External Providers

ESP / MSP / MSSP Guidance (CMMC 2.0 / Final Rule Update)

• The DoD now formally defines External Service Providers (ESPs) — including MSPs, MSSPs, CSPs — as any third‑party providing IT or cybersecurity services on behalf of a contractor.
• Importantly, not all ESPs are required to hold their own CMMC certification. Whether an ESP must be certified depends on whether they process, store or transmit CUI (or handle other sensitive data) on behalf of the contractor.
• If the ESP only provides supporting security functions (e.g., monitoring, patch management, SIEM, logging) and does not itself host or process CUI, then the contractor may include those services in their own assessment — no separate certification needed.
• For MSPs/MSSPs that do host, process or transmit CUI (or whose services are integral to CUI handling) — they must be included in the contractor’s scope and assessed to the appropriate level (typically Level 2).
• Cloud‑based service providers (CSPs) that host CUI must meet FedRAMP Moderate (or equivalent) baseline; CSPs providing only security services for CUI-hosted environments may be scoped under the contractor’s assessment.
• For contractors using Virtual Desktop Infrastructure (VDI) architectures — remote endpoints that only connect to a secure enclave (without processing/storing/transmitting CUI on the endpoint itself) may now be considered out-of-scope.

What this means for subcontractors and suppliers: Contractors must understand and document whether any third‑party provider (ESP, MSP, MSSP, CSP) they use touches CUI or provides security protection assets for CUI-related systems. That determination drives whether the provider must be assessed or simply included in the contractor’s environment scope.

 Why This Matters (And Why You Should Act Now)

• Many small or mid-sized DIB contractors rely on third‑party MSPs or MSSPs for IT operations. The clarified ESP definitions and scope rules give them flexibility — compliance does not necessarily require re-certifying every MSP, reducing cost and overhead.
• At the same time — if your MSP/MSSP or CSP handles CUI or hosts sensitive systems — you must ensure they meet the required CMMC level and that their systems are included in your compliance scope. Otherwise, you risk non-compliance when submitting to contract award or audit.
• As a consultant / MSSP / RPO (like you are with AG Grace), this creates an opportunity: you can help clients map their third‑party relationships, determine scope, document responsibilities (Customer Responsibility Matrices / SSPs / Shared‑Responsibility Matrices), and ensure compliance — without forcing all MSPs to certify.
• It also means that many MSPs may voluntarily seek certification or at least build compliant service offerings — making them more attractive to DoD contractors.