Is your MSP in your CMMC assessment scope? The ESP rules explained

If your architecture, engineering or construction firm handles CUI on defense work, the MSP that runs your network, Microsoft 365 tenant and endpoints is probably part of your CMMC assessment scope. Your SSP, your SPRS score and any future Level 2 assessment depend on how that relationship is documented.

What counts as an external service provider under CMMC?

An external service provider (ESP) is any outside party whose people, technology or facilities your firm uses, but CMMC only treats a vendor as an ESP if it processes, stores or transmits CUI or Security Protection Data. Your managed IT provider almost always meets that test, even if it never opens a project drawing.

The definitions sit in 32 CFR 170.4. Security Protection Data (SPD) is "data stored or processed by Security Protection Assets (SPA) that are used to protect an OSC's assessed environment." Security Protection Assets are the tools that provide security functions for your assessment scope: the identity platform, endpoint protection, logging, remote management and backup systems an MSP runs on your behalf.

Table 4 of 32 CFR 170.19(c)(2)(i) closes the loop: "A service provider that does not process CUI or SPD does not meet the CMMC definition of an ESP." A vendor that only sells you plotter paper is outside the rule. A vendor that administers your firewall is inside it.

Is your MSP in your assessment scope if it never touches CUI?

Yes, if it handles Security Protection Data. Under Table 4, an ESP that handles SPD but no CUI is "in the OSA's assessment scope" and its services are "assessed as Security Protection Assets." That is true whether or not the ESP is a cloud provider.

The Department of War's CMMC FAQs walk through this exact case. A contractor outsources IT support to an MSP and security tools to a separate managed security provider, and sends no CUI to either. The answer (E-A4): both "qualify as ESPs and will be assessed as part of the Organization Seeking Assessment's assessment scope against applicable security requirements."

For Security Protection Assets, Table 3 of the same section says the assessment covers the "Level 2 security requirements that are relevant to the capabilities provided." In practice, an assessor reviewing your MSP's remote management tool will look at how access to that tool is controlled, authenticated and logged, because those controls protect everything the tool can reach. The DoD Level 2 scoping guide uses the same framing. If you want the full list of asset categories, our piece on shrinking CMMC scope with zero trust and VDI covers them.

When does your MSP count as a cloud service provider?

It depends on who holds the cloud subscription. If the Microsoft 365 or Azure tenant is licensed to your firm, your MSP is treated as an ESP, even when it resells the licenses. If the MSP contracts with the cloud provider and modifies the service it hands you, it may be a cloud service provider in its own right.

That distinction comes from FAQ E-A5, and it matters because the rules split sharply. Where a cloud service provider processes, stores or transmits CUI, Table 4 says it "shall meet the FedRAMP requirements in 48 CFR 252.204-7012." The DFARS 7012 clause requires security equivalent to the FedRAMP Moderate baseline, which the FAQs say can be met with a FedRAMP Moderate authorized service or one that satisfies the Department's December 2023 equivalency memo.

Where an ESP that is not a cloud provider handles CUI, its services "are in the OSA's assessment scope and shall be assessed as part of the OSA's assessment." A private file server your MSP hosts in its own data center for your project archive falls into that bucket, and the assessor will look at it the same way it looks at your own servers.

Does your MSP need its own CMMC certification?

No. The FAQs say an MSP "is not required to have its own CMMC assessment but may elect to perform its own self-assessment or undergo a certification assessment" (E-A3). The rule at 170.19(c)(2)(ii) says the same: an ESP "may voluntarily undergo a CMMC certification assessment to reduce the ESP's effort required during the OSA's assessment."

A CMMC certified MSP helps only if its certification matches what your contract requires. Under E-A3, "the assessment level and type need to be the same, or above, as the level and type specified in the OSA's contract," and it has to "cover those assets that are in scope for the OSA's assessment." An MSP's Level 2 (Self) result does not stand in for a Level 2 (C3PAO) requirement on your contract, and a certificate that covers the MSP's own office network says little about the tools it uses to manage yours.

Without a certification, expect the MSP's services to be examined during your assessment. Ask now whether your provider will make its people, configurations and records available when your assessor asks.

What has to be in your SSP and the MSP's paperwork?

Your SSP has to document the MSP, and the MSP has to provide a service description and a customer responsibility matrix (CRM). Section 170.19(c)(2)(ii) requires that "the use of an ESP, its relationship to the OSA, and the services provided need to be documented in the OSA's SSP and described in the ESP's service description and customer responsibility matrix (CRM)." The CRM spells out which party performs each part of each requirement.

For an architecture or engineering firm, the SSP entry should name the MSP, list each service it provides (help desk, identity administration, endpoint management, backup, security monitoring), and say whether each service touches CUI, SPD or neither. Each Security Protection Asset the MSP operates belongs in your asset inventory and network diagram, as Table 3 requires.

The CRM is where most gaps show up. A requirement split between your firm and the MSP, such as account reviews, needs both halves written down, with the evidence location for each. Our guide to writing a system security plan an assessor can follow covers how to document shared and inherited controls.

Does the Phase 2 suspension change any of this?

No. The ESP rules are part of the codified scoping text in 32 CFR 170.19, and the July 2026 suspension did not rewrite that text. It suspended the Phase 2 requirements, along with pending and future implementation milestones, while a task force reviews the program. Phase 1 self-assessments, SPRS scores and annual affirmations still apply, as our Phase 2 suspension explainer describes.

A Level 2 self-assessment is scored against the same scope a certification assessment would use. If your MSP's tools are outside your self-assessment because nobody listed them, the score your affirming official signs overstates what was assessed.

What should an AEC firm do this quarter?

Five steps put your MSP relationship on paper before the next affirmation:

• List every outside provider with administrative access to your network, identity platform or endpoints, and mark whether each one handles CUI, SPD or neither.
• For each cloud service that stores CUI, confirm who holds the subscription and keep the FedRAMP Moderate authorization or equivalency evidence on file.
• Ask your MSP for a service description and a customer responsibility matrix that maps its services to the NIST SP 800-171 requirements it performs or shares.
• Update the SSP, asset inventory and network diagram to show the MSP's Security Protection Assets.
• Confirm in writing that the MSP will support your assessment, including access to its staff and records.

Where does s90 fit?

s90 runs IT for architecture, engineering and construction firms in Los Angeles and Orange County. We maintain the NIST SP 800-171 controls behind a Level 2 self-assessment, keep the evidence current between affirmations, and can help you document how each outside provider fits into your SSP. If you want a second look at where your current provider sits in your CMMC scope, we are glad to walk through it with you.