GDPR Compliance for US MSPs

Last updated: April 2026

Affiliate Disclosure: We may earn a commission when you purchase through our links. This does not affect our editorial independence.

Quick Answer

CMMC is a 3-tier model designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within the defense supply chain.
Roughly 75,000 Defense Industrial Base (DIB) companies handle CUI and are required to achieve CMMC Level 2 compliance.
Managed Service Providers (MSPs) must meet CMMC standards if they store, process, or transmit CUI on their own systems or have privileged access to client systems containing CUI.
Failing to comply with CMMC can lead to contract loss for both the MSP and its clients, reputational damage, and potential suspension from defense work for the MSP.

The U.S. Department of Defense (DoD) created the Cybersecurity Maturity Model Certification (CMMC) to enforce strict cybersecurity standards across the Defense Industrial Base (DIB), making CMMC compliance a critical requirement for any Managed Service Provider (MSP) working with defense contractors. This framework is a 3-tier model with increasing requirements aimed at protecting both Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC Level 1 specifically applies to approximately 140,000 DIB companies that handle FCI, requiring them to meet 15 security requirements through annual self-assessments. However, for the roughly 75,000 DIB companies that manage CUI, CMMC Level 2 is mandatory, demanding adherence to 110 security requirements. MSPs are directly affected by these rules, especially if they manage networks, systems, or cloud services that involve sensitive government data. If an MSP stores, processes, or transmits CUI on its own infrastructure, it must undergo an independent CMMC Level 2 assessment, a shift clarified by Matt Travis, CEO of the Cyber AB.

What is CMMC and Why Does it Matter for MSPs?

CMMC is a vital cybersecurity framework established by the U.S. Department of Defense to strengthen the security posture of the entire Defense Industrial Base. It is a three-tier model, with each level introducing stricter requirements to safeguard sensitive government data. The program's primary goal is to prevent data leakage and intellectual property theft by adding a layer of third-party verification to existing cybersecurity standards, particularly those outlined in NIST SP 800-171. This means that contractors and subcontractors working with the DoD must not only claim to implement security controls but also prove they have them in place.

The Purpose of CMMC in the Defense Industrial Base

The U.S. Department of Defense created the Cybersecurity Maturity Model Certification (CMMC) to enforce strict cybersecurity standards across the Defense Industrial Base (DIB). This initiative ensures that every contractor and subcontractor involved in the defense supply chain, especially those handling sensitive government data, meets specific security requirements. CMMC evolved from NIST SP 800-171 requirements, adding third-party verification to stop data leakage and intellectual property theft. The program ensures that contractors actually implement the security controls they claim to have in place. This is crucial because the defense supply chain depends on every link maintaining strong cybersecurity, and MSPs are critical links in that chain. The CMMC framework aims to build trust and resilience across the DIB by standardizing and verifying cybersecurity practices.

CMMC's Tiered Structure and Data Protection

CMMC operates on a 3-tier model, with each level dictating increasing requirements for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

CMMC Level 1: This level applies to approximately 140,000 DIB companies. These companies handle Federal Contract Information (FCI), which is information not intended for public release but also not classified. To achieve Level 1 compliance, organizations must meet 15 security requirements. The assessment for Level 1 is a self-assessment, which must be performed annually. This basic level ensures fundamental cybersecurity hygiene for contractors who only handle FCI.
CMMC Level 2: This level is applicable to roughly 75,000 DIB companies. These organizations deal with Controlled Unclassified Information (CUI), which is government-created or owned information that requires safeguarding or dissemination controls. DFARS 252.204-7012 already requires NIST SP 800-171 R2 compliance for CUI. CMMC Level 2 validates full compliance with these existing regulations, requiring 110 security requirements. The assessment type for Level 2 can be a self-assessment or a CMMC Third-Party Organization (C3PAO) assessment, as specified in the contract.
CMMC Level 3: This level adds and validates additional security requirements for select DoD programs. It aims to increase protection against advanced persistent threats by incorporating NIST SP 800-172 Feb2021 and NIST SP 800-172A Mar2022. The requirements at this level are significantly more stringent, designed for the most critical defense programs.

The Direct Impact on Managed Service Providers

Managed Service Providers (MSPs) are directly affected by these CMMC rules. MSPs manage networks, systems, and cloud services for their clients, who often include defense contractors. Because MSPs frequently have privileged access to contractor environments that may contain CUI, they must meet the same security standards as their defense contractor clients. If an MSP administers IT systems, cybersecurity tools, hosting, networks, or cloud workloads for DoD contractors, and handles Federal Contract Information (FCI) or CUI on behalf of a client, it falls under CMMC scope. This means understanding CMMC requirements for MSPs is not just important; it is essential for any service provider working with defense contractors. The "CMMC Status of Level 1, Level 2, or Level 3" is a condition of contract award when included in contracts that process, store, or transmit FCI or CUI, and prime contractors flow these requirements down to subcontractors based on the data shared.

When Does an MSP Need Its Own CMMC Level 2 Certification?

The need for an MSP to achieve its own CMMC Level 2 certification depends entirely on the nature of the services it provides and its interaction with Controlled Unclassified Information (CUI). If an MSP's operations involve storing, processing, or transmitting CUI on its own systems, or if it has privileged access to client systems containing CUI, then it is directly in scope for CMMC compliance. This policy marks an important shift for the industry, as many MSPs and Managed Security Service Providers (MSSPs) now face a dual challenge: pursuing their own compliance journey while continuing to advise their clients on theirs.

Defining CMMC Scope for MSPs

A CMMC-applicable MSP is any service provider that administers IT systems, cybersecurity tools, hosting, networks, or cloud workloads for DoD contractors. If you handle Federal Contract Information (FCI) or CUI on behalf of a client, you fall under CMMC scope. This includes several key scenarios:

Storing CUI data on your infrastructure: If your servers, cloud storage, or other systems directly hold CUI from your defense contractor clients, you are in scope.
Transmitting sensitive information between systems: If your services involve moving CUI between different systems, whether client-owned or your own, this activity places you under CMMC requirements.
Processing contractor data that includes CUI: Any operations that involve reading, modifying, or otherwise interacting with CUI as part of your service delivery put you in scope.
Having privileged access to client systems containing CUI: Even if you don't directly handle the data on your own systems, privileged access to a client's CUI environment means you are within the compliance boundary. This access could allow you to view, alter, or potentially exfiltrate CUI, making your security posture critical.

The Independent CMMC Level 2 Assessment Requirement

A significant clarification regarding MSP compliance came from Matt Travis, CEO of the Cyber AB, during a May Cyber-AB Town Hall. He stated, "If an ESP (that is not a Cloud Service Provider) is storing, processing, or transmitting CUI on their own systems—not just administering someone else’s systems—then they require their own Level 2 CMMC certification." This means that if your organization stores, processes, or transmits CUI on your own systems, you must undergo a CMMC Level 2 assessment independently from your clients. Failure to do so means you will be assessed in addition to the customer’s assessment, effectively requiring a second assessment each time one of your customers gets assessed. This emphasizes that simply providing general IT support does not necessarily exempt an MSP from CMMC if CUI touches their infrastructure or privileged access.

Specific Scenarios Requiring MSP Certification

Several common MSP activities would necessitate an independent CMMC Level 2 certification:

Remote Monitoring and Management (RMM) Tools: If you manage a remote monitoring and management (RMM) tool that collects data from your client’s CUI environment, this data collection on your systems makes you responsible for CMMC compliance.
Administrator Access to CUI Environments: If you are an administrator of platforms like Microsoft GCC High or PreVeil, and your access includes client emails or documents containing CUI, your systems and access methods must be CMMC compliant. This is because your access grants you the ability to interact with and potentially influence the security of CUI.
Managed Security Services: If your Managed Security Service Provider (MSSP) offers security monitoring, incident response, or vulnerability management services that involve collecting or processing CUI from client environments on your own security platforms, you will need your own CMMC certification.

Understanding when MSPs need CMMC compliance is crucial for business continuity and client relationships in the defense sector. The implications of this policy shift are profound, requiring many MSPs to proactively pursue their own CMMC Level 2 certification to remain viable partners for defense contractors.

What Are the Consequences of Non-Compliance for MSPs?

Failing to meet CMMC standards creates serious problems for Managed Service Providers (MSPs) and their defense contractor clients. The U.S. Department of Defense (DoD) established CMMC to ensure the integrity and security of the entire defense supply chain. When an MSP, a critical link in this chain, does not comply, it introduces significant risks that can lead to severe business repercussions. These consequences extend beyond just the MSP, impacting the ability of their clients to secure and maintain DoD contracts.

Loss of Contracts and Business Opportunities

One of the most immediate and severe consequences of CMMC non-compliance for an MSP is the potential loss of contracts. Defense contractors cannot win or retain DoD contracts if their service providers are not compliant with CMMC requirements. This means that if an MSP supports a contractor handling CUI and the MSP itself is not compliant, the contractor will be unable to bid on or continue working on DoD projects. This directly translates to lost business for the contractor, which in turn leads to lost business for the non-compliant MSP. The DoD specifies that "CMMC Status of Level 1, Level 2, or Level 3" is a condition of contract award when included in contracts that process, store, or transmit FCI or CUI. This makes compliance a mandatory prerequisite for participation in the defense industrial base. The flow-down of these requirements from prime contractors to subcontractors means that MSPs must be prepared to demonstrate their compliance to their clients.

Mandatory Vendor Reporting and Red Flags

During CMMC assessments, contractors are required to document every vendor that has access to their CUI systems. This includes their MSPs and any other external service providers. If an MSP is identified as non-compliant, it immediately becomes a red flag during the assessment process. This non-compliance can jeopardize the client's own certification, as the security posture of their entire ecosystem, including third-party providers, is scrutinized. An MSP that cannot demonstrate CMMC compliance will be noted as a security risk, potentially causing delays, additional scrutiny, or even outright failure in the client's assessment. This scrutiny highlights the interconnectedness of cybersecurity in the defense supply chain, where the weakest link can compromise the entire chain.

Suspension from Defense Work

The DoD has the authority to take direct action against non-compliant MSPs. This can include suspending or outright barring MSPs from working with defense contractors. Such a suspension would effectively cut off an MSP from a significant market segment, especially for those who have built a business around serving the Defense Industrial Base (DIB). This consequence is a powerful motivator for MSPs to prioritize CMMC compliance, as it directly affects their ability to operate within this sector. The rules are clear: understanding CMMC compliance for IT providers isn't optional anymore; it's a business requirement for any MSP serving the defense sector. The defense supply chain relies on every link maintaining strong cybersecurity, and MSPs are critical links in that chain.

Reputational Damage

Beyond financial and operational penalties, non-compliance carries a significant risk of reputational damage. The defense community is a closely-knit network, and word spreads fast about security risks. An MSP flagged for CMMC non-compliance will quickly be marked as unreliable and a potential security liability. This can make it extremely difficult to attract new defense contractor clients and may even lead to existing clients seeking more compliant alternatives. Reputational damage can be long-lasting and costly to repair, affecting an MSP's ability to compete in the broader market, not just within the defense sector. In an industry where trust and security are paramount, a tarnished reputation can be a death knell for a service provider.

How Do MSPs Turn CMMC Compliance into a Business Opportunity?

CMMC compliance, while presenting significant challenges, also offers a unique and profitable business opportunity for Managed Service Providers (MSPs). By proactively meeting these rigorous cybersecurity standards, MSPs can differentiate themselves in the market, build specialized service offerings, and become indispensable partners to defense contractors struggling with their own compliance journeys. This strategic approach transforms a regulatory burden into a competitive advantage, opening new revenue streams and strengthening client relationships within the lucrative defense sector.

Becoming a Trusted Partner in the Defense Ecosystem

MSPs can leverage CMMC compliance by offering cybersecurity solutions that align with CMMC standards. This goes beyond just meeting the minimum requirements for their own operations. By developing expertise in CMMC, MSPs can guide their defense contractor clients through the complex compliance process. This positioning allows MSPs to become trusted partners in the defense ecosystem, a role that commands higher value and deeper client relationships. Defense contractors, particularly the roughly 75,000 DIB companies handling CUI that need CMMC Level 2, often lack the in-house expertise or resources to navigate these requirements alone. An MSP that is already compliant and proficient in CMMC can step in to fill this gap, offering peace of mind and specialized knowledge.

Offering Specialized Cybersecurity Solutions and Support

The need for CMMC compliance creates a demand for specialized cybersecurity services. MSPs can capitalize on this by developing and marketing service packages tailored specifically to CMMC requirements. These services could include:

CMMC Gap Analysis: Helping clients identify where their current security posture falls short of CMMC Level 1, 2, or 3 requirements.
Implementation of CMMC Controls: Assisting clients in implementing the 15 security requirements for Level 1 or the 110 security requirements for Level 2, which align with NIST SP 800-171 R2.
Managed Security Services for CUI: Providing ongoing monitoring, threat detection, and incident response services specifically designed to protect CUI environments in accordance with CMMC standards.
Assessment Preparation: Guiding clients through the preparation for CMMC self-assessments (for Level 1 or some Level 2 scenarios) or C3PAO assessments (for Level 2).
Documentation and Policy Development: Helping clients create the necessary policies, procedures, and documentation required to demonstrate compliance.

By providing ongoing compliance support, MSPs can ensure their clients remain compliant year after year, fostering long-term engagements. This continuous support is vital, as CMMC compliance is not a one-time event but an ongoing commitment to maintaining robust cybersecurity. For more details, see CMMC technical application requirements.

Strategic Positioning in a Growing Market

Understanding cmmc compliance for it providers is no longer optional; it is a business requirement for any MSP serving the defense sector. This regulatory mandate creates a barrier to entry for non-compliant providers, effectively reducing competition for those who invest in compliance. For MSPs looking to grow their business, this means:

Market Differentiation: Being CMMC compliant distinguishes an MSP from competitors who are not, making them more attractive to defense contractors.
Access to New Clients: Compliance opens doors to a vast market of defense contractors who desperately need compliant service providers.
Premium Service Offerings: The specialized nature of CMMC compliance allows MSPs to charge premium rates for their expert services.
Enhanced Reputation: As mentioned earlier, while non-compliance damages reputation, achieving compliance builds a strong reputation as a secure and reliable partner within the defense community.

In essence, CMMC compliance transforms from a mere regulatory hurdle into a strategic imperative that can drive significant growth and profitability for discerning MSPs. By embracing these standards, managed service providers can become indispensable partners in safeguarding the nation's defense supply chain.

What is the Difference Between an MSP and an MSSP in the Context of CMMC?

While both Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) offer outsourced IT services, their primary focus areas differ significantly, especially when considering the stringent requirements of CMMC. Understanding this distinction is crucial for defense contractors seeking compliance support and for the service providers themselves in defining their scope and responsibilities under the CMMC framework. Both types of providers can fall under CMMC scope, but their specific roles in handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) will determine their compliance obligations.

Defining the Roles: MSP vs. MSSP

The core difference between an MSP and an MSSP lies in the nature of the services they prioritize:

Managed Service Provider (MSP): An MSP primarily focuses on general IT management to support your day-to-day business operations. This typically includes services like network management, system administration, hardware and software support, data backup and recovery, and cloud service management. Their goal is to ensure the smooth, efficient, and reliable operation of a client's IT infrastructure. An MSP ensures that an organization's technology functions as expected, allowing the client to focus on its core business activities.
Managed Security Service Provider (MSSP): An MSSP, on the other hand, provides specialized IT security services for your business. Their offerings go beyond general IT management to include technology, processes, and proactive protection measures. This often involves services such as continuous security monitoring, threat detection and prevention, vulnerability scanning and remediation, intrusion detection systems, security information and event management (SIEM), and incident response. The primary objective of an MSSP is to actively protect the business from cyber threats and ensure its security posture is robust against evolving risks.

Overlap and Distinct Responsibilities Under CMMC

While their primary focuses differ, there is often an overlap in their service delivery, especially as cybersecurity becomes an integral part of all IT operations. In the context of CMMC, both MSPs and MSSPs can be considered External Service Providers (ESPs) and thus subject to CMMC requirements if they interact with FCI or CUI.

MSPs and CMMC: If an MSP manages a client's network or cloud environment where CUI is stored, processed, or transmitted, or if the MSP has privileged access to these systems, the MSP itself falls under CMMC scope. For example, if an MSP administers IT systems, cybersecurity tools, hosting, networks, or cloud workloads for DoD contractors, and handles FCI or CUI on behalf of a client, it must meet the same security standards as its defense contractor clients. This is true even if the MSP's primary role is general IT support, as the access and interaction with sensitive data trigger compliance.
MSSPs and CMMC: MSSPs, by their very nature, are deeply involved in cybersecurity. If an MSSP is providing security services for a defense contractor that handles CUI, and those services involve storing, processing, or transmitting that CUI on the MSSP's own systems (e.g., a Security Operations Center (SOC) collecting CUI-related logs), then the MSSP absolutely requires its own CMMC Level 2 certification. This is especially relevant if the MSSP is actively scanning client networks for threats or remediating vulnerabilities in environments containing CUI, as these actions typically involve direct interaction with the sensitive data.

The key determinant for CMMC applicability for both MSPs and MSSPs is whether they store, process, or transmit CUI on their own systems or have privileged access to client systems containing CUI. This means that while an MSP might initially believe it's only offering "general IT support," if that support involves managing a remote monitoring and management (RMM) tool that collects data from a client’s CUI environment, or if their access to client emails or documents in Microsoft GCC High or PreVeil includes CUI, then they must pursue their own CMMC Level 2 certification. Finding the right Managed Service Provider (MSP) for CMMC compliance could be one of, if not the most important step for defense contractors supporting the Department of Defense, and this choice often involves understanding the specific capabilities and compliance status of both MSPs and MSSPs. Therefore, whether you are an MSP or an MSSP, if you serve the defense sector, CMMC compliance is a critical consideration for your business model.

How Does SOC 2 Compliance Relate to CMMC for MSPs?

While CMMC (Cybersecurity Maturity Model Certification) is specifically designed for the U.S. Department of Defense supply chain, Service Organization Control 2 (SOC 2) compliance offers a broader, yet highly relevant, framework for data security that can significantly benefit Managed Service Providers (MSPs) serving the defense sector and beyond. SOC 2 attestation proves a business can protect sensitive customer data, making it a competitive differentiator and a valuable complement to CMMC efforts by demonstrating a strong overall security posture.

Understanding SOC 2 Compliance

Service Organization Control for Service Organizations (SOC 2) attestation is a data security regulation that has become particularly important in recent years. It is a set of auditing standards developed by the American Institute of Certified Public Accountants (AICPA) for service organizations to demonstrate that they can securely manage data to protect the interests of their clients and the privacy of their clients' customers. SOC 2 reports evaluate an organization's information security system based on the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Trust Services Criteria:
- Security: Protection against unauthorized access (both physical and logical). This is the foundational criterion and must be included in every SOC 2 report.
- Availability: The system is available for operation and use as committed or agreed.
- Processing Integrity: System processing is complete, accurate, timely, and authorized.
- Confidentiality: Information designated as confidential is protected as committed or agreed.
- Privacy: Personal information is collected, used, retained, disclosed, and disposed of in conformity with the commitments in the entity’s privacy notice and with criteria set forth in Generally Accepted Privacy Principles (GAPP).

SOC 2 compliance is not a one-time certification but an ongoing commitment, with reports typically issued annually after an audit by an independent CPA firm. Learn why this data security standard matters for MSPs.

SOC 2 as a Competitive Differentiator for MSPs

For MSPs, achieving SOC 2 compliance is a powerful competitive differentiator that proves a business can protect sensitive customer data. It is often a deciding factor in winning enterprise deals, especially in industries such as SaaS, fintech, and healthcare, where data security is expected. Clients in these sectors rely heavily on their service providers to safeguard their confidential information and are increasingly demanding evidence of robust security controls. A SOC 2 report provides this assurance, demonstrating that an MSP has implemented rigorous internal controls over information security.

Winning Enterprise Deals: Many large organizations, particularly those in highly regulated industries, require their vendors, including MSPs, to be SOC 2 compliant before entering into contracts. This is because these organizations are themselves accountable for the security of their data, even when it's handled by third parties.
Building Trust: In an era where the cloud and countless applications host confidential data, data security and privacy regulations aren’t simply matters of grave importance to modern businesses for the sole sake of maintaining tight control over their internal information security matters. They’ve become increasingly crucial to end users as well. SOC 2 compliance helps an MSP build trust with potential and existing clients by formally validating their security practices.
Internal Security Improvement: The process of preparing for a SOC 2 audit often leads to significant improvements in an MSP's internal security policies, procedures, and technologies, making the organization more secure overall.

Complementing CMMC with SOC 2

While CMMC directly addresses the specific requirements for handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) for DoD contractors, SOC 2 demonstrates broader data security and privacy controls. An MSP that is pursuing or has achieved CMMC compliance can use SOC 2 as an additional layer of assurance and a demonstration of a comprehensive security posture.

Broader Security Posture: CMMC focuses on a specific set of controls aligned with NIST SP 800-171 R2 and NIST SP 800-172. SOC 2, by addressing the Trust Services Criteria, demonstrates a wider organizational commitment to security, availability, processing integrity, confidentiality, and privacy. This broader scope can be appealing to clients who may not be in the defense sector but still demand high security standards.
Operational Excellence: The process of achieving SOC 2 compliance often forces MSPs to formalize and document their operational processes, which can indirectly aid in meeting certain CMMC requirements related to system documentation, access control, and incident response.
Market Appeal: For MSPs serving a diverse client base, including both defense contractors and commercial entities, SOC 2 offers a universally recognized standard of security assurance. It can attract clients outside the DIB while still complementing the CMMC efforts for defense clients.

In summary, while CMMC is mandatory for MSPs working with the DoD and handling CUI, SOC 2 compliance can serve as a powerful tool to enhance an MSP's overall security credibility, attract a wider range of clients, and demonstrate a commitment to data protection that aligns well with the principles underpinning CMMC. This strategic approach allows MSPs to solidify their position as secure and reliable service providers in a competitive market.

Frequently Asked Questions

What is CMMC Level 1 compliance?

CMMC Level 1 compliance is the foundational tier of the Cybersecurity Maturity Model Certification. It applies to approximately 140,000 Defense Industrial Base (DIB) companies that handle Federal Contract Information (FCI), which is information not classified but also not publicly released. To achieve Level 1, organizations must implement 15 basic security requirements, focusing on fundamental cybersecurity hygiene. Compliance for Level 1 is demonstrated through an annual self-assessment.

Do MSPs always need their own CMMC Level 2 certification?

No, MSPs do not always need their own CMMC Level 2 certification. The requirement depends on their interaction with Controlled Unclassified Information (CUI). If an MSP stores, processes, or transmits CUI on its own systems, or has privileged access to client systems containing CUI, then it must undergo an independent CMMC Level 2 assessment. If an MSP only provides general IT support without touching CUI on its own systems, it may not need its own certification but will still be part of the client's CMMC assessment scope.

What kind of data triggers CMMC compliance for an MSP?

CMMC compliance for an MSP is triggered by handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). FCI requires CMMC Level 1, involving 15 security requirements. CUI, which is more sensitive government information requiring safeguarding, triggers CMMC Level 2, demanding 110 security requirements aligned with NIST SP 800-171 R2. If an MSP's systems or privileged access interact with either type of data on behalf of a DoD contractor, CMMC requirements apply.

Can an MSP help a client achieve CMMC compliance without being compliant itself?

An MSP can advise a client on CMMC compliance, but if the MSP itself stores, processes, or transmits CUI on its own systems, or has privileged access to client systems containing CUI, it must be compliant. If the MSP is non-compliant, it becomes a red flag during the client's CMMC assessment, potentially leading to contract loss for both parties. Therefore, for most practical scenarios involving CUI, an MSP needs to pursue its own CMMC Level 2 certification to effectively support its defense contractor clients.

What is the difference between an MSP and an MSSP?

An MSP (Managed Service Provider) focuses on general IT management, supporting day-to-day business operations like network management and system administration. An MSSP (Managed Security Service Provider) specializes in IT security services, providing proactive protection, threat detection, and vulnerability remediation. Both can fall under CMMC scope if they handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) for DoD contractors, but MSSPs are inherently more focused on the security aspects that CMMC addresses.