The MSP decision that decides your CMMC outcome.

A prime asks for your CMMC status. Or a solicitation comes back marked non-responsive. Or your IT person says the word for the first time and looks worried. However it lands on your desk, the first instinct is almost always the same: ask the MSP if they can handle it.

The MSP says yes. They usually do. A statement of work gets signed, a number gets agreed, and the problem feels solved. For a lot of defense contractors, that single moment — that one yes — is where the most expensive mistake in their whole CMMC journey gets made. Not because the MSP is dishonest. Because the question was never one an ordinary IT provider could answer.

This is the conversation that should happen before that yes. We’ve covered the decision to stay in defense work at all elsewhere; this picks up after you’ve decided to stay. No jargon, no fear-selling — just the map of what you’re actually deciding, what it costs to get it wrong, and the handful of questions that protect you.

Why this is the expensive decision

The first real decision in CMMC is whether to stay in defense work at all. The second is who leads the compliance work. And the second one quietly costs more contractors more money than any other, because of one feature of how CMMC works: you can fail it.

Here’s the shape of it. The third-party assessment itself runs roughly $30,000 to $75,000 before anyone has fixed a single thing.⁵ If you fail, you pay again — a focused reassessment runs $10,000 to $30,000, on top of whatever it costs to fix what they found.⁶ Then comes the part that hurts most: the wait. You re-prepare, you get back in your assessor’s queue, and the calendar keeps moving toward November 10, 2026, when third-party certification becomes mandatory for the contracts that require it.³ A failed assessment is not a do-over next month. It can cost you most of a year — a year in which your prime is deciding whether to keep waiting on you, or move the work to a sub who is already certified. (If you’re still weighing whether that math even works for your contract mix, that’s the cost-and-recovery question.)

That asymmetry is the whole reason this decision deserves an hour of your attention before you sign anything. The work can be done well by your MSP, by a specialist, or by the two of them together. What you cannot afford is to drift into one of those arrangements by accident, assuming someone has it, and finding out otherwise on assessment day.

The eight stages, start to certified

Most owners don’t struggle with the individual requirements — there are guides for those. What’s missing is the shape of the journey: what happens, in what order, and which calls are yours versus your team’s. This is the map. Hold these eight stages in your head and you can have a straight conversation with any vendor who walks through your door.

Where your MSP actually sits in all this

Here’s the part almost nobody explains clearly, and it’s the heart of the matter.

When the final CMMC rule was published, it dropped the requirement that your MSP hold its own certification.⁹ A lot of owners heard that and relaxed. That was the wrong thing to relax about. The rule didn’t take your MSP out of the picture. It pulled your MSP into yours.

The moment your MSP manages your systems, its tools start collecting your logs, your configuration data, your patch status, the records of who logged in and when. The rule has a name for that: Security Protection Data. And any provider that handles your CUI or that Security Protection Data sits inside your assessment boundary — certified or not.¹⁰ So when the assessor evaluates you, they’re also evaluating the slice of controls your MSP runs. If that slice is weak, those aren’t the MSP’s findings. They’re yours.

This is why the rule also requires a Customer Responsibility Matrix — a document stating, control by control, exactly what the provider does and what you do. It’s not optional, and the assessor reads it first.¹⁰ If your MSP can’t produce one, you don’t have a CMMC partner; you have an IT vendor with a CMMC page on its website. (Our free Shared Responsibility Matrix maps all 110 requirements to who’s responsible across each platform — the honest starting point for your own.)

Why most MSPs can’t lead this — even when they say they can

Let’s be fair about this. Your MSP may be excellent at what they do. Keeping your email up, your laptops patched, your network running — that’s real skill, and most of them earn their fee. CMMC is simply a different trade. It’s a credentialed compliance specialty, and the gap between “good at IT” and “can carry you through a CMMC assessment” is wider than it looks. Two things tell you which side of that gap a provider is on.

The environment

Commercial Microsoft 365 — the version most businesses already run — does not meet the Defense Department’s requirement for CUI on its own, and Microsoft says so plainly.¹³ Most CUI work belongs in GCC High, a separate government cloud that, among other things, requires administrators who are U.S. persons with background checks.¹³ That detail quietly disqualifies a lot of capable commercial MSPs. An MSP that talks about GCC High as “basically the same as the 365 you already have” has told you, in one sentence, that they haven’t done this before.

The credentials

The CMMC ecosystem has specific, verifiable credentials — Registered Practitioner, Certified CMMC Professional, Certified CMMC Assessor. As of early 2026 there were only around 760 certified assessors and just under 1,500 certified professionals across the entire country.⁴ The pool of providers who genuinely hold these is small. Most MSPs don’t. That’s not an insult; it’s arithmetic.

None of this means fire your MSP. Plenty of MSPs are exactly the right partner for the day-to-day, and a good one is worth keeping for years. It means stop assuming the CMMC question and the IT question have the same answer.

The three ways to set this up

Once you accept that “who leads” is a real decision, there are only three workable answers. None is wrong. The wrong move is choosing one by default.

The honest deciding question: when the affirmation comes due each year, whose work do you want standing behind your signature? There’s no universally right answer — only the one you chose on purpose versus the one that happened to you.

What this looks like when it goes wrong

This isn’t hypothetical anymore, and it isn’t only happening to household names. The Justice Department has spent the last few years using the False Claims Act — the government’s fraud statute — against contractors who certified cybersecurity they hadn’t delivered. You don’t need a breach for it to apply; a false certification is enough.¹⁴

MORSE is the one to remember — small, and a provider’s shortfall became its problem. It’s not alone. A partial ledger of recent cybersecurity settlements:

And in December 2025 it moved past money: a former manager at a Virginia contractor was criminally indicted over misrepresenting the security of a cloud platform used by the Army.²¹ The exposure now reaches individuals, not just balance sheets — which is exactly why who signs your affirmation matters.

What “passing” actually requires — and why it never really ends

Two things owners consistently get wrong about the finish line.

You can’t buy your way to a conditional pass with a long to-do list

Scoring starts at 110 and you lose points for each control you haven’t met — 1, 3, or 5 points depending on how important it is.²² To pass even conditionally, you need at least 88 out of 110.⁷ And you can only defer the cheap stuff: only 1-point controls can go on a Plan of Action and Milestones. The heavyweight 3- and 5-point controls — the ones like multi-factor authentication — must be fully in place on assessment day.²³ Miss one of those and the score doesn’t matter; you don’t pass. (The full mechanics live in our SPRS score guide.)

If you do squeak in conditionally, the clock starts: 180 days to close every open item and pass a closeout check, or the conditional status expires and you’re back in line.⁷

It’s not “certify once every three years”

You sign an affirmation every year attesting that your controls are still in place.¹⁴ Evidence collection is continuous; the documentation has to stay current. The quiet trap: a contractor who passes once and then coasts often finds their posture has decayed by the next reassessment — and every decayed control is fresh exposure on the next signature. The signature that is, remember, yours.

Work it out for yourself, before you spend a dollar

You don’t need to hire anyone to get oriented. Start with the scorecard — the fastest way to find out whether the “we’ve got it handled” you heard from your MSP holds up. Nothing you enter leaves your browser.