State Privacy Laws MSPs Must Know

Q: Does an MSP always need CMMC compliance if their client handles CUI?

An MSP does not *always* need its own independent CMMC certification if its client handles CUI. The requirement depends on whether the MSP stores, processes, or transmits CUI on its *own systems*. If the MSP only administers a client's systems without CUI touching the MSP's infrastructure, they might be assessed with the client or be out of scope. However, if an MSP manages tools like RMM that collect data from a CUI environment or has privileged access to client emails or documents containing C

Last updated: April 2026

Affiliate Disclosure: We may earn a commission when you purchase through our links. This does not affect our editorial independence.

Quick Answer

CMMC is a three-tier model, with Level 1 applying to roughly 140,000 DIB companies and Level 2 to about 75,000 DIB companies.
MSPs must meet CMMC Level 2 independently if they store, process, or transmit CUI on their own systems.
SOC 2 compliance is a key differentiator for MSPs, proving a business can protect sensitive customer data.
Non-compliant MSPs can lead to contract loss and reputational damage for themselves and their defense contractor clients.

Managed Service Providers (MSPs) face increasing pressure to comply with robust cybersecurity standards, especially when working with defense contractors. The U.S. Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program directly affects any MSP that manages IT systems, networks, or cloud services for the Defense Industrial Base (DIB). This is because MSPs often have privileged access to environments containing sensitive government data like Controlled Unclassified Information (CUI). CMMC is a 3-tier model designed to enforce these standards, ensuring that contractors and their service providers protect critical data. For example, CMMC Level 1 applies to approximately 140,000 DIB companies, while Level 2 is relevant for about 75,000 DIB companies, demonstrating the wide reach of these regulations. Beyond defense, System and Organization Controls 2 (SOC 2) compliance offers MSPs a crucial way to prove their ability to protect sensitive customer data across various industries. Both certifications are vital for maintaining trust, securing contracts, and avoiding severe penalties in today's complex cybersecurity landscape.

What is CMMC and Why Does it Matter for MSPs?

CMMC, or the Cybersecurity Maturity Model Certification, is a program created by the U.S. Department of Defense (DoD) to enforce strict cybersecurity standards across its Defense Industrial Base (DIB). Its core purpose is to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within the defense supply chain. This program is not just for prime contractors; it flows down to all subcontractors and service providers who handle or have access to DoD data. The CMMC framework ensures that every company involved in the defense ecosystem meets specific security requirements, which are then verified by a third party. This move aims to prevent data leakage and intellectual property theft, making the entire defense supply chain more resilient against cyber threats.

The Evolution of CMMC

CMMC did not appear overnight. It evolved from existing requirements, primarily NIST SP 800-171, which outlined security controls for protecting CUI in nonfederal systems. The significant addition CMMC brought was the element of third-party verification. Before CMMC, contractors would often self-attest to their compliance with NIST SP 800-171. The DoD realized that this self-attestation was not always enough to guarantee the actual implementation of security controls. CMMC bridges this gap by requiring independent assessments, ensuring that companies truly have the security measures in place that they claim. This shift means that simply having policies written down is no longer sufficient; demonstrable implementation and ongoing adherence are now mandatory.

CMMC's Impact on Managed Service Providers

Managed Service Providers (MSPs) are directly and significantly affected by CMMC requirements. MSPs manage a wide range of IT services for their clients, including networks, systems, hosting, and cloud services. For defense contractors, this often means MSPs have privileged access to environments that may contain CUI. This access, whether direct or indirect, places MSPs squarely within the CMMC compliance boundary. If an MSP administers IT systems or cybersecurity tools for a DoD contractor, they are considered CMMC-applicable. This applies even if they do not directly store or process CUI on their own infrastructure, as privileged access to client systems containing CUI is enough to trigger compliance obligations.

CMMC Levels and Scope

CMMC is structured as a 3-tier model, with increasing levels of requirements designed to protect different types of data and against different levels of threats.

CMMC Level 1 focuses on protecting Federal Contract Information (FCI). This level applies to approximately 140,000 DIB companies, requiring them to implement 15 specific security requirements.
CMMC Level 2 is designed for the protection of Controlled Unclassified Information (CUI). This level impacts roughly 75,000 DIB companies and demands compliance with 110 security requirements, aligning closely with NIST SP 800-171 R2.
CMMC Level 3 adds even more advanced security requirements, targeting select DoD programs that need protection against advanced persistent threats.

For MSPs, understanding which level applies is crucial, as the requirements become more stringent with each tier. The goal is to ensure that every link in the defense supply chain maintains strong cybersecurity, and MSPs are recognized as critical links in that chain. When we analyze the broad scope of companies affected, it becomes clear that CMMC is not a niche regulation but a foundational requirement for any MSP looking to serve or continue serving the defense sector.

When Do MSPs Need to Be CMMC Compliant?

MSPs need to be CMMC compliant when they administer IT systems, cybersecurity tools, hosting, networks, or cloud workloads for Department of Defense (DoD) contractors. This obligation arises if the MSP handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on behalf of a client. The scope of CMMC compliance for an MSP is determined by the nature of their access to and interaction with sensitive government data. This means a direct relationship with CUI is not always necessary for compliance; privileged access to systems that contain CUI can also trigger the requirement.

Defining CMMC Scope for MSPs

An MSP falls within CMMC scope under several specific conditions. If an MSP stores CUI data on its own infrastructure, it is in scope. Similarly, if an MSP transmits sensitive information between systems that contain CUI, or processes contractor data that includes CUI, compliance is mandatory. A critical point is that even privileged access to client systems containing CUI, without directly handling the data on the MSP's own systems, places the MSP within the compliance boundary. This "privileged access" can include administrative control over networks, servers, or cloud environments where CUI resides.

For example, if an MSP manages a remote monitoring and management (RMM) tool that collects data from a client's CUI environment, that MSP is in scope. Another instance is if an MSP is an administrator of platforms like Microsoft GCC High or PreVeil, and their access includes client emails or documents containing CUI. In such scenarios, the MSP's systems become part of the CUI environment, necessitating their own CMMC certification. This is a significant clarification for the industry, as many MSPs and MSSPs previously believed they were exempt.

The Cyber-AB Clarification

A pivotal shift in understanding CMMC requirements for External Service Providers (ESPs), including MSPs and Managed Security Service Providers (MSSPs), occurred during a Cyber-AB Town Hall. Matt Travis, CEO of the Cyber AB, clarified the exact conditions under which ESPs must pursue their own CMMC certification. Travis stated that if an ESP, which is not a Cloud Service Provider, stores, processes, or transmits CUI on its own systems—as opposed to merely administering someone else’s systems—then it requires its own CMMC Level 2 certification. This policy clarifies that simply having administrative access to a client's CUI environment, without that data ever touching the MSP's own infrastructure, is different from storing or processing CUI on the MSP's internal systems.

This distinction is vital for MSPs. It means that while many MSPs provide general IT support and administer client systems, those who integrate CUI directly into their own operational infrastructure for storage, processing, or transmission must undergo an independent CMMC Level 2 assessment. If an MSP fails to do this, they will be assessed alongside each of their customers during their respective CMMC assessments. This effectively means a second assessment every time a customer undergoes one, creating a significant burden. This policy marks an important shift for the industry, presenting a dual challenge for many MSPs: managing their own compliance journey while continuing to advise their clients on theirs. Understanding When MSPs Need CMMC Compliance is therefore not just a compliance issue but a strategic business decision.

What are the Consequences of CMMC Non-Compliance?

Failing to meet CMMC standards can create severe problems for Managed Service Providers (MSPs) and their clients. The implications extend beyond simple penalties, affecting business viability, contractual relationships, and market reputation within the defense industrial base. The U.S. Department of Defense (DoD) has designed CMMC to be a mandatory condition for contract awards, meaning non-compliance can directly halt business opportunities. This makes understanding and adhering to CMMC not just a best practice, but a fundamental business requirement for any MSP serving the defense sector.

Contract Loss and Business Impact

One of the most immediate and impactful consequences of CMMC non-compliance is the loss of contracts. If an MSP is not compliant, its defense contractor clients may be unable to win or retain DoD contracts. This is because prime contractors are required to flow CMMC requirements down to their subcontractors and service providers based on the data shared. If a client's service provider (the MSP) cannot prove compliance, the client's overall CMMC status is jeopardized. This creates a domino effect: the client loses business, and, in turn, the MSP loses the client's business. In our analysis, this direct link between MSP compliance and client contract eligibility means non-compliance can lead to significant revenue loss for both parties.

The DoD specifies that "CMMC Status of Level 1, Level 2, or Level 3" is a condition of contract award when included in contracts that process, store, or transmit FCI or CUI. This makes compliance a non-negotiable entry barrier to defense work. MSPs that ignore these requirements risk being excluded from a substantial market segment.

Mandatory Vendor Reporting and Red Flags

During CMMC assessments, defense contractors must meticulously document every vendor, including MSPs, that has access to their CUI systems. For a non-compliant MSP, this documentation becomes a significant red flag. Assessors will identify these vendors, flagging them as potential weak points in the contractor's cybersecurity posture. This can lead to increased scrutiny for the contractor and potentially prevent them from achieving their desired CMMC level. In essence, an MSP's non-compliance can directly impede its client's ability to pass their own CMMC audit. This mandatory reporting mechanism ensures that the entire supply chain is held accountable, emphasizing the interconnectedness of cybersecurity within the DIB.

Suspension and Reputational Damage

Beyond contract loss and reporting issues, the DoD holds the power to suspend or even permanently bar MSPs from working with defense contractors. This is a severe consequence that can effectively end an MSP's ability to operate within the defense sector. Such a suspension can be devastating, cutting off a vital revenue stream and potentially forcing the MSP to re-evaluate its business model entirely.

Furthermore, non-compliance carries significant reputational damage. The defense community is tightly knit, and news of security risks spreads quickly. An MSP marked as non-compliant or a security risk will find it incredibly difficult to attract new defense clients or retain existing ones, even if they manage to avoid formal suspension. This reputational harm can extend beyond the defense sector, impacting the MSP's credibility and trustworthiness with clients in other industries who also prioritize strong cybersecurity. The defense supply chain relies on every link maintaining strong cybersecurity, and MSPs are critical links in that chain. Understanding CMMC Requirements for MSPs is not optional; it is a business imperative.

What are the CMMC Levels?

CMMC is structured as a three-tier model, each level building upon the previous one with increasing security requirements and assessment rigor. This tiered approach allows the Department of Defense (DoD) to apply appropriate cybersecurity standards based on the sensitivity of the information handled by defense contractors and their service providers. The levels ensure a scalable and verifiable framework for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the Defense Industrial Base (DIB).

CMMC Level 1: Foundational Safeguards for FCI

CMMC Level 1 is the most basic tier, focused on protecting Federal Contract Information (FCI). FCI is information, not intended for public release, that is provided by or generated for the Government under a contract. For example, it includes information that is not CUI. This level validates full compliance with existing regulations, specifically focusing on basic cyber hygiene practices. It requires the implementation of 15 security requirements. These requirements are foundational and typically involve practices like identifying and classifying FCI, controlling access, and ensuring basic system integrity.

The assessment type for CMMC Level 1 is a self-assessment, which contractors must conduct annually. This means companies at this level are responsible for verifying their own adherence to the 15 security requirements. This level is designed for the approximately 140,000 DIB companies that handle FCI but not CUI. It serves as an entry point for many organizations into the CMMC framework, establishing a baseline of cybersecurity practices.

CMMC Level 2: Protecting CUI with NIST SP 800-171

CMMC Level 2 is the core level for protecting Controlled Unclassified Information (CUI). CUI is government-created or owned information that requires safeguarding or dissemination controls pursuant to law, regulation, or government-wide policy. This level is significantly more robust than Level 1, requiring the implementation of 110 security requirements. These requirements align directly with NIST SP 800-171 R2, which is mandated by DFARS 252.204-7012. NIST SP 800-171 outlines a comprehensive set of security controls covering areas such as access control, incident response, system integrity, and physical protection.

For the approximately 75,000 DIB companies that handle CUI, CMMC Level 2 is critical. The assessment for Level 2 can be either a self-assessment or conducted by a CMMC Third-Party Organization (C3PAO), as specified in the contract. This flexibility allows the DoD to tailor assessment requirements based on the specific contract and risk profile. However, the trend is towards C3PAO assessments for many CUI-handling contracts, emphasizing the need for independent verification. This level ensures that organizations have a robust cybersecurity posture capable of protecting sensitive unclassified government information from common threats.

CMMC Level 3: Advanced Protection Against Persistent Threats

CMMC Level 3 is the highest tier, designed for select DoD programs that require enhanced protection against advanced persistent threats (APTs). This level builds upon the 110 requirements of Level 2 by adding and validating additional security requirements. These extra controls are derived from NIST SP 800-172, which focuses on advanced cybersecurity capabilities to counter sophisticated adversaries. Level 3 is intended for a smaller subset of defense contractors handling the most sensitive CUI, where the consequences of compromise would be particularly severe.

The assessment for CMMC Level 3 is conducted by government assessors, ensuring the highest level of scrutiny and verification. This level goes beyond basic cyber hygiene and even standard CUI protection, aiming to fortify systems against highly skilled and persistent attackers. Each CMMC level represents a progressive increase in cybersecurity maturity, ensuring that the defense supply chain is protected proportionate to the sensitivity of the data it handles. MSPs serving clients at any of these levels must understand and meet the corresponding requirements to remain viable partners in the defense ecosystem. The CMMC framework aligns to several NIST Special Publications, including NIST SP 800-171 R2, NIST SP 800-171A Jun2018, NIST SP 800-172 Feb2021, and NIST SP 800-172A Mar2022.

What is SOC 2 Compliance and Why is it Important for MSPs?

System and Organization Controls 2 (SOC 2) is a data security standard that proves a business can protect sensitive customer data. It is not a government mandate like CMMC, but rather an auditing procedure developed by the American Institute of Certified Public Accountants (AICPA). For Managed Service Providers (MSPs), achieving SOC 2 attestation demonstrates a commitment to robust internal controls regarding the security, availability, processing integrity, confidentiality, and privacy of client data. This attestation is increasingly vital for MSPs seeking to build trust and secure new business opportunities in a data-conscious marketplace.

The Value of SOC 2 as a Competitive Differentiator

In today's competitive landscape, SOC 2 compliance serves as a significant competitive differentiator for MSPs. It provides independent assurance that an MSP's systems and processes meet stringent security standards. This assurance is often a deciding factor in winning enterprise deals, particularly in industries where data security is paramount. For example, SaaS companies, fintech firms, and healthcare providers routinely require their service providers to be SOC 2 compliant before entering into contracts. These industries handle vast amounts of sensitive personal and financial data, making robust data protection a non-negotiable expectation.

Without SOC 2 compliance, an MSP might find itself excluded from lucrative opportunities, regardless of the quality of its other services. It signals to potential clients that the MSP takes data security seriously and has implemented the necessary controls to protect their information. This builds confidence and reduces the perceived risk of outsourcing IT services. When we compare MSPs, those with SOC 2 often stand out as more reliable and trustworthy partners for organizations with high data security demands. It is a tangible way to prove an MSP's capability to protect sensitive customer data.

The Trust Services Criteria

SOC 2 reports are based on the AICPA's Trust Services Criteria, which define the principles for managing customer data. These criteria include:

Security: Protection against unauthorized access, use, or modification of information. This is the baseline and mandatory criterion for all SOC 2 reports.
Availability: Ensuring that systems are available for operation and use as agreed.
Processing Integrity: Confirming that system processing is complete, valid, accurate, timely, and authorized.
Confidentiality: Protecting information designated as confidential from unauthorized access or disclosure.
Privacy: Handling personal information in accordance with privacy principles.

An MSP can choose which of these criteria to include in its SOC 2 audit, though Security is always required. The specific criteria chosen depend on the services the MSP provides and the nature of the data it handles. By demonstrating adherence to these criteria, an MSP shows that it has implemented comprehensive controls across its operations, from network security to data backup and incident response. This holistic approach to data protection is what makes SOC 2 so valuable to clients. As MSPs increasingly operate in cloud environments and handle confidential data for numerous clients, SOC 2 attestation has become particularly important. According to SOC 2 Compliance for MSPs, this standard matters greatly for MSPs.

Beyond Compliance: Operational Benefits

While SOC 2 is primarily about external assurance, pursuing compliance also brings significant internal benefits to an MSP. The process of preparing for a SOC 2 audit forces an organization to formalize its security policies, procedures, and controls. This often leads to improved operational efficiency, better risk management, and a more mature security posture overall. By identifying and addressing control gaps, an MSP can strengthen its defenses against cyber threats, reduce the likelihood of data breaches, and enhance its ability to respond effectively if an incident occurs.

Moreover, having a SOC 2 report streamlines due diligence processes for potential clients. Instead of answering lengthy security questionnaires from each prospect, an MSP can present its SOC 2 report as comprehensive proof of its security capabilities. This saves time and resources for both the MSP and its clients, accelerating sales cycles and fostering stronger business relationships. In essence, SOC 2 compliance is not just a checkbox; it's an investment in an MSP's security maturity, marketability, and long-term success.

How Do MSPs Approach CMMC and SOC 2 Compliance?

Managed Service Providers (MSPs) approach CMMC and SOC 2 compliance through a combination of strategic planning, internal process improvements, and often, by leveraging their own expertise to offer these services to clients. The path to compliance for each standard differs, reflecting their distinct purposes and requirements, but both demand a rigorous focus on data security and operational integrity. For MSPs, these compliance journeys are not just about meeting regulatory demands; they can also be transformed into profitable service models and significant competitive advantages.

Turning CMMC into a Service Model

For MSPs serving the defense sector, CMMC compliance is a dual challenge: achieving it internally while also guiding clients through their own compliance journeys. The good news is that MSPs can turn CMMC compliance into a profitable service model. By developing deep expertise in CMMC standards, MSPs can offer specialized cybersecurity solutions and ongoing compliance support to defense contractors. This positions them as trusted partners in the defense ecosystem, helping clients navigate the complex requirements of protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

This involves offering services like CMMC gap assessments, implementation of NIST SP 800-171 controls, security architecture design, and continuous monitoring. Managed Security Service Providers (MSSPs), in particular, are well-positioned for this, as their core focus is on IT security. An MSSP provides IT security by adding technology, processes, and services to proactively protect businesses, scanning networks for threats, and remediating vulnerabilities. Their expertise in proactive threat detection and response aligns perfectly with the robust requirements of CMMC, especially at Level 2 and Level 3. By becoming CMMC-compliant themselves, MSPs gain firsthand experience and credibility, which they can then offer as a service to their clients. Finding the right Managed Service Provider (MSP) for CMMC compliance could be one of, if not the most important step for defense contractors supporting the Department of Defense.

Navigating CMMC for Internal Operations

When it comes to internal CMMC compliance, MSPs must first determine their exact scope. This means understanding whether they are storing, processing, or transmitting CUI on their own systems, or simply administering client systems that contain CUI. As Matt Travis, CEO of the Cyber AB, clarified, "If an ESP (that is not a Cloud Service Provider) is storing, processing, or transmitting CUI on their own systems—not just administering someone else’s systems—then they require their own Level 2 CMMC certification." This distinction is critical. If an MSP's own RMM tools, PSA systems, or other internal infrastructure handle CUI, they must undergo an independent CMMC Level 2 assessment.

This often involves a comprehensive review of their internal IT environment, implementing the 110 security requirements of NIST SP 800-171, and preparing for a potential C3PAO audit. It's a rigorous process that demands investment in tools, training, and documentation. However, achieving this internal compliance not only protects the MSP from penalties but also enhances its credibility and marketability to defense clients. It demonstrates a practical understanding of the challenges clients face and showcases the MSP's ability to meet stringent security standards.

Achieving SOC 2 Compliance

The approach to SOC 2 compliance is different from CMMC, as it focuses on demonstrating control over an MSP's systems and processes to protect client data, often involving a third-party audit against the AICPA's Trust Services Criteria. For SOC 2, MSPs typically begin with a readiness assessment to identify gaps in their security controls and policies. This assessment covers areas like access control, change management, incident response, and data encryption. Based on the findings, the MSP then implements necessary controls, formalizes procedures, and gathers evidence of their effectiveness.

The next step is to engage an independent CPA firm to conduct the SOC 2 audit, which results in a SOC 2 Type 1 or Type 2 report. A Type 1 report describes the MSP's systems and the suitability of the design of its controls at a specific point in time. A Type 2 report goes further, detailing the operating effectiveness of those controls over a period, typically six to twelve months. This ongoing monitoring and evidence collection are crucial for Type 2. Achieving SOC 2 compliance requires consistent effort and a culture of security throughout the organization. It proves a business can protect sensitive customer data, making it a critical differentiator for MSPs aiming to serve enterprise clients across various industries.

Frequently Asked Questions

What is the primary purpose of CMMC?

The primary purpose of CMMC is to enforce strict cybersecurity standards across the U.S. Defense Industrial Base (DIB) to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It ensures that all contractors and subcontractors handling DoD data implement and verify cybersecurity controls, preventing data leakage and intellectual property theft. CMMC is a 3-tier model, with Level 1 applying to approximately 140,000 DIB companies and Level 2 to about 75,000 DIB companies, demonstrating its broad reach.

Does an MSP always need CMMC compliance if their client handles CUI?

An MSP does not always need its own independent CMMC certification if its client handles CUI. The requirement depends on whether the MSP stores, processes, or transmits CUI on its own systems. If the MSP only administers a client's systems without CUI touching the MSP's infrastructure, they might be assessed with the client or be out of scope. However, if an MSP manages tools like RMM that collect data from a CUI environment or has privileged access to client emails or documents containing CUI on their own platforms, they will need their own CMMC Level 2 certification.

What kind of data does CMMC Level 1 cover?

CMMC Level 1 covers Federal Contract Information (FCI). FCI is information, not intended for public release, that is provided by or generated for the Government under a contract. It is distinct from Controlled Unclassified Information (CUI) and requires a baseline of cybersecurity practices. CMMC Level 1 requires the implementation of 15 security requirements, with compliance verified through an annual self-assessment.

How is an MSSP different from an MSP regarding security?

An MSSP (Managed Security Service Provider) differs from an MSP (Managed Service Provider) in its specialized focus. While an MSP provides general IT management to support day-to-day business operations, an MSSP specifically provides IT security services. MSSPs add technology, processes, and expertise to proactively protect businesses, often including services like network scanning for threats and vulnerability remediation. This security-centric approach makes MSSPs particularly well-suited to help clients achieve and maintain CMMC compliance.

Why is SOC 2 compliance important for an MSP's business growth?

SOC 2 compliance is crucial for an MSP's business growth because it acts as a competitive differentiator and builds trust with potential clients. It proves that an MSP can protect sensitive customer data according to the AICPA's Trust Services Criteria. This attestation is often a deciding factor in winning enterprise deals, especially in data-sensitive industries like SaaS, fintech, and healthcare, where data security is a non-negotiable expectation. It signals a mature security posture and reduces the perceived risk for companies outsourcing their IT services.