Does My MSP Need to Be CMMC Certified? What the Final Rule Actually Says

The Test: Does the Provider Touch CUI?

The rule doesn't care what your provider calls itself — MSP, MSSP, IT shop. It asks one core question: does the provider store, process, or transmit your CUI (or your Security Protection Data)? The answer determines everything.

• The MSP does NOT hold CUI (CUI stays in your systems; they just manage tools) → the MSP generally does not need its own CMMC certification.
• The MSP DOES store/process/transmit CUI → that handling is squarely in scope and must meet the requirements.

What About the MSP Running Your Security?

Many providers don't hold your CUI but do run security-relevant services — your SIEM, endpoint protection, identity provider, patching. Under CMMC these are Security Protection Assets, and the services they provide are assessed within your CMMC assessment scoperather than requiring the MSP to hold a separate certificate. They're in the picture — just as part of your assessment, documented in your SSP, not as an independent cert.

Cloud Providers Are a Separate Path

If your provider is a cloud service provider that stores or processes CUI, it follows the DFARS 252.204-7012 path: meet the FedRAMP Moderate baseline (or equivalent) and the clause's incident-reporting requirements. That's why the platform you choose matters so much — see GCC High vs Commercial.

The Responsibility Never Leaves You

Here's the half nobody likes: even a fully “CMMC-ready” MSP cannot transfer your obligation. The contractor seeking certification is responsible for meeting the requirements — full stop. An MSP can implement and operate controls on your behalf, but if something is missing, it's your assessment that fails and your contract at risk.

Setting the Relationship Up Right

• Map the data. Confirm in writing whether your MSP ever holds CUI or Security Protection Data.
• Get the CRM. Know which of the 110 requirements they cover and which are yours.
• Document them in your SSP. Their security services belong in your System Security Plan.
• Verify the cloud path. If a provider holds CUI in the cloud, confirm FedRAMP status — don't assume it.

Know Exactly Where Your MSP Fits

The cleanest way to settle the MSP question is to scope your environment and assess against all 110 requirements — mapping which controls your provider covers and which are yours. The Dragonfli Group CMMC Accelerator does exactly that, producing a draft SSP and gap plan reviewed by a CMMC Registered Practitioner, so the line between you and your MSP is documented, not assumed.