Do MSPs and MSSPs Need Their Own CMMC Assessment?

MSP/MSSP Assessment Rules

If you outsource IT or security to managed service providers, understanding how they fit into your CMMC assessment is critical.

Key Rule: ESPs Are Assessed Through Your Assessment

Managed Service Providers and Managed Security Service Providers are classified as External Service Providers (ESPs) under CMMC. They are assessed as part of your assessment scope — they don't need their own separate CMMC certification.

Practical Implications

• Your MSP's controls are your responsibility: If your MSP manages your CUI environment, their security controls are evaluated during your assessment
• Your MSSP is in scope too: Security tools and monitoring managed by your MSSP are part of your assessment boundary
• No separate cert required: ESPs don't need their own CMMC certificate
• Optional self-certification: MSPs may choose to get their own CMMC certification to simplify their clients' assessments

What to Ask Your MSP/MSSP

Before your assessment, verify that your MSP/MSSP can demonstrate compliance with the applicable NIST SP 800-171 requirements that fall within their responsibility. Get documentation of their security controls, as your assessor will need to evaluate them.