The CMMC Inheritance Shortcut: MSPs, CSPs, and the 90% You Don't Own

By the Department of War’s own account, the fastest path to CMMC compliance is to not do most of the work yourself. Rent a seat on a managed platform, inherit 80 to 90 percent of the 110 controls from the provider, and pay an assessor for what remains. One unnamed company went from zero to all 110 controls in two months at about $1,300 a seat plus a $32,000 assessment.

Those figures are a single data point. Stacy Bostjanick, the Department’s chief of Defense Industrial Base cybersecurity, described the pilot to a reporter in June 2025 and would not name the company. There is no published dataset behind the numbers and no independent verification. They are one official’s account of one company, not an audited result. I want to keep that in view, because everything after it is about what the shortcut does to whoever buys it.

Inheritance is in the rule

The shortcut is not a vendor pitch dressed up as policy. It is written into the program rule, 32 CFR 170. Under §170.19, an External Service Provider (ESP), including a cloud provider, that does not process, store, or transmit CUI does not need its own CMMC assessment. The services it provides are assessed inside the contractor’s own assessment as Security Protection Assets. In the pilot, Microsoft, Google, AWS, and Oracle partnered with MSPs, mostly through virtual desktops. If the platform runs your security stack and never touches your CUI, its protections are counted as part of your assessment rather than assessed separately.

The rule then qualifies what it grants. In its response to a comment about enclaves, the Department wrote that a contractor “cannot inherit the enterprise certification,” that within the assessed scope “all requirements must be MET” whether implemented or inherited, and that “there is no established metric for inherited implementations.”

That last sentence is the one to sit with. The rule says you may inherit most of the controls and, in the next breath, says nobody has agreed on how to measure whether inheriting them accomplished anything.

The part nobody inherits

What remains after inheritance lands on the customer, and it is documented in a customer responsibility matrix. Bostjanick called that document “wildly important,” because NIST SP 800-171 still requires work “in your spaces” that no platform can do for you: physical security, incident response, the CUI your own systems handle. Ten to twenty percent of 110 is eleven to twenty-two controls, and those are the ones your vendor is not doing for you.

There is a nuance worth getting right. The formal requirement to demonstrate inherited controls through a Customer Implementation Summary or Customer Responsibility Matrix (CIS/CRM) is spelled out for Level 3, where an organization can use a FedRAMP Moderate cloud and must show how the 24 Level 3 requirements it inherits are still met. The Level 2 case, the 80-to-90-percent scenario, runs on the Security Protection Asset scoping, which is less prescriptive about how the residual controls get proven. The more common the shortcut becomes, the thinner the documentation of the part the customer still owns.

Why the shortcut exists

The shortcut exists because the assessment pipeline does not scale. The Department estimates 220,000 to 300,000 companies in the defense industrial base, roughly 80,000 of which need Level 2 and about 1,500 Level 3. There are 50 to 60 certified third-party assessment organizations (C3PAOs). That queue cannot clear on any timeline the rule assumes.

The layer meant to relieve it is itself unsteady. The Inspector General’s January 2025 audit (DODIG-2025-056) found the C3PAO authorization process “was not effectively implemented.” Of the 11 C3PAOs reviewed, two were authorized without a signed agreement and code of professional conduct, four without verifying their quality control leads were certified, and all eleven without adequately verifying that a certified assessor and quality control lead were on staff. The independent verification the shortcut is supposed to ease was not reliably verified before it got the job.

The concentration nobody is measuring

None of my sources raise this, and I want to flag it as my own inference rather than a sourced claim. If tens of thousands of small firms inherit from the same four hyperscalers and their MSP channel, the industrial base’s compliance posture concentrates in a handful of platforms. One mis-scoped shared environment, or one provider outage, becomes a systemic exposure instead of one company’s problem. I have no number for that risk, and I could not find anyone who does. The rule says nothing about it either.

I do not think that is an argument against the shortcut. A 40-person machine shop that buys into a platform handling most of the controls is probably better off than it would be trying to stand up the full 110-control stack alone. The worry is different. Inheritance moves the burden from implementing controls to holding up your end of a shared-responsibility document that most small firms will sign and not read.

What the suspension changed

This has gotten more important since Bostjanick described the pilot. In July the Department suspended the Phase II requirements that would have made third-party certification a contract condition, and a reform task force is now synthesizing industry feedback from a request for information about how to protect federal data while cutting compliance cost and burden. The suspension is its own story, covered elsewhere on this site. What it did to the shortcut is this: inheritance went from a cost-reduction pilot to a plausible plan for whatever replaces the suspended Phase II.

So the question stops being whether the shortcut is real. It is, and the rule says so. The question is who is left holding the part the platform did not inherit, and whether they know it. The Department can point to the platform and say the requirements are met. Whether the security is actually there depends on the eleven to twenty-two controls nobody inherited, and on a customer who can read the matrix well enough to know they are still theirs.

Sources

1. Federal Register — Cybersecurity Maturity Model Certification (CMMC) Program, Final Rule (32 CFR 170)
2. Federal News Network — DoD addresses two big challenges to make CMMC a reality
3. DoD Office of Inspector General — Audit of the DoD’s Process for Authorizing Third-Party Organizations (DODIG-2025-056)
4. DoD Office of Inspector General — DODIG-2025-056 Full Report (PDF)
5. Department of War — Department of War Suspends CMMC Phase II Requirements