CMMC provider-classification guide

Start with the service, not the label.

An MSP manages technology. A cloud service provider delivers cloud services. Those roles can overlap, but they are not interchangeable.

For CMMC planning, the useful question is not, “Is our MSP a CSP?” Ask instead: “Which service are we evaluating, what does it do, what information does it handle, and where do the responsibilities sit?”

Discuss your CMMC requirement

What is a CSP?

For the CMMC Program, a Cloud Service Provider is an external company that provides cloud services based on cloud computing. The related acquisition definition describes cloud computing as on-demand access to shared configurable resources that can be rapidly provisioned and released with limited management effort or provider interaction. It includes common service models such as software, platform, and infrastructure services.

That definition is about how a particular service is delivered. It is not a status conferred by calling a business an MSP, MSSP, reseller, hosting provider, or technology partner.

When can an MSP also be a CSP?

An MSP can be both when it provides its own service that meets the cloud-computing definition. For example, the same company might operate a cloud service for one client and provide administration, monitoring, or support for another service. The classification should be made for the specific offering and the specific customer environment.

An MSP can also be an External Service Provider without being a CSP for the service under review. The difference matters because CMMC asks the organization to evaluate both the provider role and the service's handling of CUI or Security Protection Data.

Check these four points

1. Define the offering

Name the exact service. Document its service description, delivery model, systems, tenant or environment, integrations, support model, and the assets used to provide it.

2. Classify the provider role

Determine whether the service is cloud computing under the applicable definition. Separately determine whether the provider is an External Service Provider for the CMMC environment. A company can play more than one role across different services.

3. Trace the information and security function

Determine whether the provider's assets process, store, or transmit CUI or Security Protection Data. Also identify security functions, privileged access, logs, configurations, backup data, monitoring data, and integrations that matter to the assessed environment.

4. Document the responsibility boundary

Record what the provider does and what remains with the organization. Use a service description, customer-responsibility matrix, architecture record, asset inventory, System Security Plan treatment, and evidence plan that match the actual operating model.

Why the distinction matters

The current CMMC rule directs organizations to consider whether an External Service Provider is a CSP and whether it handles CUI or Security Protection Data. Where a CSP processes, stores, or transmits CUI, the rule points to the FedRAMP requirements in DFARS 252.204-7012. Where a service handles Security Protection Data without CUI, the service may still be relevant to the assessment as a Security Protection Asset.

Those are decisions to validate against the contract, service documentation, architecture, and current program requirements. They are not conclusions a website, a provider label, or a single contract term can make for you.

Make continuous compliance an operating discipline

Where a contract requires CMMC status, the applicable DFARS clause requires the affirming official to complete and maintain an annual affirmation of continuous compliance for each applicable information system. That makes this more than an assessment-day exercise. The organization needs a repeatable way to govern changes, review provider responsibilities, maintain evidence, and surface unresolved gaps before an affirmation is due.

ThreatKrusher Comply is eTrepid's compliance-as-a-service pillar. Within an agreed scope, it can support that operating discipline through evidence organization, responsibility review, change-aware planning, and readiness cadence. It does not make an affirmation for the organization, guarantee continuous compliance, replace an authorized assessment, or transfer the organization's accountability.

eTrepid's role

Within an agreed scope, eTrepid can help organize the service inventory, responsibility questions, architecture review, evidence plan, and next decisions. The organization remains responsible for its facts, provider selection, scope, representations, risk acceptance, and contract performance. Authorized assessment entities retain their own determination authority.

Sources and limits

This candidate is based on the current CMMC Program rule, applicable DFARS cloud-computing language, and current DoD CMMC scoping guidance in the controlled source pack. It does not determine whether a particular provider is a CSP, whether a service satisfies a government requirement, or whether an environment is in or out of scope.