CMMC for MSPs: Does Your MSP Need It, and What Applies Now

Last updated: October 1, 2026

Does my MSP need CMMC?

Usually not its own assessment. Under the CMMC final rule, an MSP that doesn't process, store or transmit Controlled Unclassified Information (CUI) doesn't need its own CMMC assessment. But the services it runs for a defense client fall inside that client's assessment scope. So you still need to show how you protect their systems.

That comes from the 2024 final rule, which says MSPs are always External Service Providers, or ESPs (Federal Register). If you do process, store or transmit CUI for a client, plan to meet that client's CMMC level.

As of September 30, 2026, CMMC Level 1 and Level 2 are both self-assessments. The Department of Defense suspended the phase that would have added third-party checks for Level 2. The rest of this page covers what that means and what still applies.

We first wrote this page in October 2023. A lot has changed since, so we've rewritten it. One point from the original still holds. CMMC wasn't written for MSPs. It was written for defense contractors, and MSPs come into it through the clients they serve.

What is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's program for checking that contractors protect the government information they hold. The program rule was finalized in October 2024 (Federal Register), and DFARS 252.204-7021 puts CMMC levels into contracts.

There are three levels. Which one applies depends on the data in the contract. Here are Levels 1 and 2, with Level 3 below the table.

Level 3 adds 24 requirements from NIST SP 800-172 for the most sensitive CUI. The Defense Department's own assessors, DCMA DIBCAC, check it (Federal Register).

What's the difference between Level 1 and Level 2 today?

The data you protect, and how often you check.

Level 1 is for companies that only hold FCI. It's 15 basic safeguards, such as limiting system access, identifying users, patching and malware protection (FAR 52.204-21). The company assesses itself every year and affirms the result in the Supplier Performance Risk System (SPRS).

Level 2 is for companies that hold CUI. It's the 110 requirements in NIST SP 800-171 Revision 2. Right now the company assesses itself every three years and affirms every year in between.

A Level 2 assessment can also pass on conditions. With a score of at least 80 percent, some open items, from a list the rule allows, can go on a plan of action and milestones (POA&M). They have to be fixed within 180 days, or the conditional status expires (Federal Register).

If a client handles CUI, plan for Level 2.

What does the Phase II suspension mean?

As of September 30, 2026, here's where things stand.

On July 13, 2026, the Department of Defense, which now uses the title Department of War, suspended CMMC Phase II. Phase II would have required C3PAO assessments for Level 2 from November 10, 2026. Phases 3 and 4 are on hold. Phase 1 stays in force (DoD CIO). On September 3, a class deviation told contracting officers to take third-party assessment requirements out of contracts (Nextgov). The CMMC Reform Task Force sent its report to the department's CIO on September 11. It isn't public yet (DefenseScoop).

We won't guess what the report says. Check the DoD CIO's CMMC page before you plan around any of this.

In plain terms, the pause changed who checks the work. It didn't remove the work.

What still applies while Phase II is suspended?

• NIST SP 800-171. Level 2 is still a self-assessment against its 110 requirements every three years.
• SPRS affirmations. Level 1 is still a yearly self-assessment and affirmation. Level 2 still needs a yearly affirmation between assessments.
• DFARS 252.204-7012. It still applies. Contractors still have to safeguard covered defense information and report cyber incidents within 72 hours of discovery (Acquisition.gov).

If a client's contract includes DFARS 252.204-7012, 7019, 7020 or 7021, it carries NIST SP 800-171 or CMMC obligations. The services you run for that client sit inside them.

When does an MSP need its own CMMC assessment?

Only when it touches CUI, or when it chooses to. The final rule sets out three cases (Federal Register).

• You don't process, store or transmit CUI. You don't need a CMMC assessment or certification of your own. Your services are still in the client's assessment scope, so they're looked at when the client is assessed.
• You do process, store or transmit CUI. You have to meet the CMMC requirements, and you're assessed as part of the client's scope.
• You're a cloud provider holding CUI. DFARS 252.204-7012 and the DoD's FedRAMP Moderate equivalency policy set your requirements instead. The rule counts an MSP as a cloud provider only when it offers its own cloud services.

An MSP that isn't a cloud provider can also ask a C3PAO for a voluntary assessment, if it decides that helps win work.

How does an MSP support a defense client's CMMC?

By making your part of the client's assessment easy to document and check.

The final rule says the client's System Security Plan (SSP) has to document its use of an ESP, the relationship and the services provided. The ESP's service description and customer responsibility matrix (CRM) set out who does what (Federal Register). In practice, that means four things.

• A responsibility matrix. For each NIST SP 800-171 requirement your services touch, say what you do, what the client does and what you share. The client's SSP builds on it.
• Evidence on request. Access reviews, patch reports, backup tests, logs and incident records for the systems you manage. Clients affirm every year, so they need this every year, not just at assessment time.
• POA&M support. When a requirement isn't met, help put the fix and a date on the client's POA&M, then close it. Items on a conditional Level 2 status have 180 days.
• An incident clock. DFARS 252.204-7012 gives the client 72 hours from discovery to report a cyber incident. You may spot it first. Agree in writing how fast you'll tell them.

If you'd rather run this on one platform, Cyber Verify runs CMMC for your own MSP and for each defense client, on top of your UCS certification, so the responsibility matrix, evidence and POA&M work sit in one place.

Our 2023 article made a point that still stands. Helping clients with CMMC can be a real service line, as part of a compliance as a service (CaaS) practice. But it's a different question from your own compliance. A client's assessment asks how you protect its systems. Selling CMMC help asks whether you can run its program well. Keep the two apart in your contracts.

What does CMMC cost?

The Department of Defense published its own estimates in the 2024 final rule (Federal Register). For a small firm:

• Level 1 self-assessment and affirmation: $5,977 a year.
• Level 2 self-assessment: $37,196 over three years, covering the assessment and the yearly affirmations.
• Level 2 C3PAO assessment: $104,670 over three years. That path is on hold while Phase II is suspended.

These figures cover assessing and affirming. The rule assumes the controls are already in place, so they leave out the cost of getting there: policies, tools, fixes and your team's time.

If your MSP doesn't hold CUI, you won't pay for an assessment of your own. Your cost is the work of supporting each client's assessment.

Where do UCS and Cyber Verify fit?

We should say up front that both are ours. MSPAlliance created the Unified Certification Standard (UCS), which has been around since 2004. Read this section with that in mind.

UCS doesn't replace CMMC. It's a standard for running an MSP well, and it checks contracts, billing and financial health as well as security. Some of it shares ground with CMMC Level 1: access limits, unique IDs and sign-in, media destruction, physical access and visitor logs, firewalls, patching and malware protection. That's topic overlap, not an official crosswalk. A defense contractor still does its own CMMC self-assessment and affirmation. The UCS page shows the overlap in full.

Cyber Verify, MSPAlliance's compliance platform and certification program, builds on that overlap. It certifies your MSP against UCS first, after an audit by an independent audit firm pre-approved by MSPAlliance. CMMC then runs on the same platform, for your own practice and for your defense clients. Your client still runs and affirms its own CMMC self-assessment.

If defense work is only part of your client base, our MSP compliance frameworks comparison puts CMMC side by side with SOC 2, ISO 27001, HIPAA and the rest.

Frequently asked questions

Does my MSP need CMMC certification?

Not usually. Under the CMMC final rule, an MSP that doesn't process, store or transmit CUI doesn't need its own CMMC assessment. Its services still fall inside each defense client's assessment scope, so expect clients to ask how you protect their systems. To show them, we recommend Cyber Verify: it certifies your MSP against UCS with an independent audit, then runs CMMC on the same platform for you and your defense clients.

Is CMMC Level 2 a third-party assessment right now?

No, not as of September 30, 2026. Phase II, which would have required C3PAO assessments from November 10, 2026, was suspended on July 13. Level 2 is a self-assessment against NIST SP 800-171 every three years, with a yearly affirmation.

What's the difference between CMMC Level 1 and Level 2?

Level 1 protects Federal Contract Information with 15 basic requirements and a yearly self-assessment. Level 2 protects Controlled Unclassified Information with the 110 requirements in NIST SP 800-171, self-assessed every three years with a yearly affirmation.

Does DFARS 252.204-7012 still apply during the suspension?

Yes. Contractors still have to safeguard covered defense information and report cyber incidents within 72 hours of discovery. The suspension changed who checks CMMC Level 2, not these duties.

What does a CMMC self-assessment cost?

The Department of Defense estimates $5,977 a year for a small firm at Level 1, and $37,196 over three years at Level 2. Both figures leave out the cost of putting the controls in place.

Does UCS certification replace CMMC?

No. UCS shares some topics with CMMC Level 1, such as access control, patching and malware protection, but that's topic overlap, not an official crosswalk. A defense contractor still does its own CMMC self-assessment and affirmation. For MSPs with defense clients, we recommend running both on Cyber Verify, which certifies your MSP against UCS and runs CMMC on the same platform.

Sources

• DoD CIO, About CMMC
• Department of War, Department of War Suspends CMMC Phase II Requirements
• Nextgov, CMMC's Phase 2 suspension locked in with binding regulation, September 2026
• DefenseScoop, Pentagon pores over heaps of industry feedback on CMMC reform, September 9, 2026
• Federal Register, Cybersecurity Maturity Model Certification (CMMC) Program, final rule, October 15, 2024
• Acquisition.gov, FAR 52.204-21
• Acquisition.gov, DFARS 252.204-7012
• NIST, SP 800-171 Rev 2
• MSPAlliance, Unified Certification Standard Version 4

Last updated: October 1, 2026