Risk, responsibility, oversight, and security considerations involving service providers, suppliers, technology partners, cloud providers, managed services, and other external dependencies.
Determining whether an MSP or MSSP requires independent CMMC certification depends on what the provider does, which assets it uses, and whether it handles Controlled Unclassified Information or Security Protection Data.
An External Service Provider (ESP) under CMMC 32 CFR Part 170 is an outside party used for comprehensive IT or cybersecurity services. Scoping depends on data handling, system connections, and security functions.
An MSP manages technology; a CSP delivers cloud computing. In CMMC and DFARS 252.204-7012 compliance, understanding whether your provider is an MSP, a CSP, or both determines applicable FedRAMP and scoping rules.
Browse our complete library of technical compliance guides and regulatory scoping frameworks across all domains.