runs any processes, or owns any facilities, you do not fit. Misclaiming staff-aug status to dodge Path 2 is a finding.
4. Building a Path 2 engagement on a Path 1 CRM. Some MSPs build CRMs as if they were certified themselves — claiming responsibility for full controls — when they should be on a customer-led assessment with a customer-led CRM. The result is confusion at assessment about who actually owns what.
Frequently Asked Questions
Does my MSP have to be CMMC-certified to serve a DoD contractor? No. Per 32 CFR § 170.19(c)(2), the rule requires ESP documentation in the customer’s SSP, not ESP certification. Whether your MSP needs its own certification depends on which of the four paths you are on.
If my MSP is on Path 2, does the C3PAO assess my whole environment? The C3PAO assesses the parts of the MSP’s environment that touch the customer’s CUI or provide security protection to it. Not the whole MSP business. The CRM tells the C3PAO what to walk.
Can my MSP claim Path 3 (out of scope) just because we do not have admin credentials on the CUI tenant? Not on its own. The Scoping Guide test is whether the MSP processes, stores, or transmits CUI, OR provides security protection to CUI Assets. If the MSP touches the customer’s identity layer, RMM, SIEM, or any CUI-related tooling — even without admin on the CUI tenant — that is still security protection. Out of scope means “genuinely not connected to the CUI environment.”
Is the staff-aug exception in the original 32 CFR Part 170, or is it newer? The staff-augmentation framing is in the CMMC Scoping Guide Level 2 (v2.13) and DoD CIO guidance. It is a clarification of how to apply the rule, not a separate rule path. Read the Scoping Guide for the current version.
My customer’s prime is telling them their MSP must be Level 2 certified. Is that true? Not by the rule. Some primes flow stricter requirements than the rule requires — that is a contracting decision, not a CMMC requirement. The customer can push back, ask the prime for the contract clause, and look for the actual rule citation.
How do I document the path my MSP is on in the customer’s SSP? Per 32 CFR § 170.19(c)(2): the SSP names the ESP, describes the services, references the ESP’s service description, and references the CRM. The path (1, 2, 3, or 4) is implicit in how the CRM is structured and how the services are described. The C3PAO will ask the customer which path the MSP is on; the documentation should answer cleanly.
Closing thought
MSPs who handle CMMC should read the rule before they read the marketing. The rule gives you four paths. Many MSPs land on Path 2 — assessed as part of the customer’s assessment, with a clean CRM defining the boundary. A few choose Path 1 because they have the volume to justify it. A handful genuinely fit Path 3 or Path 4. None of those paths require six figures of preemptive cert work for an MSP that just wants to serve their CMMC client well. So before your next CMMC conversation figure out which path your engagement actually fits, and whether the CRM you have right now reflects that path?
A³ Vallum runs ESP scoping engagements for MSPs supporting CMMC clients. If your MSP is hearing conflicting advice on whether you need to certify, reach out for a CCA’s read on the path that actually fits your engagement.
About DIBFI for MSPs
DIBFI is a multi-tenant CMMC readiness platform built for MSPs and consultants. White-label by design, with SSP builders, CRMs, evidence lockers, and “Ask an Assessor” guidance built in. Manage scope, evidence, POA&Ms, and assessment readiness across your entire client portfolio in one place.
Sources
- 32 CFR Part 170 — CMMC Program rule, particularly § 170.19(c)(2) (ESP documentation) and § 170.17 (Level 2 Certification)
- CMMC Assessment Scope – Level 2, v2.13 (September 2024), DoD CIO (DoD-CIO-00006) — ESP scoping paths and staff-augmentation exception
- NIST SP 800-171 Revision 2 — security requirements
- NIST SP 800-171A — assessment objectives (the basis of the 320-row CRM)
- DFARS clause 252.204-7012 — Safeguarding Covered Defense Information
- DFARS clause 252.204-7021 — Cybersecurity Maturity Model Certification Requirements
- DoD CIO Memo, December 21, 2023, “FedRAMP Moderate Equivalency for Cloud Service Providers”
- Cyber AB CCA-led guidance on ESP categorization
