MSP Cyber Insurance Requirements 2026

Last updated: April 2026

Affiliate Disclosure: We may earn a commission when you purchase through our links. This does not affect our editorial independence.

Quick Answer

CMMC Level 2 compliance is required for MSPs that store, process, or transmit Controlled Unclassified Information (CUI) on their own systems, affecting approximately 75,000 Defense Industrial Base (DIB) companies.
The U.S. Department of Defense (DoD) created CMMC to enforce strict cybersecurity standards across the DIB.
CMMC Level 1 applies to about 140,000 DIB companies, while Level 2 applies to those handling CUI, validating full compliance with NIST SP 800-171 R2.
SOC 2 compliance is a competitive differentiator, often a deciding factor in winning enterprise deals, especially in SaaS, fintech, and healthcare sectors, proving a business can protect sensitive customer data.

Managed Service Providers (MSPs) face increasing pressure to meet stringent cybersecurity requirements, especially when working with government contractors or handling sensitive client data. For 2026, two key compliance frameworks stand out: the Cybersecurity Maturity Model Certification (CMMC) and Service Organization Control 2 (SOC 2). The CMMC, developed by the U.S. Department of Defense, aims to enforce robust cybersecurity standards across the Defense Industrial Base (DIB), directly impacting MSPs that interact with DoD data. Approximately 75,000 DIB companies dealing with Controlled Unclassified Information (CUI) are subject to CMMC Level 2, which requires third-party verification of 110 security controls from NIST SP 800-171 R2 Technical Application of CMMC Requirements. Meanwhile, SOC 2 compliance is a crucial differentiator that demonstrates an MSP's ability to protect sensitive customer data, making it a critical factor for securing enterprise clients in data-sensitive industries such as SaaS, fintech, and healthcare.

What is CMMC and Why Does it Matter for MSPs?

CMMC, or the Cybersecurity Maturity Model Certification, is a program created by the U.S. Department of Defense (DoD) to enforce strict cybersecurity standards across the Defense Industrial Base (DIB). Its primary goal is to protect Controlled Unclassified Information (CUI) within the defense supply chain, stopping data leakage and intellectual property theft CMMC Requirements for MSPs. Every contractor and subcontractor that handles DoD data must now prove they meet these security requirements through third-party verification. This focus ensures that contractors actually implement the security controls they claim to have in place.

MSPs are directly affected by these rules because they manage networks, systems, and cloud services for their clients, often having privileged access to contractor environments that may contain CUI. If an MSP administers IT systems, cybersecurity tools, hosting, networks, or cloud workloads for DoD contractors, and especially if they handle Federal Contract Information (FCI) or CUI on behalf of a client, they fall under CMMC scope. This means MSPs must meet the same security standards as their defense contractor clients. The program ensures that the entire defense supply chain maintains strong cybersecurity, with MSPs acting as critical links in that chain. Understanding CMMC compliance for IT providers is no longer optional; it is a fundamental business requirement for any MSP serving the defense sector.

The Evolution of CMMC

CMMC evolved from earlier NIST SP 800-171 requirements. While NIST SP 800-171 provided a framework for protecting CUI, CMMC adds a layer of third-party verification. This verification step is crucial because it ensures that organizations are not just self-attesting to their security posture but are actually implementing and maintaining the required controls. This shift was necessary to combat persistent threats and ensure the integrity of the defense supply chain. The DoD observed that despite self-attestation, data breaches and intellectual property theft continued, highlighting the need for a more robust and verifiable compliance model.

CMMC's Impact on the Defense Industrial Base

The DIB consists of a vast network of companies, from prime contractors to small subcontractors, all contributing to national defense. The DoD recognizes that the security of this entire ecosystem is only as strong as its weakest link. Therefore, by mandating CMMC across the board, the DoD aims to raise the cybersecurity baseline for all entities involved. This comprehensive approach means that even a small MSP providing IT support to a subcontractor needs to be aware of and potentially comply with CMMC if they handle CUI or have privileged access to systems containing it. The program is designed to protect sensitive government data from advanced persistent threats, which can exploit vulnerabilities anywhere in the supply chain.

Turning Compliance into a Business Opportunity

While compliance can seem like a burden, MSPs can view CMMC as a profitable service model. By becoming experts in CMMC standards, MSPs can offer specialized cybersecurity solutions and ongoing compliance support to their defense contractor clients. This positions them as trusted partners within the defense ecosystem, helping clients navigate the complexities of CMMC and maintain their eligibility for DoD contracts. MSPs can develop service packages that specifically address CMMC requirements, including assessments, remediation, and continuous monitoring. This not only secures existing client relationships but also opens doors to new opportunities with contractors seeking compliant service providers. The demand for CMMC-savvy MSPs is growing as the compliance deadline approaches, creating a significant market for those prepared to meet the challenge.

When Do MSPs Need to Be CMMC Compliant Themselves?

MSPs need to be CMMC compliant themselves if they store, process, or transmit Controlled Unclassified Information (CUI) on their own systems. This requirement applies independently of their clients' assessments, meaning the MSP must undergo its own CMMC Level 2 certification if these conditions are met When MSPs Need CMMC Compliance. This policy marks a significant shift for the industry, as many MSPs and Managed Security Service Providers (MSSPs) previously believed they were exempt, even when their defense contractor customers were handling CUI.

Matt Travis, CEO of the Cyber AB, clarified this during a Cyber-AB Town Hall, stating, "If an ESP (that is not a Cloud Service Provider) is storing, processing, or transmitting CUI on their own systems—not just administering someone else’s systems—then they require their own Level 2 CMMC certification." This means that if an MSP's infrastructure holds CUI, or if their tools interact with CUI in a way that brings that data onto their systems, they are in scope for their own certification. Failure to do so could result in the MSP being assessed alongside each customer's assessment, effectively requiring multiple assessments and increasing compliance costs and complexities.

Specific Scenarios Requiring CMMC Level 2

Several specific scenarios trigger an MSP's obligation for independent CMMC Level 2 compliance:

Storing, Processing, or Transmitting CUI on MSP Systems

If an MSP's internal infrastructure, such as its servers, data centers, or cloud storage, is used to store, process, or transmit CUI, that MSP must pursue its own CMMC Level 2 certification. This is distinct from merely having privileged access to a client's system where CUI resides. The critical factor is whether the MSP's own systems are actively handling the CUI. For example, if an MSP collects and retains backup data that includes CUI on its own storage infrastructure, it becomes responsible for CMMC compliance for that infrastructure.

Managing Remote Monitoring and Management (RMM) Tools

Many MSPs use RMM tools to monitor and manage client environments remotely. If an RMM tool collects data from a client’s CUI environment and that data is stored or processed on the MSP's systems, the MSP is in scope. This means the RMM tool itself, and the infrastructure supporting it, must meet CMMC Level 2 requirements. The data collected by RMM tools often includes system configurations, logs, and potentially snippets of information that could contain CUI, thus necessitating compliance.

Administrating Platforms with CUI Access

MSPs often administer cloud platforms like Microsoft GCC High or secure collaboration tools like PreVeil for their clients. If an MSP's administrative access to these platforms includes the ability to view or interact with client emails or documents containing CUI, then the MSP's internal systems and processes used for that administration must be CMMC Level 2 compliant. This is because the MSP, through its privileged access, effectively has the capability to process or transmit CUI, even if not actively storing it on their own distinct infrastructure outside the client's managed platform. The access itself creates a compliance boundary.

Distinguishing Scope: General IT Support vs. CUI Handling

It is important to differentiate between general IT support and direct CUI handling. If an MSP provides only general IT support that does not involve storing, processing, or transmitting CUI on its own infrastructure, and does not have privileged access to client systems containing CUI, they might not need their own CMMC certification. However, even privileged access to client systems containing CUI, without direct handling on the MSP's own systems, places the MSP within the compliance boundary. During CMMC assessments, contractors must document every vendor with access to CUI systems, making it crucial for MSPs to understand their specific obligations.

What Are the Consequences of CMMC Non-Compliance for MSPs?

Failing to meet CMMC standards creates serious problems for Managed Service Providers (MSPs) and their clients. The repercussions extend beyond mere operational inconvenience, impacting business viability, contractual relationships, and reputation within the defense sector. Non-compliance can lead to a cascading series of negative outcomes that jeopardize an MSP's ability to serve defense contractors.

Contract Loss and Business Impact

One of the most immediate and severe consequences of CMMC non-compliance is contract loss. Defense contractors cannot win or retain U.S. Department of Defense (DoD) contracts if their service providers, including MSPs, are not compliant. This means that if an MSP fails to achieve the necessary CMMC certification, its defense contractor clients will lose business, and by extension, the MSP will lose those clients. The flow-down of CMMC requirements from primes to subcontractors ensures that every link in the defense supply chain is secure. If an MSP is a weak link, it jeopardizes the entire chain, leading to the termination of existing contracts and the inability to secure new ones. This directly impacts the MSP's revenue and growth potential within the lucrative defense market.

Mandatory Vendor Reporting and Red Flags

During CMMC assessments, contractors are mandated to document every vendor and External Service Provider (ESP) that has access to systems containing Controlled Unclassified Information (CUI). If an MSP is identified as non-compliant, it becomes a significant red flag for the assessor and the DoD. This transparency is designed to ensure that all parties handling sensitive government data adhere to the required cybersecurity standards. A non-compliant MSP not only delays or complicates a client's CMMC assessment but also places the client at risk of failing their own certification. This process highlights non-compliant MSPs, making them undesirable partners for any defense contractor.

Suspension from Defense Work

The DoD has the authority to suspend or even permanently bar MSPs from working with defense contractors if they fail to meet CMMC requirements. This is not a theoretical threat; it is a direct consequence designed to enforce the integrity of the Defense Industrial Base (DIB). Such a suspension or ban can effectively cut off an MSP from a significant market segment, potentially crippling their business if a substantial portion of their client base is in the defense sector. The DoD's stance is clear: cybersecurity is paramount, and non-compliance will not be tolerated.

Reputational Damage

In the defense community, information about compliance and security postures spreads quickly. An MSP's failure to achieve CMMC compliance can severely damage its reputation, marking it as a security risk. This reputational damage can extend beyond the defense sector, affecting the MSP's ability to attract clients in other industries who also prioritize strong cybersecurity. Trust is a cornerstone of the MSP-client relationship, especially when dealing with sensitive data. A tarnished reputation due to non-compliance can be difficult to overcome, impacting future business opportunities and growth across various markets. The perception of an MSP as a security liability can be a death knell in an industry where data protection is paramount.

How Do CMMC Levels Apply to MSPs?

CMMC is a 3-tier model with increasing requirements designed to assess and protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Each level builds upon the previous one, validating full compliance with existing regulations and adding more stringent security requirements as the sensitivity of the data increases. MSPs must understand these levels to determine their specific compliance obligations based on the type of data they handle for their defense contractor clients Technical Application of CMMC Requirements.

CMMC Level 1: Foundational Safeguards for FCI

CMMC Level 1 focuses on foundational cybersecurity practices for protecting Federal Contract Information (FCI). FCI is information, not intended for public release, that is provided by or generated for the Government under a contract. This level involves 15 security requirements and applies to approximately 140,000 DIB companies. The assessment type for Level 1 is a self-assessment, which must be conducted annually. While a self-assessment, it still requires organizations to demonstrate that they have implemented basic cyber hygiene practices. For MSPs, if they handle FCI for a client, their systems and processes related to that FCI must meet these 15 requirements. Even if not directly storing FCI on their own infrastructure, MSPs providing IT support or managing systems where FCI resides must ensure those environments meet Level 1 controls. This is the entry point for many organizations into the CMMC framework, establishing a baseline of security for unclassified but sensitive government information.

CMMC Level 2: Protecting CUI with NIST SP 800-171 R2

CMMC Level 2 is designed for organizations that process, store, or transmit Controlled Unclassified Information (CUI). This level is based on the 110 security requirements outlined in NIST SP 800-171 R2 and applies to approximately 75,000 DIB companies. Compliance with DFARS 252.204-7012 mandates NIST SP 800-171 R2. For Level 2, the assessment type can be either a self-assessment or a CMMC Third-Party Organization (C3PAO) assessment, as specified in the contract. The C3PAO assessment provides independent verification, ensuring a higher degree of assurance. As discussed earlier, if an MSP stores, processes, or transmits CUI on its own systems, it must undergo its own CMMC Level 2 assessment independently from its clients. This is a critical distinction, as it requires the MSP to demonstrate full compliance with all 110 NIST SP 800-171 R2 controls for its own CUI-handling environment. The requirements are extensive, covering areas such as access control, incident response, configuration management, and system and information integrity.

The Role of NIST SP 800-171 R2

NIST SP 800-171 R2 provides a comprehensive set of security requirements for protecting CUI in nonfederal information systems and organizations. These requirements are grouped into 14 families, including:

Access Control
Awareness and Training
Audit and Accountability
Configuration Management
Identification and Authentication
Incident Response
Maintenance
Media Protection
Personnel Security
Physical Protection
Risk Assessment
Security Assessment
System and Communications Protection
System and Information Integrity

Each of these families contains multiple controls that organizations must implement. For MSPs handling CUI, this means not only implementing the technical controls but also establishing robust policies, procedures, and training programs to support them.

CMMC Level 3: Advanced Persistent Threat Protection

CMMC Level 3 is the highest tier and adds and validates additional security requirements for select DoD programs. These additional requirements are designed to increase protection against advanced persistent threats (APTs). Level 3 aligns with NIST SP 800-172 and NIST SP 800-172A. This level is reserved for organizations handling the most sensitive CUI, often critical to national security, and requires the most rigorous assessment by a C3PAO. While fewer MSPs may directly need Level 3 certification, those supporting prime contractors on highly sensitive programs might find themselves needing to demonstrate capabilities aligned with Level 3 requirements, even if not directly certified at that level. This might involve implementing specific enhanced security controls or demonstrating the ability to rapidly respond to sophisticated cyberattacks.

Condition of Contract Award

It is crucial to understand that CMMC status (Level 1, Level 2, or Level 3) is a condition of contract award when included in contracts that process, store, or transmit FCI or CUI. Prime contractors are required to flow these requirements down to their subcontractors based on the data shared. This means that if an MSP wants to work with defense contractors, it must meet the CMMC level specified in the contract, whether directly or indirectly through its services. Without the appropriate certification, an MSP's clients will be unable to secure DoD contracts, leading to significant business losses for all parties involved.

What is SOC 2 Compliance and Why is it Important for MSPs?

System and Organization Controls 2 (SOC 2) is an attestation that proves a business can protect sensitive customer data. It is not a government mandate like CMMC but a voluntary audit that has become a crucial competitive differentiator in the modern business landscape Why you should have SOC 2 compliance as an MSP. SOC 2 compliance demonstrates an MSP's commitment to data security and privacy, which is increasingly important for end-users and modern businesses that rely heavily on cloud services and third-party vendors.

The SOC 2 report evaluates a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy, collectively known as the Trust Services Criteria (TSC) SOC 2® - SOC for Service Organizations: Trust Services Criteria. Achieving SOC 2 compliance shows that an MSP has robust internal controls in place to protect the data it processes and stores on behalf of its clients. This assurance is often a deciding factor in winning enterprise deals, particularly in industries such as SaaS, fintech, and healthcare, where the protection of sensitive data is not just expected but legally mandated in many cases.

The Trust Services Criteria

SOC 2 reports are based on five Trust Services Criteria:

1. Security

This is the most fundamental and mandatory criterion. It addresses the protection of information and systems against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems. For an MSP, this means having controls in place to prevent cyberattacks, unauthorized data access, and system breaches. This includes firewalls, intrusion detection, multi-factor authentication, and encryption.

2. Availability

This criterion refers to the accessibility of the system, products, or services as committed or agreed. It addresses whether the system is available for operation and use as agreed upon with clients. MSPs must demonstrate robust controls for monitoring network performance, disaster recovery planning, and incident management to ensure continuous service delivery. This is critical for clients who rely on the MSP's services for their daily operations.

3. Processing Integrity

This criterion addresses whether system processing is complete, valid, accurate, timely, and authorized. It focuses on the quality of the data processing. For an MSP, this means ensuring that data is handled correctly throughout its lifecycle, from input to storage and output. Controls for data validation, error detection, and quality assurance are essential here. This is particularly important for MSPs providing services like data analytics, transaction processing, or financial reporting.

4. Confidentiality

This criterion addresses the protection of information designated as confidential from unauthorized access and disclosure. Confidential information includes business plans, intellectual property, customer data, and other sensitive information. MSPs must implement strong access controls, data encryption, and secure data transmission protocols to maintain confidentiality. This is vital for maintaining client trust and protecting their proprietary information.

5. Privacy

This criterion addresses the collection, use, retention, disclosure, and disposal of personal information in conformity with the entity’s privacy notice and generally accepted privacy principles. While similar to confidentiality, privacy specifically focuses on personal identifiable information (PII). MSPs handling PII must ensure their practices align with privacy regulations like GDPR or CCPA, having clear privacy policies and controls for consent, data access, and data deletion.

SOC 2 as a Competitive Differentiator

In an increasingly competitive market, SOC 2 compliance serves as a powerful competitive differentiator. It signals to potential clients that an MSP takes data security seriously and has undergone a rigorous independent audit to prove it. Small business buyers shopping for security-first partners can compare options in our roundup of the Best Cybersecurity-Focused MSPs for Small Business [2026]. This can be especially impactful when bidding for enterprise deals, where the client's own compliance requirements often necessitate that their vendors also be compliant. Industries like SaaS, fintech, and healthcare are particularly sensitive to data breaches and regulatory penalties, making SOC 2 a non-negotiable requirement for many of their service providers How to get SOC 2 compliance: A guide for MSPs supporting client audits. By achieving SOC 2, an MSP not only mitigates risks but also builds trust, expands its market reach, and enhances its reputation as a secure and reliable partner. This compliance provides a tangible, audited report that can be shared with clients, offering them peace of mind regarding the security of their data.

What is the Difference Between an MSP and an MSSP in the Context of Compliance?

Understanding the distinction between a Managed Service Provider (MSP) and a Managed Security Service Provider (MSSP) is crucial when navigating the complexities of compliance frameworks like CMMC and SOC 2. While both types of providers offer outsourced IT services, their primary focus areas differ significantly, which in turn affects their specific roles and responsibilities in achieving and maintaining compliance for their clients and themselves. Both can be vital partners for defense contractors seeking CMMC compliance Find A Managed Service Provider (MSP) For CMMC Compliance.

Managed Service Provider (MSP)

An MSP primarily focuses on general IT management to support a client's day-to-day business operations. This typically includes a broad range of services such as network management, help desk support, cloud services, data backup and recovery, software updates, and infrastructure maintenance. The core objective of an MSP is to ensure the smooth, efficient, and reliable operation of a client's IT environment. They act as an outsourced IT department, handling routine tasks and proactive maintenance to keep systems running.

In the context of compliance, an MSP's role often involves implementing the foundational IT infrastructure and controls necessary to support compliance. For CMMC, an MSP might implement access controls, configure firewalls, manage user accounts, and ensure data backups, all of which are components of various CMMC levels. For SOC 2, an MSP would contribute to the security and availability criteria by maintaining system uptime, patching vulnerabilities, and managing network security devices. However, their primary focus isn't necessarily the security aspect of these controls, but rather the operational aspect of IT. If an MSP handles Controlled Unclassified Information (CUI) on its own systems, it would still need to achieve CMMC Level 2 compliance for those specific systems, regardless of its general IT focus.

Managed Security Service Provider (MSSP)

An MSSP, on the other hand, specializes in providing IT security services. Their offerings go beyond general IT management to proactively protect a business from cyber threats. MSSPs achieve this by adding specialized technology, processes, and dedicated security services. Their core services often include 24/7 security monitoring, threat detection and response, vulnerability scanning, penetration testing, security information and event management (SIEM), intrusion detection systems (IDS), and remediation of security incidents. An MSSP's goal is to minimize security risks and respond effectively to cyberattacks.

For compliance frameworks like CMMC and SOC 2, an MSSP plays a more direct and specialized role in meeting the security-specific requirements. For CMMC, an MSSP would be crucial for implementing advanced security controls, conducting security assessments, managing incident response plans, and continuously monitoring for compliance with the 110 requirements of NIST SP 800-171 R2. Their expertise is invaluable for achieving the higher CMMC levels. For SOC 2, an MSSP directly addresses the "Security" Trust Services Criteria, ensuring robust protection against unauthorized access and cyber threats. They would also contribute significantly to "Availability" through proactive monitoring and incident response, and to "Confidentiality" by managing data encryption and access controls.

Overlap and Collaboration

While distinct, the roles of MSPs and MSSPs can overlap, and many organizations benefit from leveraging both. Some MSPs may offer basic security services, blurring the lines, while some MSSPs may also handle general IT management. For comprehensive compliance, especially with CMMC Level 2 and beyond, a defense contractor often needs the operational support of an MSP combined with the specialized security expertise of an MSSP. An MSP might lay the groundwork by managing the network infrastructure, while an MSSP layers on the advanced security monitoring, threat intelligence, and incident response capabilities required to meet stringent compliance standards. Both types of providers are critical partners in building a secure and compliant IT environment, but their specific contributions to compliance efforts stem from their core service offerings. An MSP could help a client implement the technical controls, while an MSSP could provide continuous monitoring and security assessments to maintain compliance.

Frequently Asked Questions

Does CMMC apply to all MSPs?

CMMC does not apply to all MSPs universally, but it applies to any MSP that works with defense contractors and handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Specifically, if an MSP stores, processes, or transmits CUI on its own systems, it requires its own CMMC Level 2 certification, which is based on 110 security requirements from NIST SP 800-171 R2. Even if an MSP only has privileged access to client systems containing CUI, it falls within the CMMC compliance boundary. Approximately 75,000 DIB companies are subject to CMMC Level 2, and their MSPs may be in scope.

What is the main difference between CMMC Level 1 and Level 2?

The main difference lies in the type of information protected and the rigor of the requirements and assessment. CMMC Level 1 addresses Federal Contract Information (FCI) with 15 foundational security requirements, and its assessment is a self-assessment, applicable to about 140,000 DIB companies. CMMC Level 2, on the other hand, is for Controlled Unclassified Information (CUI) and mandates 110 security requirements based on NIST SP 800-171 R2, applicable to approximately 75,000 DIB companies. Level 2 can require a CMMC Third-Party Organization (C3PAO) assessment, providing a higher level of verification.

Can an MSP help my company achieve CMMC compliance?

Yes, an MSP can be a crucial partner in helping your company achieve CMMC compliance. By offering cybersecurity solutions aligned with CMMC standards and providing ongoing compliance support, managed service providers can become trusted partners in the defense ecosystem. They can assist with implementing the necessary security controls, conducting assessments, and maintaining the required security posture. Finding the right MSP for CMMC compliance is one of the most important steps for defense contractors supporting the Department of Defense.

Is SOC 2 compliance mandatory for MSPs?

SOC 2 compliance is not mandatory in the same way CMMC is for defense contractors; it is a voluntary attestation. However, it has become a critical competitive differentiator for MSPs, especially in industries like SaaS, fintech, and healthcare. Achieving SOC 2 proves a business can protect sensitive customer data and is often a deciding factor in winning enterprise deals, as it demonstrates robust internal controls over security, availability, processing integrity, confidentiality, and privacy.

How does privileged access affect an MSP's CMMC compliance obligations?

Privileged access significantly impacts an MSP's CMMC compliance obligations. Even if an MSP does not directly store, process, or transmit CUI on its own infrastructure, having privileged access to client systems that contain CUI places the MSP within the CMMC compliance boundary. During CMMC assessments, contractors must document every vendor with access to CUI systems, and non-compliant MSPs with privileged access become a red flag. This means MSPs with such access must ensure their internal security practices and personnel meet the CMMC requirements relevant to protecting that CUI.