CMMC provider-scope decision guide

A provider list does not tell you what is in scope.

Most organizations depend on outside services. The CMMC question is not whether a provider has a familiar label. It is whether the provider's people, technology, or facilities deliver a relevant service for the environment, and whether its assets handle CUI or Security Protection Data.

Discuss your CMMC requirement

What is an ESP?

In the CMMC context, an External Service Provider is an outside party used for comprehensive IT or cybersecurity services on behalf of the organization. For CMMC scoping, the provider becomes relevant when CUI or Security Protection Data is processed, stored, or transmitted on the provider's assets.

That may involve a managed service, security operation, hosted capability, monitoring service, backup service, administrative service, or another arrangement. The classification comes from the actual service and the data path, not from a vendor category.

Is every ESP a CSP?

No. A Cloud Service Provider is a specific kind of external provider that delivers cloud services based on cloud computing. An ESP can be a CSP for one offering and not a CSP for another. Evaluate both questions separately:

Is this provider an ESP for the environment under review?
Is this specific service cloud computing under the applicable definition?
Does the provider's service handle CUI or Security Protection Data?
Which responsibilities remain with the organization?

Why this matters after the assessment

Where CMMC status is required by contract, the affirming official must maintain an annual affirmation of continuous compliance for applicable information systems. Provider relationships, service changes, access paths, configurations, evidence, and responsibility boundaries can all affect whether that affirmation remains supportable.

Treat provider review as an operating cadence, not a one-time questionnaire. Revisit it when the service, architecture, information flow, security function, or contract changes.

How ThreatKrusher Comply can help

ThreatKrusher Comply is eTrepid's compliance-as-a-service pillar. Within an agreed scope, it can help establish a practical cadence for provider inventory, responsibility review, evidence organization, change review, and readiness decisions.

It does not determine CMMC scope for the organization, make an annual affirmation, guarantee continuous compliance, or replace an authorized assessment. The organization retains responsibility for its facts, representations, risk acceptance, and contract performance.

Sources and limits

This candidate is based on the current CMMC Program rule, DFARS 252.204-7021, and current DoD scoping guidance in the controlled source pack. It does not decide whether a specific provider or service is in scope, whether a contract requires CMMC status, or whether an organization can make an affirmation.