CMMC 2.0 Compliance Guide for MSPs Serving DoD Contractors

If your MSP manages IT for any company in the defense supply chain, Cybersecurity Maturity Model Certification (CMMC) 2.0 compliance is your problem too. Defense contractors cannot outsource accountability of complying with CMMC controls, but they can outsource their implementation, and that puts MSPs directly in the middle of every assessment that follows. But, what does CMMC 2.0 mean for MSPs?

Every client that is a DoD contractor handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) must meet CMMC 2.0 as a final rule. The question is not whether your customers need to comply but rather whether your practice is built to support it. This guide covers the requirements, who they apply to, and how to enforce them if your clients fall within scope.

What CMMC 2.0 Requires

As a framework, CMMC 2.0 establishes three levels of cybersecurity requirements tied to the sensitivity of the federal information a defense contractor handles:

• Level 1 applies to contractors handling FCI. It requires 17 basic safeguarding practices from FAR 52.204-21 and is satisfied through annual self-assessment and affirmation.

• Level 2 is where most of the defense industrial base sits. It covers organizations handling CUI and maps directly to all 110 security requirements in NIST SP 800-171 Rev. 2. In the past, Level 2 required a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO), but recent updates have changed that. More on that in a second.

• Level 3 applies to contractors supporting advanced programs with the highest-sensitivity CUI and adds requirements from NIST SP 800-172 on top of the Level 2 baseline. It requires a government-led DIBCAC assessment.

The practical reality for MSPs: Level 2 is likely where your customers are, and the 110-practice requirement set is where your security stack either earns its place or exposes gaps.

The Phase II Suspension: What Changed and What Did Not

On July 13, 2026, the Department of War suspended CMMC Phase II, pausing the mandatory C3PAO certification gate that was scheduled to enter solicitations on November 10, 2026. A CMMC Reform Task Force was stood up to conduct a 60-day review of the program, with conclusions expected around mid-September 2026.

Read this carefully: the pause is not a repeal of the security obligations for organizations in Level 2.

NIST SP 800-171 Rev. 2 safeguarding requirements and DFARS 252.204-7012 and 252.204-7020 compliance obligations are still intact. CMMC Phase I self-assessments at Level 1 and Level 2, along with the annual affirmation, are the only levels a contracting officer may currently designate. The CMMC clause under DFARS 252.204-7021 is still prescribed for use through November 2028.

Under the pre-suspension model, a C3PAO assessor reviewed the environment independently. That external check absorbed a significant portion of the verification burden. In a self-attestation world, that check disappears, shifting the full burden of verification back onto the contractor and, by extension, onto the MSP managing their environment.

What the Phase II Suspension Means for MSP Liability

The DOJ has consistently pursued False Claims Act (FCA) actions tied to DFARS 252.204-7012 noncompliance. The Civil Cyber-Fraud Initiative is active, and settlements like the case against DIB contractor  LOGZONE have already demonstrated enforcement reaches NIST SP 800-171 self-assessments. FCA violations have resulted in fines reaching hundreds of thousands of dollars.

For MSPs, this creates a specific exposure scenario. If a DIB customer self-attests to a score your environment cannot support, and DOJ investigates, the trail leads to the systems, configurations, and controls you manage. It is critical MSPs work with customers to attest carefully and build environments that are defensible by evidence, not assumption.

How to Submit a Comment to the CMMC Reform Task Force RFI

The CMMC Reform Task Force opened a Request for Information (RFI) as part of its 60-day review. MSPs and defense contractors can submit formal comments directly through the federal rulemaking portal at regulations.gov. Search for the active CMMC-related docket and submit under your organization name or as an individual. If compliance costs have affected your practice, quantify them. Assessment preparation hours, tooling investments, staff training, and customer churn tied to compliance friction are all relevant data points. The Task Force is evaluating whether the current program structure imposes disproportionate burden on small and mid-sized contractors and their service providers. A specific, documented comment from an MSP carries more weight than a general objection. The window is open now.

Why MSPs Cannot Afford to Wait to Ensure CMMC 2.0 Compliance

Even with the Phase II suspension in place, the underlying compliance obligations have not changed. If your DIB customers have not started scoping, they are behind. Because assessment preparation depends heavily on the security stack their MSP has built and documented, waiting compounds the problem.

The cost of starting late is not just a gap remediation project. It is a contract eligibility problem with real consequences attached.

How to Scope CMMC 2.0 for Small Defense Contractors: Where MSPs Should Start

Before any tool gets deployed or any policy gets written, the scope has to be defined correctly. A poorly scoped assessment costs more, takes longer, and produces weaker evidence.

Start by identifying where CUI lives. Map every system, device, and user that processes, stores, or transmits CUI. That boundary defines your CMMC Assessment Scope. Everything inside it is subject to the 110 practices. Everything outside it, properly documented, is not.

From there, the scoping work breaks into four areas:

1. Define which assets are in scope versus out of scope, and deliberately limit scope to reduce cost and complexity.
2. Evaluate every External Service Provider (ESP), including cloud platforms, SaaS tools, and the MSP itself, for potential scope inclusion.  
3. Build a System Security Plan (SSP) that maps assets, data flows, and the security controls applied to each.  
4. Document cloud services touching CUI carefully.  

The CMMC Level 2 Domain Checklist for MSPs

Here is a practical overview of each domain, what it demands, and where your stack needs to deliver:

• Access Control (22 requirements): Least privilege, session management, remote and wireless controls, CUI encryption on mobile devices. Every connection must be authorized, monitored, and controlled.
• Awareness and Training (3 requirements): Role-based training for all personnel, covering CUI handling risks and insider threat recognition.
• Audit and Accountability (9 requirements): Centralized logging with user-level traceability, cross-system correlation, and tamper-resistant log protection.
• Configuration Management (9 requirements): Documented, enforced secure baselines for all hardware, software, and firmware. All changes logged and impact-assessed before implementation.
• Identification and Authentication (11 requirements): MFA on all accounts, replay-resistant authentication, enforced password complexity, and immediate replacement of all default credentials.
• Incident Response (3 requirements): Documented handling capability covering preparation through recovery. All incidents tracked, reported, and regularly tested.
• Maintenance (6 requirements): Controlled maintenance with approved tools and authorized personnel only. MFA required for all remote maintenance sessions.
• Media Protection (9 requirements): Physical security and access control for all CUI media. Encrypted portable storage. Sanitization before disposal.
• Personnel Security (2 requirements): Pre-access screening for all individuals. Immediate access revocation on termination or role change.
• Physical Protection (6 requirements): Access controls, cameras, visitor escort, and CUI safeguards enforced at all work sites including remote environments.
• Risk Assessment (3 requirements): Periodic risk assessments, regular vulnerability scans, and risk-prioritized remediation.
• Security Assessment (4 requirements): Periodic control effectiveness reviews, continuous monitoring, and a current SSP at all times.
• System and Communications Protection (16 requirements): Boundary monitoring, FIPS-validated encryption for CUI in transit and at rest, split tunneling prevention, and control over VoIP and collaborative devices.
• System and Information Integrity (7 requirements): Timely flaw remediation, updated malicious code protection, and active monitoring of inbound and outbound traffic for indicators of compromise.

Who Is Responsible for What: The Accountability Map

This is where MSP engagements go wrong. CMMC compliance responsibility is not evenly distributed, and it is not transferable. Getting the boundaries right before assessment protects everyone.

The Defense Contractor Owns Compliance

End customers are always accountable for CMMC compliance. The MSP can build the environment, configure the tools, and produce the evidence, but the contractor still owns the result. Key responsibilities that fall on the customer include:  

• Defining the assessment scope
• Developing and maintaining the SSP
• Scanning for vulnerabilities and assessing risk
• Enforcing physical and personnel security
• Documenting and delivering security awareness training
• Achieving MET or NA on all 110 practices in accurate self-assessment
• Submitting results to the Supplier Performance Risk System (SPRS)

No managed service agreement changes that accountability chain.

How SPRS Submission Works

The Supplier Performance Risk System (SPRS) is the federal portal where defense contractors submit their NIST SP 800-171 self-assessment scores. Every contractor subject to DFARS 252.204-7019 must post a current score before receiving a DoD contract award. The score ranges from negative 203 to 110, calculated by assigning point values to each of the 110 practices and deducting for unmet requirements.

MSPs do not submit scores on behalf of contractors. The submission is made by an authorized representative of the contracting organization, who attests to its accuracy. Your role is to ensure the environment you manage can support the score your customer submits. An inflated score tied to a deficient environment is the scenario that draws DOJ attention. Make sure the evidence exists before the attestation goes in.

The MSP Owns the Stack and the Evidence

MSPs carry responsibility for IT operational controls and for continually reviewing and adapting the quality of the security environment they deliver based upon how the Contractor's environment changes. That means configuring and managing the security platform correctly, enforcing endpoint security controls, implementing compliant network security, assisting in GRC documentation, translating SOC activity into audit-ready evidence, maintaining continuous monitoring and audit trails, conducting pre-assessment gap reviews, supporting vulnerability scans and remediation tracking, and facilitating incident response testing.

One boundary that catches MSPs off guard: physical security, personnel security, maintenance, and media protection are out of scope for the MSP. Those domains belong entirely to the contractor.

Does Your MSP Need Its Own CMMC Certification?

This question does not have a single answer, and that ambiguity is exactly why it catches MSPs off guard.

If your MSP accesses, processes, stores, or transmits CUI as part of delivering services to a DIB customer, your systems are likely in scope for that customer's CMMC assessment. That means your environment, your tools, and your configurations get evaluated as part of their assessment boundary. You do not necessarily need your own separate CMMC certification, but the systems you operate on behalf of that customer do need to meet the applicable requirements.

The cleaner path for most MSPs is to architect the managed environment so that CUI stays within the contractor's boundary and the MSP accesses it only through controlled, documented mechanisms. That limits scope creep into your own infrastructure. Where that separation is not possible, document the access model clearly in the SSP and treat your relevant systems as in-scope assets. Ambiguity in that boundary is a liability during assessment and a larger one if DOJ ever comes looking.

Todyl's Role as a Security Protection Asset

Security vendors like Todyl operate as a Security Protection Asset (SPA) provider. Its responsibility is securing and operating its own platform and serving as a reliable evidence partner. That means providing compliance attestations when requested, delivering platform-level documentation, and providing ESP evidence. Todyl is not accountable for individual CMMC requirements, cannot fulfill PE, PS, MA, or MP controls, and drafts or unverified claims from any party are not evidence.

How the Todyl Platform Maps to CMMC Level 2

Todyl supports and helps demonstrate compliance across the full 110-practice requirement set. No single tool covers everything, and Todyl does not claim otherwise. What it does is consolidate the capabilities that cover the most ground, reduce the fragmentation that makes evidence collection painful, and give MSPs a coherent platform to operate from.

Here is how each module maps to the CMMC domains:

SIEM: The Compliance Backbone

SIEM supports CMMC Level 2 by demonstrating compliance across over 40 of the 110 practices. Its core strengths are Audit and Accountability (AU), Access Control and Identity Monitoring (AC/IA), Incident Response (IR), Configuration and Change Management (CM), System and Information Integrity (SI), and Risk and Security Assessment (CA/RA).

For CMMC purposes, SIEM centralizes audit log collection and correlation, provides the audit trails that prove controls are working, detects unauthorized access and suspicious activity, monitors communications for unauthorized data transfers, and supports continuous monitoring requirements across Security Assessment (CA).

The AU domain requires that every logged event trace back to an individual user. If it is not logged, it did not happen, and an assessor will treat it accordingly.

Endpoint Security: Frontline Telemetry

Endpoint Security supports and demonstrates 20-plus Level 2 practices, with core strength in System and Information Integrity (SI). It continuously monitors endpoints, automatically updates malicious code protection, detects and blocks unauthorized software installation, and generates the forensic telemetry that supports both audit trails and incident response evidence.

For Configuration Management (CM), endpoint tools detect and block unauthorized software at the device level. For SI, continuous endpoint monitoring is the mechanism that turns a malicious code defense policy into an observable, enforceable reality.

MXDR: The 24/7 Operations Function

MXDR supports and demonstrates 20-plus Level 2 practices with Incident Response (IR) as its core strength. It fulfills the continuous monitoring mandate that runs through nearly every CMMC domain, provides the documented operational IR capability that assessors look for, and produces audit-ready evidence of threat detection, investigation, and response activity.

For MSPs that do not run an internal SOC, MXDR delivers a formalized security operations function with the documentation to support it. For the IR domain specifically, CMMC requires that incident handling capabilities be built, tested, and documented, and that all incidents get tracked and reported. MXDR supports all three.

LAN Zero Trust: Access Enforcement at the Network Layer

LAN Zero Trust (LZT) enforces zero trust policies on internal networks, directly supporting Access Control (AC) and System and Communications Protection (SC) requirements. It restricts access to unauthorized ports and protocols, limits internal network access to authorized connections, and demonstrates least-privilege enforcement at the network layer.

The SC domain is the largest in CMMC Level 2, covering 16 requirements. Every boundary, pathway, and channel through which CUI flows falls under its scope. LZT is the enforcement mechanism that makes internal access controls auditable.

SOAR: Automated Response and Containment

SOAR executes automated containment actions in response to SIEM alerts, terminates unauthorized user sessions for Access Control (AC) violations, disables accounts in response to System and Communications Protection (SC) policy violations, and automatically disables terminated employee accounts that engage in potentially malicious behavior.

The value for CMMC is specificity: SOAR produces records of every enforcement action taken during an event, turning incident response from a described process into documented evidence.

GRC: The Documentation Layer

GRC serves as the demonstration layer across virtually all 110 Level 2 practices. Its core strength is Security Assessment and the System Security Plan (CA), but its scope runs across every domain: Risk Assessment (RA), Awareness and Training (AT), Access Control (AC/IA), Incident Response (IR), Configuration Management (CM), Personnel and Physical Security (PS/PE), Maintenance and Media Protection (MA/MP), and System Integrity and Communications (SI/SC).

Policies, procedures, assessments, and evidence artifacts that assessors require all live in GRC. For domains where Todyl's technical controls do not apply, like PE and MP, GRC provides the process documentation that satisfies the requirement.

In a self-attestation environment, GRC is how you prove compliance evidence, showcasing requirements directly rather than just claiming them. In conversations with the DOJ, that proves a major difference maker.

What Todyl Does Not Do

Clarity on this matters, because overpromising on compliance tooling is how MSPs and contractors end up with indefensible attestations.

Todyl does not act as a panacea for all CMMC Level 2 components. It does not provide a silver bullet for any individual practice, nor does it offload compliance responsibility from the contractor or the MSP. GRC documentation alone does not constitute comprehensive compliance. Todyl also does not eliminate the need for other solutions, including MFA systems and vulnerability scanners.

A platform that supports 110 practices is not the same as a platform that satisfies them. The contractor still has to implement controls, enforce them, and prove it.

Start the Conversation With Your DIB Customers Now

The CMMC Reform Task Force report lands around mid-September 2026. Whatever it produces, the underlying obligation to protect CUI and FCI is not going away. Neither is DOJ enforcement under the Civil Cyber-Fraud Initiative.

Contact Todyl to see how the platform maps to CMMC Level 2 and how your practice can support defensible compliance for defense contractor clients today and for whatever the Reform Task Force finalizes next.