When Is an MSP Also a CSP in CMMC?
Updated November 2026
Cloud Architecture • Third-Party Risk • Regulatory Scoping
When is an MSP also a CSP in CMMC?
An MSP manages technology.
A Cloud Service Provider supplies cloud computing.
The same company can do both, but the roles should be classified service by service rather than company by company.
For CMMC and DFARS purposes, ask what the provider is actually delivering.
What makes a service cloud computing?
NIST SP 800-145 describes cloud computing through characteristics including:
- on-demand self-service;
- broad network access;
- resource pooling;
- rapid elasticity; and
- measured service.
Cloud offerings may be delivered as infrastructure, platform, or software services.
The architecture determines whether the offering is cloud computing. The vendor’s use of words such as “managed,” “hosted,” or “cloud-enabled” does not decide the question.
An MSP managing somebody else’s cloud is not automatically the CSP
Consider a managed service provider administering a customer’s Microsoft 365 tenant.
The MSP may configure identities, devices, policies, logging, or security settings, but Microsoft supplies the underlying cloud service.
In that relationship:
- Microsoft may be the CSP;
- the MSP may be an ESP providing administration or security services; and
- the customer retains its own responsibilities.
Each role should be documented separately.
An MSP can also operate its own cloud service
The classification changes if the MSP itself hosts and delivers a service with cloud-computing characteristics.
Examples might include provider-operated hosted desktops, managed application hosting, backup repositories, or shared infrastructure services.
The organization should evaluate that specific offering rather than treating every service from the provider the same way.
Why the distinction matters
CSP processing, storing, or transmitting CUI
DFARS 252.204-7012 requires an external cloud service used to store, process, or transmit covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline and comply with the clause’s applicable cyber-incident and forensic-support provisions.
Non-CSP ESP processing, storing, or transmitting CUI
Current CMMC Level 2 scoping treats the services provided by a non-CSP ESP as part of the organization’s assessment scope.
The rule does not simply convert every such provider into an independently certified C3PAO-assessed organization.
Provider handling Security Protection Data without CUI
When an ESP handles Security Protection Data without CUI, the relevant services are assessed as Security Protection Assets.
Four classification checks
For each service, document:
1. Delivery model What capability is the provider actually supplying?
2. Infrastructure owner Who owns or operates the underlying computing platform?
3. Information flow Does CUI or Security Protection Data reside on provider assets?
4. Responsibility model Which security requirements belong to the customer, CSP, MSP, or another party?
The result should agree with the System Security Plan, provider agreement, customer responsibility matrix, and actual technical architecture.
Sources and limits
This guidance is informed by NIST SP 800-145, DFARS 252.204-7012, 32 CFR Part 170, and current CMMC scoping guidance.
The classification of a particular service is fact-specific.
Related guidance:
Evaluate Your Compliance or Security Boundary
Schedule an executive consultation or run our diagnostic readiness check.