A CMMC Level 2 MSSP is a managed security service provider whose services support a contractor’s Level 2 environment: monitoring, detection, response, log management and similar work. Under the CMMC program rule, a provider like this is treated as an external service provider, and its services can fall inside your assessment scope. That makes choosing one a scoping decision as well as a buying decision. This guide covers how an MSSP fits into CMMC scope, what to look for in CMMC managed security services, the red flags, and the questions to ask before you sign.
Why CMMC Level 2 changes what you need from an MSSP
Most MSSP pitches are about outcomes like faster detection and round-the-clock coverage. Those matter. CMMC Level 2 adds a different question: can you show, requirement by requirement, who does what and what proves it?
The work an MSSP does touches many parts of NIST SP 800-171. Log collection and review relate to audit and accountability. Alert handling and escalation relate to incident response. Detection and patch support relate to system and information integrity. Risk and vulnerability work relate to risk assessment and security assessment. Access the provider holds in your environment relates to access control.
Outsourcing that work does not outsource the responsibility. You can hand off the activity. You cannot hand off the job of showing it is done, because your assessment covers your environment, including the services you rely on.
So a Level 2 buyer should look past “we run a SOC” and ask how the service maps to the requirements, what evidence it produces, and how it is documented in your System Security Plan.
Where an MSSP sits in your CMMC scope
The scoping rules for Level 2 are in 32 CFR 170.19. In plain terms, a provider is in scope because of the services it provides you. The rule asks you to consider two things: whether the provider is a cloud service provider, and whether it processes, stores or transmits CUI or what the rule calls security protection data. Security protection data is information about your security itself, such as logs, alerts and configurations.
| Situation | How the rule treats it |
|---|---|
| The provider handles only security protection data | Its services are in scope and are assessed as security protection assets, against the Level 2 requirements relevant to what those services do |
| The provider handles CUI and is not a cloud service provider | Its services are assessed as part of your own assessment, covering the full set of Level 2 requirements for those services. The provider may also choose to get its own CMMC Level 2 certification, which can reduce the work during your assessment |
| The provider is a cloud service provider that handles CUI | It must meet the FedRAMP requirements referenced in DFARS 252.204-7012 |
| The provider handles neither CUI nor security protection data | It does not meet the rule’s definition of an external service provider |
Two documentation duties follow from this. First, you record the provider in your System Security Plan, your asset inventory and your network diagram, with the services it provides. Second, the provider’s service description and a customer responsibility matrix must lay out the responsibilities of each party. If a provider cannot give you a customer responsibility matrix, you cannot document the relationship properly.
This is a summary of the rule as written when this post was prepared. The details depend on your contract and on which assets the provider touches, so read the current text of 32 CFR 170.19 and talk to your assessor before you decide how a given provider is scoped.
What to look for in CMMC managed security services
These are features and practices worth looking for when you compare providers. Not every provider will offer all of them, and the right mix depends on your environment.
- A clear statement of scope. Which of your systems, accounts and data the service touches, and whether the provider’s staff or tools will ever see CUI.
- A written customer responsibility matrix. Mapped to the requirements the service supports, with each party’s role spelled out.
- Defined log and monitoring coverage. Which sources are collected (endpoints, identity, cloud, network), how long logs are kept, and who reviews them.
- Documented detection and response. An incident handling process, escalation paths and support for reporting, with a record kept for each case.
- Vulnerability and patch support. If it is in the contract, how findings are reported and tracked to closure.
- Clear data handling. Where your data goes, where the provider’s analysts and tools are located, any personnel or location restrictions your contract imposes, and whether the service works in your cloud, including a government cloud if you use one.
- Controlled access to your environment. Least privilege, multi-factor authentication, logging of the provider’s own admin actions, and a way to revoke access quickly.
- Evidence you can use. Reports, tickets and logs that are dated, sourced and available to hand to an assessor, not only a dashboard.
- A position on its own CMMC status. Whether it holds or plans a CMMC certification, or how it expects its services to be assessed alongside yours.
- Contract terms that match the work. Notification duties, assessor access, flow-down of requirements, and what happens at renewal or exit.
- Support during an assessment. Whether provider staff will be available for interviews and evidence requests.
Who owns what
The split below is typical, not universal. Your contract and your customer responsibility matrix decide the real answer, so treat this as a starting point for the conversation.
| Responsibility | Typically the MSSP | Typically you |
|---|---|---|
| Collecting and monitoring logs from covered sources | Operates collection and monitoring | Gives access, confirms the source list is complete |
| Alert triage and escalation | Triages and escalates by the agreed process | Responds to escalations within the agreed times |
| Incident response plan and decisions | Supports and advises | Owns the plan and the decisions |
| Reporting to the government when your contract requires it | Provides data and timelines | Owns the reporting |
| Scope, inventory and network diagram | Provides service details | Owns and maintains them |
| Policies and procedures | Its own, for its services | Yours, for your environment (they typically help draft them, however) |
| Access policy and account approvals | Follows your rules in your environment | Sets the rules and approves access |
| Evidence for an assessment | Supplies evidence of the service | Collects, organizes and presents it |
The pattern is that the provider does the operating and you keep the ownership. If a provider’s matrix claims the opposite for something your contract makes yours, ask why.
Red flags
- It promises compliance or certification. No provider can guarantee you pass an assessment. The assessor decides.
- It claims to be “CMMC compliant” without saying what that covers. Ask what was assessed, by whom, and for which services.
- It will not provide a customer responsibility matrix. Without one, the relationship can’t be documented the way the rule expects.
- It can’t say whether it will touch CUI, or where your data goes. That answer decides how it is scoped.
- Log sources and retention are vague. “We monitor everything” is not a scope.
- It offers dashboards but no evidence. You need dated records you can hand to an assessor.
- It wants standing admin access with no logging. Its access to your environment is part of your attack surface and your scope.
- It treats scoping as your problem. A provider that has supported Level 2 customers should be able to explain how its services are normally scoped.
- It offers to assess you as well. A company can provide managed services and perform assessments, but it should not do both for the same customer.
Questions to ask any MSSP
- Will your staff or tools ever store, process or transmit CUI in our environment? If so, how is that handled?
- Can we see your customer responsibility matrix for this service, mapped to the requirements?
- Which log sources do you collect, how long do you keep them, and who reviews them?
- What does an incident record look like from alert to closure? Can we see a sample with details removed?
- Where are your analysts and tools located, and does the service work in our cloud, including a government cloud?
- How do you control and log your own access to our environment?
- What evidence can you give us for an assessment, and how quickly?
- Do you hold or plan a CMMC certification? If not, how do you expect your services to be assessed alongside ours?
- Will your staff be available during our assessment?
- What does the contract say about assessor access, incident notification and exit?
Seeing whether the work is actually being done
Signing a contract with an MSSP is the start. The harder part is knowing, month after month, that the service is doing what the matrix says and that you can prove it.
That is where a continuous verification platform like Continu-US helps. Continu-US is built to keep evidence tied to each assessment objective, and several of its features line up with an MSSP relationship:
- Incident and alert evidence from SIEM solutions like Elastic, Sentinel and Huntress, so provider-handled detection and response shows up as dated records.
- Change and vulnerability evidence from Ticketing systems like Jira, ServiceNow and SharePoint boards, including approvals and whether remediation was on time.
- Inheritance recorded by provider. Controls handled by a named provider, fully or in part, are recorded as such, with what you still own.
- Customer responsibilities spelled out, and a shared responsibility matrix that flows into the generated System Security Plan.
- Recurring activities with owners and due dates, so reviews of the provider’s reports don’t lapse.
- An audit log and evidence packages, with file hashes and per-objective folders, so the record can be handed to an assessor.
Continu-US runs in your own Azure tenant and reads your environment with read-only access. It verifies and evidences controls. It does not make you compliant, and it does not decide whether a requirement is met.
If you are an MSSP, partner mode lets you monitor many client organizations from one view. ATLLC uses Continu-US internally for the compliance program behind its own managed services.
Frequently asked questions
Do I need an MSSP for CMMC Level 2? No. CMMC does not require you to use a managed security provider. Many contractors do the work in-house. An MSSP is one way to cover monitoring and response, and if you use one, it becomes part of your scope.
Does a CMMC MSSP need its own CMMC certification? It depends on what it touches. As I read 32 CFR 170.19, a provider that is not a cloud service provider and handles CUI has its services assessed as part of your assessment, and it may choose to get its own Level 2 certification to reduce the effort. A cloud service provider handling CUI must meet the FedRAMP requirements in DFARS 252.204-7012. Confirm the details for your contract with your assessor.
What is a customer responsibility matrix? A document that lays out which party is responsible for which requirement or activity in a service. The rule expects it, together with the service description, to describe each party’s responsibilities.
Does hiring an MSSP make me CMMC compliant? No. It can cover real work, and it can produce evidence. Whether each requirement is met in your environment is the assessor’s decision.
Can my MSSP also be my assessor? A company can offer managed services and also perform assessments as a C3PAO separately, but it should not do both for the same customer.
Talk to us
If you are choosing an MSSP, or you are one, ask us for a walkthrough of how Continu-US keeps provider evidence tied to your objectives.
Sources
Continu-US verifies and evidences controls. It does not make an organization compliant or certified. Assessment decisions belong to the assessor. ATLLC is a C3PAO, and buying Continu-US does not influence or entitle anyone to a certification outcome.