Choosing an MSP for CMMC: the shared-responsibility questions that matter.

Your MSP is in your scope. Full stop.

Under the CMMC final rule, an External Service Provider — your MSP or MSSP — that does not process, store, or transmit CUI doesn't need its own CMMC certification. That sounds like an exit ramp. It isn't. The services that provider delivers to you are still inside your assessment scope, and assessors will look at them: the admin accounts they hold, the tooling they run, the changes they push into your environment.

And if the provider does handle your CUI — hosts it, backs it up, touches it in a ticket — they must meet the requirements as part of your scope. Either way, there is no configuration of the rules in which your MSP's competence is somebody else's problem. You're not buying help desk hours; you're choosing who sits next to you when a C3PAO starts asking questions.

The Shared Responsibility Matrix is table stakes

A Shared Responsibility Matrix (SRM) answers one question across all 110 requirements: who owns this one? Which requirements the MSP owns, which you own, and which are shared — in writing, with signatures. It's the document that turns "our MSP handles security" from a hopeful sentence into evidence an assessor can actually use.

If a provider won't sign one, that's your answer. Not a negotiating position, not a yellow flag to revisit next quarter — your answer. A provider unwilling to put their name next to specific requirements is telling you exactly how they'll behave when the assessor's interview schedule comes out. And notice what the matrix quietly reveals: even in the most generous split, a substantial share of the 110 stays in your column or the shared one. That's not the MSP shirking — that's the honest shape of the work, and a provider who shows it to you up front is one you can plan around.

Questions to ask before you sign

• Do you hold a CMMC Level 2 certification yourselves? inDirectIT does — we hold the certification we help you earn. A provider who's been through the process gives you very different advice than one who's read about it.
• Will you sign a Shared Responsibility Matrix? All 110 requirements, three columns: yours, ours, shared. Anything less is marketing.
• Do you operate GCC High tenants? Commercial Microsoft experience does not automatically translate, and the differences surface at the worst possible time.
• Will you stand with us during the C3PAO assessment? Interviews, evidence pulls, control walkthroughs — in the room, not on a retainer clause.
• What happens at contract exit — who keeps the evidence? Logs, configurations, SRM history. If the answer is "it lives in our systems," your compliance record walks out the door with them.

Two situations, two very different demands

	MSP handles your CUI	MSP doesn't touch CUI
Their certification obligation	Must meet requirements as part of your scope	No CMMC cert of their own required
Your assessment impact	Their people, systems, and processes get assessed alongside yours	Their services are still in your scope — assessors will look at them
What to demand	Signed SRM, evidence access, presence at assessment	Signed SRM and proof their access paths can't touch CUI

Red flags that should end the conversation

"We make you compliant." No, they don't. Compliance is shared, never outsourced whole — your policies, your people, your physical controls stay yours no matter who runs the firewall. A provider selling turnkey compliance is selling you a sentence you'll have to retract in an interview.

The rest of the list is short: no SRM, for the reasons above. Commercial-only Microsoft experience when your environment needs more. And per-ticket security — if defending your scope is billed like a printer jam, it will get the urgency of a printer jam.

The pattern underneath every red flag is the same: a provider who thinks CMMC is your project that they bill against, rather than a scope they live inside. See how we structure it differently across our solutions, or start with a gap assessment that maps exactly which requirements your current provider is actually covering — the answer is usually shorter than the sales deck implied.