Twenty six tabs. I counted them once while helping a six person managed service provider sort out a defense client’s assessment prep, and every tab was a different version of the same spreadsheet. Controls on one, evidence on another, a folder of screenshots nobody could trace back to a date, and a Notion page where someone had written “ask Dave about the firewall” in March and never followed up. That’s the real cost of CMMC for most MSPs. Not the certification itself. The paperwork sprawl.

Here’s the part that surprises people: most managed service providers don’t need their own certification at all. If you host, manage, or touch systems that hold Controlled Unclassified Information for a defense contractor, you’re what the program calls an external service provider, and your work gets examined inside your client’s assessment. How deeply depends on what you actually do. Anyone who has tried to read msp cmmc guidance knows the scope question is the one that keeps owners up at night, so it’s worth being blunt about the answer.

Your access level decides your exposure. Break glass only, and you are a line item in the client’s System Security Plan. Standing admin rights on a server that stores CUI, and you are effectively running a piece of the client’s boundary, which means their assessor has questions for you whether you like it or not.

The three places MSPs actually sit in a client’s assessment

Picture a spectrum. At one end, you’re selling help desk hours and a monitoring tool that lives entirely on your own cloud tenancy. Your client’s CUI never touches your infrastructure. At the other end, you run the file server, the backup target, and the identity provider, which means CUI is sitting on boxes you own. The middle is messier, and the middle is where most MSPs actually live.

Ask yourself which of these describes your contracts:

• Advisory only. You tell the client what to fix and they fix it. No standing access, no data on your systems.
• Co-managed. You share admin duties with an internal IT person. Access exists but it’s shared and logged.
• Fully managed. You own the tooling, the backups, and the credentials. CUI flows through your stack daily.

The third bucket changes your business. If CUI lands on systems you control, you’re looking at the same security requirements your client faces, and that means controls from the National Institute of Standards and Technology apply to your shop directly. I’d rather see an MSP get an independent assessment once than sit through the same evidence requests from eight different clients every spring. The repeated examination is what quietly eats your margin.

What to fix first if you can only fix five things

Owners ask for a priority order and usually get a control family list back, which is useless when you have a Tuesday deadline. Here’s the order I’d work in, based on what assessors actually pull on:

1. Your identity layer. MFA everywhere, no exceptions for the owner’s account, and a written process for who gets admin rights and how they lose them.
2. Data flow map. One page showing where CUI moves between your client, your tools, and your backup target. If you can’t draw it in ten minutes, your SSP is fiction.
3. Evidence with dates. Screenshots expire. A dated export from your RMM or ticketing system carries weight a folder of images never will.
4. Incident response that names a person. “The team will respond” is not a plan. Put a name and a phone number in it.
5. Subcontractor list. Every vendor you pass data to needs a documented answer, even the cheap ones.

That last item is where MSPs get caught flat footed. You’re part of your client’s supply chain, and your own vendors are part of yours. The U.S. Small Business Administration tracks how much federal contracting flows to small firms, and a large share of that work lands on companies with no in-house compliance staff at all, which means they lean on you to carry the documentation load. Worth knowing before you promise something you can’t produce.

Should you sell CMMC as a service line?

Yes, but not the way most MSPs try it. Selling “CMMC compliance” as a flat package is a trap, because the work scales with the client’s boundary, not with a price sheet. What sells is readiness work: gap assessments, SSP drafting, evidence organization, and the ongoing hygiene that keeps a client audit ready between assessments. Those are recurring, they use skills you already have, and they don’t require you to become a registered assessor.

Pricing conversation I keep having with owners: they quote a single number, the client balks, and the deal dies. Quote phases instead. Discovery, gap report, remediation plan, ongoing management. Each phase stands on its own, so the client can stop after the gap report if the budget disappears, and you still got paid for real work.

One warning. Don’t promise certification outcomes. You can promise organized evidence and a clean SSP. Nobody can promise what a third party assessor will conclude, and the Cybersecurity and Infrastructure Security Agency publishes plenty of plain guidance for small organizations that you can point clients at when they want a neutral source instead of your invoice.

What actually separates the MSPs who win this work

It isn’t technical skill. It’s the ability to show a client, in one sitting, exactly where every requirement stands. I’ve watched an owner open a single dashboard, walk a prospect through their controls, evidence dates, and open tasks, and win a contract on the spot against a bigger competitor with a nicer website. That’s the whole game.

The framework I’d hand any MSP right now is simple, and I haven’t seen it written down anywhere else, so take it as my own: one client, one workspace, one evidence trail. No client gets two places where their information lives. The moment a control has two possible homes, the evidence goes missing, and an assessor will find that gap faster than you will.

Practically, that means picking a tool that holds controls, evidence, documentation, and task status together, then killing every parallel spreadsheet on day one. Yes, day one, before the migration is perfect, because the old spreadsheets are the reason the migration never finishes.

And here’s the honest stance: most MSPs are overestimating what they need and underestimating what their clients will pay for help. Your clients aren’t shopping for a certification vendor. They’re shopping for someone who can make the next assessment boring. Boring is the product.

Where to go from here

Start with your three largest defense clients. Write down what data of theirs touches your systems, who on your team can reach it, and where the evidence for that access lives. That’s a Tuesday afternoon, not a project. If the answer turns out to be “nowhere,” you just found your first piece of billable work, and it’s the kind that keeps paying every year.

So which is it for you, advisory only, or are you already holding CUI on boxes with your logo on the invoice?