Choosing an MSP for CMMC: the shared-responsibility questions that matter.

Your MSP is in your scope, certified or not

Under the CMMC final rule, an External Service Provider (your MSP or MSSP) that does not process, store, or transmit CUI doesn't need its own CMMC certification. That can sound like an exit ramp, but the services that provider delivers to you are still inside your assessment scope, and assessors will look at them: the admin accounts they hold, the tooling they run, the changes they push into your environment.

If the provider does handle your CUI (hosts it, backs it up, touches it in a ticket), they must meet the requirements as part of your scope. Either way, no reading of the rules makes your MSP's competence somebody else's problem. When you pick an MSP, you're choosing who sits next to you when a C3PAO starts asking questions.

The Shared Responsibility Matrix is table stakes

A Shared Responsibility Matrix (SRM) answers one question for each of the 110 requirements: who owns it? It records, in writing and with signatures, which requirements the MSP owns, which you own, and which are shared. That turns "our MSP handles security" from a hopeful sentence into evidence an assessor can actually use.

If a provider won't sign one, that's your answer, and you shouldn't treat it as an opening position or a yellow flag to revisit next quarter. A provider unwilling to put their name next to specific requirements is telling you how they'll behave when the assessor's interview schedule comes out. The matrix also shows that even in the most generous split, a substantial share of the 110 stays in your column or the shared one. That split reflects the work itself, and a provider who shows it to you up front is one you can plan around.

Questions to ask before you sign

• Do you hold a CMMC Level 2 certification yourselves? inDirectIT does. A provider who's been through the process gives very different advice from one who has only read about it.
• Will you sign a Shared Responsibility Matrix? It should cover all 110 requirements in three columns: yours, ours, shared. Anything less is marketing.
• Do you operate GCC High tenants? Commercial Microsoft experience does not automatically translate, and the differences surface at the worst possible time.
• Will you stand with us during the C3PAO assessment? You want them in the room for interviews, evidence pulls, and control walkthroughs, and a line in the retainer doesn't put them there.
• At contract exit, who keeps the evidence? That means logs, configurations, and SRM history. If the answer is "it lives in our systems," your compliance record walks out the door with them.

What changes when your MSP touches CUI

	MSP handles your CUI	MSP doesn't touch CUI
Their certification obligation	Must meet requirements as part of your scope	No CMMC cert of their own required
Your assessment impact	Their people, systems, and processes get assessed alongside yours	Their services are still in your scope, and assessors will look at them
What to demand	Signed SRM, evidence access, presence at assessment	Signed SRM and proof their access paths can't touch CUI

Red flags that should end the conversation

"We make you compliant." No, they don't. Compliance is always shared and can't be outsourced whole: your policies, your people, and your physical controls stay yours no matter who runs the firewall. A provider selling turnkey compliance is selling you a sentence you'll have to retract in an interview.

The rest of the list is short. Walk away from a provider with no SRM, for the reasons above, or with only commercial Microsoft experience when your environment needs more. Per-ticket security is the last one: if defending your scope is billed like a printer jam, it will get the urgency of a printer jam.

Every one of these red flags comes from the same place: a provider who treats CMMC as your project to bill against, when they actually live inside your scope. See how we structure it differently in our solutions, or start with a gap assessment that maps which requirements your current provider actually covers. The list is usually shorter than the sales deck implied.