The year-two problem
Reaching a compliant state is hard. Still being there eighteen months later, with evidence current enough to prove it, is harder. That holds whether your verification is a CMMC certificate, a GSA authorization with continuous monitoring behind it, or a self-assessment you affirm every year and a prime can audit. Drift makes no noise: a Conditional Access exception here, an unlabeled share there, a POA&M item that stopped burning down. Managed compliance catches drift while it is still a ticket, before an assessor writes it up as a finding. The goal is continuously protected CUI, and the compliance artifacts come out of that work.
What operations include
- Managed IT for the compliant environment: service desk, patching, and monitoring, run from inside the boundary.
- Evidence refresh on a rolling calendar: we re-capture screenshots, configurations, and logs against the assessment objectives so the evidence package never goes stale.
- Control validation re-tests implemented controls on a set cycle. It is an internal version of the mock assessment that cleared you for certification.
- POA&M burn-down tracks each open item through remediation to closure under the CMMC POA&M rules, including the 180-day closeout deadline.
- Boundary change control checks new tools, users, and contracts for scope impact before they expand your assessment without anyone noticing.
- Authorization maintenance applies to agency lanes with a continuous-monitoring obligation (see GSA). We keep the reporting schedule and stay ready for re-evaluation so the authorization decision stands.
- Baseline watch tracks Rev. 3 adoption, agency policy changes, and new clause language against your contract mix, so transitions arrive as changes you planned for.
Shared responsibility: as your ESP we sit inside your assessment scope, which is why our own CMMC Level 2 certification matters to you. Our controls and evidence are inheritable. An ESP that can't show the same becomes a source of findings in your assessment.
Want the boundary operated as a product? CUIckStart is our managed CUI enclave on Microsoft 365 GCC High, with compliance management built in: the SSP and the remaining customer work are kept current, and your MSP keeps the corporate network. See cuickstart.com.
Questions contractors ask us
Why does compliance need to be 'managed'? We passed.
Every verification (a CMMC certificate, an agency authorization, a self-assessment score) measures one moment, and the environment starts drifting from that moment on. Evidence goes stale, staff changes break processes, and new tools enter the boundary. Year two is where certifications and authorizations get lost. Managed compliance keeps the posture you proved true between reviews.
How is this different from a normal MSP contract?
A generic MSP keeps systems running. Managed compliance also keeps them provable: we run every patching cycle, access review, and configuration change against the control set and capture it as evidence at the assessment-objective level. We hold CMMC Level 2 ourselves, so you can inherit our posture as your ESP.
Does our MSP being in scope really matter?
Yes. An external service provider that touches your CUI or security functions is inside your assessment under shared responsibility, so gaps in its posture become your findings. Ask any MSP bidding for your business what its own SPRS score is. A CMMC certification and an SPRS Basic Assessment score are different records, so ask what scope each one covers and for the evidence behind it.
Keep the certification you paid for.
Tell us whether your environment is certified, mid-remediation, or drifting, and we'll scope the sustainment operation. Or email rj@indirectit.com directly.