CompTIA Trustmark for MSPs

Last updated: April 2026

Affiliate Disclosure: We may earn a commission when you purchase through our links. This does not affect our editorial independence.

Quick Answer

CMMC is a three-tier model, with Level 1 applying to about 140,000 DIB companies.
MSPs must pursue CMMC Level 2 certification if they store, process, or transmit CUI on their own systems.
Failing CMMC compliance can lead to contract loss and suspension from defense work.
CMMC Level 2 has 110 security requirements.

Managed Service Providers (MSPs) serving the U.S. defense sector face strict new requirements under the Cybersecurity Maturity Model Certification (CMMC). This framework, developed by the U.S. Department of Defense (DoD), ensures that all contractors and subcontractors, including MSPs, meet specific cybersecurity standards to protect sensitive government data. If an MSP handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) for a defense contractor, it falls under CMMC scope. For example, CMMC Level 1 applies to approximately 140,000 Defense Industrial Base (DIB) companies, while Level 2 applies to about 75,000 DIB companies Technical Application of CMMC Requirements. This means MSPs must often achieve their own CMMC Level 2 certification, especially if they store, process, or transmit CUI on their own systems, not just administer a client's systems. Non-compliance carries severe penalties, including loss of contracts and reputational damage within the defense community.

What is CMMC and Why Does It Matter for MSPs?

The Cybersecurity Maturity Model Certification (CMMC) is a program established by the U.S. Department of Defense (DoD) to strengthen cybersecurity across its vast Defense Industrial Base (DIB). Its primary goal is to enforce stringent security standards for all contractors and subcontractors handling sensitive government data, particularly Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) CMMC Requirements for MSPs: Complete Compliance Guide. This framework is designed to stop data leakage and intellectual property theft by adding third-party verification, ensuring that companies actually implement the security controls they claim to have in place. Before CMMC, contractors would self-attest to their security posture, which proved insufficient in protecting critical defense information.

CMMC is not a new set of completely distinct requirements; rather, it evolved from the existing NIST SP 800-171 requirements. It builds upon this foundation by adding a verification component, making compliance a mandatory condition for contract awards that involve FCI or CUI. The program helps to address the critical need for a unified standard across the DIB, where even the smallest subcontractors can become targets for cyberattacks aimed at gaining access to DoD data. The defense supply chain is only as strong as its weakest link, and CMMC aims to fortify every part of that chain.

The Role of MSPs in the Defense Ecosystem

Managed Service Providers (MSPs) play a crucial role within the defense industrial base, often acting as extensions of their clients' IT departments. MSPs manage networks, systems, and cloud services for their defense contractor clients. Because of this, they frequently have privileged access to contractor environments that may contain CUI. This direct access means MSPs are not exempt from CMMC requirements; in fact, they must meet the same security standards as their defense contractor clients.

The DoD views MSPs as critical links in the defense supply chain. If an MSP has administrative access to a client's systems that contain CUI, even if the MSP doesn't directly store that CUI on its own infrastructure, it still falls under CMMC scope. This is because privileged access itself represents a potential vulnerability if not properly secured. The security posture of an MSP directly impacts the CMMC compliance status of its defense contractor clients. Therefore, understanding and achieving CMMC compliance is not just a regulatory hurdle for MSPs; it is a fundamental business requirement for any provider serving the defense sector.

From NIST SP 800-171 to CMMC

The Cybersecurity Maturity Model Certification program did not appear out of thin air. It evolved directly from the NIST SP 800-171 requirements. NIST SP 800-171 outlines security requirements for protecting CUI in non-federal systems and organizations. While NIST SP 800-171 provided a robust set of controls, the DoD found that self-attestation alone was not sufficient to ensure widespread implementation and effectiveness of these controls. Many contractors claimed compliance but did not fully implement the necessary safeguards, leading to vulnerabilities that adversaries could exploit.

CMMC addresses this gap by adding a third-party verification component. This means that for certain levels of CMMC, an independent CMMC Third-Party Organization (C3PAO) will assess a contractor's (or MSP's) implementation of security controls. This shift from self-attestation to verified compliance is a significant change, designed to ensure that the security controls are not just on paper but are actively and effectively protecting CUI. The program ensures that contractors actually implement the security controls they claim to have in place. This evolution signifies the DoD's commitment to a more rigorous and verifiable cybersecurity posture across the entire DIB, making CMMC compliance for IT providers a non-negotiable aspect of doing business with the DoD.

When Do MSPs Need Their Own CMMC Level 2 Certification?

Managed Service Providers (MSPs) must pursue their own CMMC Level 2 certification in specific scenarios, particularly when they directly handle or have privileged access to Controlled Unclassified Information (CUI). The determination of whether an MSP needs its own certification depends on the nature of the services provided and how CUI is managed or accessed. This is a critical distinction, as many MSPs previously believed they were exempt, even when their defense contractor clients handled CUI. However, this understanding shifted after clarifications from the Cyber-AB.

Defining CMMC Scope for MSPs

An MSP is considered to be within CMMC scope if it performs certain actions related to CUI on behalf of a defense contractor client. This includes, but is not limited to, storing CUI data on its own infrastructure, transmitting sensitive information between systems, or processing contractor data that includes CUI. Furthermore, an MSP is in scope if it has privileged access to client systems containing CUI, even if the data itself is not stored on the MSP's systems. This privileged access means the MSP can potentially view, alter, or otherwise interact with CUI, making its security posture directly relevant to the client's compliance.

For example, if an MSP manages a remote monitoring and management (RMM) tool that collects data from a client’s CUI environment, that MSP is in scope. The data collected by the RMM tool, if it includes CUI, would then be subject to CMMC requirements on the MSP's systems. Similarly, if an MSP acts as an administrator for platforms like Microsoft GCC High or PreVeil, and their administrative access includes client emails or documents containing CUI, they are also in scope for CMMC Level 2. These scenarios highlight that the interaction with CUI, whether through storage, processing, transmission, or privileged access, triggers the CMMC compliance obligation for the MSP.

Clarifications from the Cyber-AB

The necessity for MSPs to obtain their own CMMC Level 2 certification was clarified by Matt Travis, CEO of the Cyber AB, during a May Cyber-AB Town Hall. Mr. Travis explicitly stated that "If an ESP (that is not a Cloud Service Provider) is storing, processing, or transmitting CUI on their own systems—not just administering someone else’s systems—then they require their own Level 2 CMMC certification." This statement marked an important shift for the industry, emphasizing that MSPs and other External Service Providers (ESPs) are not automatically exempt from certification simply because they are service providers.

This policy means that MSPs can no longer rely solely on their clients' CMMC certifications to cover their own operations if they handle CUI on their own infrastructure. If an MSP fails to obtain its own independent CMMC Level 2 certification when required, it faces significant challenges. It would be assessed in addition to the customer’s assessment, effectively requiring a second assessment each time one of its customers gets assessed When do MSPs need to be CMMC compliant?. This dual challenge requires MSPs to pursue their own compliance journey while continuing to advise their clients on theirs. The implications are clear: MSPs must understand their exact role in handling CUI and proactively seek certification if their activities fall within the defined scope.

Independent Assessment vs. Client Assessment

The distinction between an MSP being assessed independently versus being assessed with a client is crucial. If an MSP stores, processes, or transmits CUI on its own systems, it must undergo a CMMC Level 2 assessment independently from its clients. This independent assessment ensures that the MSP’s own environment, which handles sensitive data, meets the rigorous security standards. This is different from a scenario where an MSP might only provide general IT support without privileged access to CUI or without storing/processing CUI on its own infrastructure.

In cases where an MSP provides only general IT support and does not handle FCI or CUI, it may be out of scope entirely for CMMC. However, the moment an MSP's services involve direct interaction with CUI, whether through administrative access, hosting, or data processing, the requirement for its own CMMC Level 2 certification becomes clear. This ensures that every entity in the defense supply chain that touches CUI is held accountable to the same high cybersecurity standards, preventing potential vulnerabilities from propagating through the network of contractors and service providers. The CMMC program exists to enforce strict cybersecurity standards across the Defense Industrial Base (DIB).

What Are the Consequences of Non-Compliance?

Failing to meet CMMC standards can have severe and far-reaching consequences for Managed Service Providers (MSPs) and their defense contractor clients. The U.S. Department of Defense (DoD) created CMMC to enforce strict cybersecurity requirements, and non-compliance is taken very seriously, impacting business operations, client relationships, and an MSP's reputation within the defense sector. The defense supply chain depends on every link maintaining strong cybersecurity.

Loss of Contracts and Business Opportunities

One of the most immediate and significant consequences of CMMC non-compliance for an MSP is the potential for contract loss. Defense contractors cannot win new DoD contracts, or retain existing ones, if their service providers are not compliant with CMMC requirements. This means that if an MSP is a critical link in a contractor’s IT infrastructure and fails to achieve the necessary CMMC level, the contractor may be forced to terminate their relationship with the MSP to secure or maintain DoD work. This ripple effect directly translates into lost business for the non-compliant MSP and can severely limit its ability to serve the defense industrial base. The goal of CMMC is to ensure that contractors actually implement the security controls they claim to have in place, adding third-party verification to stop data leakage and intellectual property theft.

This issue extends beyond current contracts. The "CMMC Status of Level 1, Level 2, or Level 3" is a condition of contract award when included in contracts that process, store, or transmit FCI or CUI Technical Application of CMMC Requirements. Primes flow these requirements down to subcontractors based on the data shared. If an MSP cannot demonstrate the required CMMC certification, it will be barred from participating in new defense-related projects, effectively cutting off a significant revenue stream and growth opportunity. For MSPs heavily reliant on the defense sector, this can be an existential threat.

Mandatory Vendor Reporting and Red Flags

During CMMC assessments, defense contractors are required to document every vendor with access to their CUI systems. This includes their Managed Service Providers. If an MSP is found to be non-compliant, it immediately becomes a "red flag" during the contractor's assessment. Assessors will scrutinize the relationship and the security measures in place to protect CUI accessed or managed by the MSP. A non-compliant MSP can jeopardize the client's own CMMC certification, making the client less likely to engage with such a provider in the future.

This mandatory vendor reporting makes it impossible for non-compliant MSPs to hide. Their security posture, or lack thereof, becomes transparent to both their clients and the CMMC assessors. This transparency is a core component of the CMMC program, designed to ensure accountability across the entire supply chain. Contractors are under pressure to ensure all their partners are compliant, and they will likely choose compliant MSPs to avoid issues during their own audits.

Suspension from Defense Work and Reputational Damage

Beyond specific contract losses, the DoD has the authority to suspend or even permanently bar MSPs from working with defense contractors if they repeatedly fail to meet CMMC standards or demonstrate a severe lack of cybersecurity maturity. This action would effectively remove an MSP from the defense industrial base entirely, cutting off access to a large and critical market segment. Such a suspension would be a devastating blow to any MSP focused on government contracting.

Furthermore, word spreads fast in the defense community. A reputation for non-compliance marks an MSP as a security risk, not just to the DoD but potentially to other clients as well. The defense sector is highly interconnected, and a poor security reputation can quickly lead to a loss of trust and business opportunities across the board. Conversely, achieving CMMC compliance can turn into a profitable service model for MSPs, allowing them to become trusted partners in the defense ecosystem by offering cybersecurity solutions aligned with CMMC standards and providing ongoing compliance support CMMC Requirements for MSPs: Complete Compliance Guide. Understanding CMMC compliance for IT providers is no longer optional; it's a critical business requirement for any MSP serving the defense sector.

How Does CMMC Structure Its Requirements?

CMMC is structured as a three-tier model, designed to progressively increase the level of cybersecurity requirements based on the sensitivity of the information handled by Defense Industrial Base (DIB) companies. This tiered approach allows for a tailored application of security controls, ensuring that companies handling the most sensitive data adhere to the highest standards. CMMC Level 1 and Level 2 validate full compliance with existing regulations, while CMMC Level 3 introduces additional security measures.

The Three Tiers of CMMC

The CMMC model outlines three distinct levels, each with increasing demands for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). This progressive approach ensures that companies implement appropriate security measures based on their involvement with sensitive DoD data.

CMMC Level 1: Foundational. This level applies to companies that only handle Federal Contract Information (FCI). FCI is information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. CMMC Level 1 focuses on basic cyber hygiene. It has 15 security requirements, which are typically assessed via a self-assessment conducted annually. This level is estimated to apply to approximately 140,000 DIB companies Technical Application of CMMC Requirements. The requirements are straightforward, covering practices like antivirus software, regular password changes, and access control.
CMMC Level 2: Advanced. This level is for companies that handle Controlled Unclassified Information (CUI). CUI is information that the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. This level aligns directly with NIST SP 800-171 R2. It includes 110 security requirements. The assessment type for Level 2 can be a self-assessment or a CMMC Third-Party Organization (C3PAO) assessment, as specified in the contract. This level is estimated to apply to approximately 75,000 DIB companies Technical Application of CMMC Requirements. MSPs that store, process, or transmit CUI on their own systems must pursue CMMC Level 2.
CMMC Level 3: Expert. This is the highest level, designed for companies that handle CUI for select DoD programs and require protection against Advanced Persistent Threats (APTs). CMMC Level 3 adds and validates additional security requirements beyond NIST SP 800-171, aligning with NIST SP 800-172. This level involves a government-led assessment. It builds upon the 110 requirements of Level 2 and introduces a smaller set of more advanced controls.

Validation and Assessment Types

CMMC Levels 1 and 2 are designed to validate full compliance with existing regulations. Specifically, Level 2 aligns to NIST SP 800-171 R2, NIST SP 800-171A Jun2018, NIST SP 800-172 Feb2021, and NIST SP 800-172A Mar2022. The assessment type varies by level and contract requirements. For Level 1, a self-assessment is typically sufficient, requiring an annual affirmation. For Level 2, while some contracts may permit self-assessment, many will require a CMMC Third-Party Organization (C3PAO) assessment. This third-party verification is a key differentiator of CMMC, ensuring an objective evaluation of a company's cybersecurity posture. Level 3 assessments are conducted by the government itself, reflecting the high stakes involved in protecting highly sensitive CUI against sophisticated threats.

The "CMMC Status of Level 1, Level 2, or Level 3" is a condition of contract award when included in contracts that process, store, or transmit FCI or CUI. This means that defense contractors, and by extension their MSPs, must achieve the specified CMMC level before they can be awarded a contract that requires it. This proactive compliance requirement underscores the DoD's commitment to ensuring cybersecurity readiness throughout its supply chain, rather than addressing deficiencies after a contract has been awarded. Primes flow these requirements to subcontractors based on the data shared, making it essential for all entities in the DIB to understand and prepare for their respective CMMC obligations.

What is the Difference Between an MSP and an MSSP in CMMC?

Understanding the distinction between a Managed Service Provider (MSP) and a Managed Security Service Provider (MSSP) is important, especially in the context of CMMC compliance. While both types of providers offer outsourced IT services, their primary focus and the scope of their responsibilities differ significantly. These differences can impact how each type of provider approaches and achieves CMMC certification.

Managed Service Providers (MSPs)

An MSP typically focuses on general IT management to support a business's day-to-day operations. This includes a broad range of services aimed at maintaining the functionality and efficiency of an organization's IT infrastructure. Common services offered by an MSP include:

Network Management: Ensuring networks are running smoothly, configuring routers and switches, and troubleshooting connectivity issues.
System Administration: Managing servers, workstations, and other hardware, including patching, updates, and performance monitoring.
Help Desk Support: Providing technical assistance to end-users for various IT problems.
Data Backup and Recovery: Implementing and managing solutions to protect data from loss and ensure business continuity.
Cloud Service Management: Administering cloud platforms, applications, and storage solutions.

The primary goal of an MSP is to optimize IT operations, reduce downtime, and provide reliable technology support, allowing clients to focus on their core business activities. While security is often a component of an MSP's offerings, it is usually integrated as part of overall IT management rather than being the sole or primary focus. An MSP's role is typically reactive to immediate IT issues and proactive in maintaining system health, but not necessarily specializing in advanced threat detection or incident response.

Managed Security Service Providers (MSSPs)

In contrast, an MSSP specializes specifically in IT security. An MSSP provides IT security for a business by adding technology, processes, and service to proactively protect the business as well as scanning your network for threats and remediating vulnerabilities Find A Managed Service Provider (MSP) For CMMC Compliance. MSSPs focus on safeguarding an organization's assets from cyber threats, ensuring compliance with security regulations, and responding to security incidents. Their services are more specialized and include:

Threat Detection and Prevention: Utilizing advanced tools like Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDPS), and endpoint detection and response (EDR) solutions.
Vulnerability Management: Regularly scanning networks and systems for vulnerabilities, conducting penetration testing, and providing remediation guidance.
Security Monitoring: 24/7 monitoring of security logs, network traffic, and system activity to identify and alert on potential security incidents.
Incident Response: Developing and executing plans to respond to cyberattacks, containing breaches, and assisting with recovery.
Compliance Management: Helping clients meet specific security compliance requirements, such as CMMC, HIPAA, or GDPR.
Security Awareness Training: Educating employees on best security practices to reduce human-related risks.

MSSPs are designed to provide a deeper, more specialized level of cybersecurity expertise than a general MSP. They often have dedicated security operations centers (SOCs) and staff with advanced certifications in cybersecurity. Their proactive approach involves continuous monitoring, analysis, and rapid response to evolving cyber threats.

Implications for CMMC Compliance

For CMMC compliance, the distinction matters because an MSSP is inherently focused on the very security controls and practices that CMMC mandates. While an MSP might implement some security measures, an MSSP's core business revolves around the advanced security capabilities required for CMMC Level 2 and Level 3. An MSP might assist a client in becoming CMMC compliant by managing their general IT infrastructure, but an MSSP would likely provide more direct support for meeting the specific cybersecurity controls, such as continuous monitoring, incident response, and vulnerability management.

However, regardless of whether a provider is an MSP or an MSSP, if they store, process, or transmit CUI on their own systems or have privileged access to client systems containing CUI, they will need to achieve their own CMMC Level 2 certification. The critical factor is the handling of CUI, not just the label of "MSP" or "MSSP." Both types of providers serving the defense industrial base must thoroughly assess their interactions with CUI and plan their CMMC compliance journey accordingly. Finding the right Managed Service Provider (MSP) for CMMC compliance could be one of, if not the most important step for defense contractors supporting the Department of Defense.

Why is SOC 2 Compliance Important for MSPs?

Service Organization Control for Service Organizations (SOC 2) compliance is a crucial attestation that demonstrates an MSP's commitment to protecting sensitive customer data. While CMMC focuses specifically on the defense industrial base and Controlled Unclassified Information (CUI), SOC 2 compliance offers a broader, yet equally vital, assurance of data security and privacy for all types of clients. It has become a competitive differentiator and a fundamental expectation in many industries.

Proving Data Security and Trust

At its core, SOC 2 attestation proves that a business can protect sensitive customer data. Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 reports evaluate an organization's information security system based on five "Trust Services Criteria": Security, Availability, Processing Integrity, Confidentiality, and Privacy SOC 2® - SOC for Service Organizations: Trust Services Criteria. For an MSP, achieving SOC 2 compliance means undergoing a rigorous audit that assesses the design and operating effectiveness of its controls related to these criteria.

This independent audit provides an objective verification that an MSP has robust controls in place to safeguard client data. In an era where data breaches are common and data privacy concerns are paramount, this assurance is invaluable. It builds trust with current and prospective clients, demonstrating a proactive and mature approach to information security. Clients, especially those in highly regulated industries, need confidence that their MSP partners are handling their data responsibly and securely. Learn why this data security standard matters for MSPs.

A Competitive Differentiator and Business Enabler

SOC 2 compliance is often a deciding factor in winning enterprise deals, especially in industries such as SaaS, fintech, and healthcare, where data security is expected How to get SOC 2 compliance: A guide for MSPs supporting client audits. Many larger organizations, particularly those that handle significant volumes of sensitive customer data or operate under strict regulatory frameworks, require their vendors and service providers to be SOC 2 compliant. Without it, an MSP may be automatically disqualified from bidding on or securing contracts with these clients.

For MSPs, having a SOC 2 report can open doors to new markets and client segments that prioritize strong data security. It signals to potential clients that the MSP has invested in its security posture, understood its risks, and implemented controls to mitigate them. This differentiator can be particularly powerful in a crowded MSP market, allowing compliant providers to stand out from competitors who have not undertaken the same level of security assurance. It's a clear signal of credibility and reliability in data protection.

Relevance in the Cloud Era

Data security and privacy regulations aren’t simply matters of grave importance to modern businesses for the sole sake of maintaining tight control over their internal information security matters. They’ve become increasingly crucial to end users as well — especially in an era when the cloud and the countless applications it hosts are so often the usage, processing, and storage environments for confidential data Why you should have SOC 2 compliance as an MSP. MSPs often manage cloud environments, host applications, and process data on behalf of their clients, making them central to the data supply chain.

As organizations increasingly move their operations and data to the cloud, the responsibility for securing that data often extends to their MSPs. SOC 2 compliance provides a framework for MSPs to demonstrate that their cloud-based services and internal operations meet stringent security, availability, processing integrity, confidentiality, and privacy requirements. This is crucial not only for protecting client data but also for ensuring the MSP's own resilience and operational integrity. A SOC 2 report essentially provides an independent assurance that the MSP's systems and processes are designed and operating effectively to protect the information entrusted to them. For MSPs, achieving and maintaining SOC 2 compliance is an investment in their own future and a commitment to their clients' security.

Frequently Asked Questions

What is CMMC?

CMMC, or the Cybersecurity Maturity Model Certification, is a framework created by the U.S. Department of Defense (DoD) to enforce strict cybersecurity standards across the Defense Industrial Base (DIB). Its purpose is to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) by requiring contractors and subcontractors to meet specific security requirements. CMMC evolved from NIST SP 800-171 and adds third-party verification to ensure actual implementation of security controls, with CMMC Level 1 applying to approximately 140,000 DIB companies Technical Application of CMMC Requirements.

When does an MSP need to be CMMC compliant?

An MSP needs to be CMMC compliant if it stores CUI data on its infrastructure, transmits sensitive information between systems, processes contractor data that includes CUI, or has privileged access to client systems containing CUI. Specifically, if an External Service Provider (ESP) is storing, processing, or transmitting CUI on its own systems, it requires its own Level 2 CMMC certification. CMMC Level 2 covers CUI with 110 security requirements Technical Application of CMMC Requirements.

What happens if an MSP is not CMMC compliant?

Failing to meet CMMC standards can lead to severe consequences for an MSP. These include contract loss for their defense contractor clients, as non-compliant MSPs become a red flag during CMMC assessments. The DoD can also suspend or bar MSPs from working with defense contractors, and non-compliance causes significant reputational damage within the defense community.

How many levels are there in CMMC?

CMMC is a three-tier model with increasing requirements. CMMC Level 1 focuses on Federal Contract Information (FCI) with 15 security requirements. CMMC Level 2 applies to Controlled Unclassified Information (CUI) with 110 security requirements, aligning with NIST SP 800-171 R2. CMMC Level 3 adds and validates additional security requirements for select DoD programs to protect against advanced persistent threats.

What is SOC 2 compliance for MSPs?

SOC 2 compliance is an attestation that proves an MSP can protect sensitive customer data, based on five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. It acts as a competitive differentiator and is often a deciding factor in winning enterprise deals, especially in industries like SaaS, fintech, and healthcare, where data security is a high priority. SOC 2 compliance is crucial for end users, especially with widespread cloud application usage for confidential data.