What to outsource for CMMC and what to keep in-house

Your organization keeps ownership of its controls, its evidence and the affirmation made by its Affirming Official. Outside parties such as a managed service provider, an implementation partner or a CMMC Third-Party Assessment Organization (C3PAO) can prepare systems and evidence, but none of them can issue the assessment result. Under 32 CFR 170.22(a)(1), the Affirming Official is the senior representative responsible for CMMC compliance and has authority to affirm continuing compliance for the organization, so that role cannot be handed to a consultant. The Department of War suspended CMMC Phase II on 13 July 2026, so certification assessments are paused for now. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, and confirm the current status of the rule with your contracting officer before you plan around it.

The right split depends on three things: the scope of your environment, the skills already on your team and the third-party services that touch CUI. Start with a written inventory of who administers each system, who operates the security tools and which vendors store, process or transmit CUI. Work that is closest to your daily operations, such as maintaining the system security plan, tracking plans of action and approving changes, usually stays with people who can answer for it later. Specialist work, such as a gap assessment, configuration hardening or log pipeline design, is often a good candidate for an outside partner under a fixed-scope written agreement. Ask any partner to state in writing which requirements it performs and which remain yours.

Third-party services need the closest look. A non-cloud External Service Provider (ESP) that handles CUI is treated as an extension of your environment and is assessed against all applicable Level 2 requirements, so its services must appear in your system security plan and in its customer responsibility matrix. Ask each provider for a current matrix that names every party with security responsibilities. Finally, keep consultants separate from the assessment. Under 32 CFR 170.8(b)(17)(i)(G), ecosystem members may not take part in a Level 2 certification assessment of an organization they consulted for within the previous 3 years, so confirm conflicts with your C3PAO before you sign any preparation contract.

Who does what: your team, an implementation partner, an MSP and the C3PAO

Your organization owns CMMC. The Affirming Official is the senior representative responsible for ensuring compliance with CMMC requirements and has authority to affirm continuing compliance for the organization (32 CFR 170.22(a)(1)). That role cannot be delegated to a consultant or a managed service provider. Your team also decides the assessment scope, approves the system security plan, and runs the daily operation of controls such as access reviews, incident handling and change approval.

Affirmation: The Affirming Official signs affirmations of continuing compliance and must be able to explain what the organization actually does.
Scope decisions: Your team decides which systems, people and facilities handle CUI and which are out of scope.
Policies and ownership: Named owners maintain policies, the SSP and the POA&M, and approve exceptions.
Daily operation: Staff perform reviews, monitoring, patching and training that generate evidence over time.
Oversight of outside parties: Your team reviews what partners deliver and accepts or rejects it.

Before you engage any outside party, confirm which of these roles your staff can fill and which need a named external resource in writing.

What the Affirming Official must own and cannot delegate to a consultant

The Affirming Official is the senior representative within each organization seeking assessment who is responsible for ensuring CMMC compliance and who has authority to affirm continuing compliance for that organization, as defined in 32 CFR 170.22(a)(1). That role cannot be handed to a consultant, an implementation partner or a managed service provider. Those firms can prepare systems, draft the *system security plan* and help assemble evidence, but the affirmation is the organization's own statement, made by someone with the authority to bind the company to it. Before engaging anyone, name the individual, confirm they hold that authority in writing, and confirm they understand what they are signing.

In practice, the Affirming Official owns the decisions that make the affirmation true. They should approve the assessment scope, accept or reject open items on any *plan of action and milestones*, decide which external service providers are documented in the system security plan, and sign off that the evidence reflects the operating environment rather than a snapshot prepared for the assessor. A useful check is whether this person can explain, without notes, which requirements are met through a provider's customer responsibility matrix and which the company performs itself. If the answer is no, the consultant's work is not yet ready for affirmation. The affirmation rules and the continuing-compliance obligations that follow from them are set out in the affirmation section of this guide and in the eCFR text of 32 CFR 170.22, which you should read with counsel before any affirmation is signed.

How external service providers come into CMMC scope

Whether an external service provider (ESP) falls inside your CMMC assessment depends on what the provider does with your CUI, and the final rule sorts ESPs into three treatments. A cloud service provider (CSP) that handles CUI must meet the FedRAMP requirements referenced in DFARS 252.204-7012. A non-cloud ESP that handles CUI is treated as an extension of your own environment: its services are assessed within your scope against all applicable Level 2 requirements, and it is accountable for every user with access to CUI through its service. An ESP used purely for staff augmentation, where you supply all processes, technology and facilities, needs no CMMC assessment of its own. A non-cloud ESP that provides technical support is an MSP, and an ESP that manages a third-party cloud service on your behalf is not itself a CSP. Read those definitions against the actual service contract, not the vendor's marketing language.

Your first task is a written classification for each provider that touches systems in scope. Ask the provider which of its personnel, tools and data paths reach CUI, whether it hosts any CUI itself, and whether it operates a cloud platform that your environment depends on. Record the answer alongside the contract clause and the data flow it describes. Where a provider is an MSP, expect the Lead CCA to require its service description and customer responsibility matrix, and expect your System Security Plan to name the provider and the requirements it performs. Confirm the classification with your Affirming Official and, where the answer is unclear, with your C3PAO before the assessment rather than during it.

Scope decisions made late are the expensive ones. If a provider falls inside scope, it may need documentation, evidence and sometimes its own assessment before your certification assessment can finish, so put the question to each provider during contract renewal or onboarding, not after an assessment date is set. Ask whether it holds a FedRAMP authorization where one applies, whether it will sign a customer responsibility matrix, and whether it will allow the assessment team to review its controls. Also confirm the current status of CMMC phase requirements with the Department of War, because the schedule for Level 2 certification assessments has changed and the answer determines how urgently you need this documentation.

How to build and check a customer responsibility matrix

This sequence turns a non-cloud External Service Provider's role into documented, assessable evidence in your SSP, the ESP's service description and a customer responsibility matrix that an assessor can test against every in-scope Level 2 requirement. It also shows what to do if the assessment team cannot confirm the ESP is properly documented.

Confirm the ESP is in scope and its role
Start by deciding whether the provider is in scope at all. Staff augmentation, where you supply all processes, technology and facilities, needs no CMMC assessment. A non-cloud ESP that provides technical support is a managed service provider and its services fall inside your assessment boundary. Your compliance lead and the provider should agree this in writing, and the output is a short scoping note that names the provider, the services it performs and the CUI systems it can reach. Confirm the classification with your assessor early, because it determines every later step.
Document the ESP in the system security plan
Record the provider's use in your system security plan, including which services it performs, which systems and accounts it touches and how it connects to the CUI environment. Under 32 CFR 170.16(c)(3), this documentation is required. The Affirming Official, or a delegate who understands the environment, should review the entry. The output is an SSP section that matches the scoping note and names the provider as an external party rather than leaving its role implied.
Collect the provider's service description
Ask the provider for its written service description, which should state what it does for you, the tools it uses, the people who operate them and the boundaries of its access. Your side reviews it against the SSP entry and the scoping note. Gaps, such as a service the provider performs but the SSP does not mention, are fixed before you proceed. The output is an agreed service description signed by both parties, with a version date and an owner on each side.
Map each in-scope requirement to a responsibility split
Work through the Level 2 requirements that touch the provider's services, using the domain and requirement IDs such as AC.L2-3.1.1 as your reference. For each, record whether the provider performs it wholly, partly or jointly, and who performs the rest. The matrix is a working document, so keep one row per requirement and one column per party. The output is a complete matrix where every in-scope requirement has a stated split, with no blank rows and no requirement left to assumption.
Name every party with security responsibilities
Go beyond your provider and your own team. Include any upstream vendor, hosting or cloud service, identity provider or monitoring service whose work supports the requirements in the matrix. CAP v2.0 expects the matrix to name all parties with security responsibilities, so a missing upstream dependency is a finding waiting to happen. The output is a party list with contact owners and the specific requirements each party covers, reviewed by the people who run those services.
Check that the matrix is current
Compare the matrix against the current service description, the SSP and the systems as they run today. Any change in provider staffing, tooling, access paths or hosting since the last review requires an update. CAP v2.0 asks assessors to confirm the matrix is current, so set a review trigger tied to change events and record the review date. The output is a dated revision with a change log that shows what changed and who approved it.
Test the matrix against evidence before the assessor does
For each row, ask whether you hold evidence that the stated party performs the stated work, such as logs, access reviews, configuration exports or contract terms. A requirement is MET only when its assessment objectives are satisfied with evidence in final form, so a matrix row without evidence is not a control. The output is an evidence index that links each row to final artifacts, with gaps tracked in your plan of action and milestones where the rules allow it.
Prepare for the Lead CCA's check and the fallback
Before the assessment, give the Lead CCA the SSP entry, the service description, the matrix and the evidence index. CAP v2.0 says that if the Lead CCA cannot confirm the ESP is properly documented and will participate, the C3PAO should discuss with your Affirming Official whether to proceed. Treat that conversation as a real risk. Resolve documentation gaps and confirm the provider's participation in writing before scheduling, and ask your provider to name a contact who can answer assessor questions during the assessment. The output is a written confirmation from the provider and the Affirming Official that the ESP is documented and will take part.

Which tools you can choose and what the rule says about them

The CMMC rule leaves tool selection to you, but it does not leave the tools out of the assessment. Each card covers one part of that split: what DoD will and will not say about products, how a tool can pull a provider into scope, and what an assessor expects to see for any tool, open source or commercial.

No DoD approved tool list

DoD has said it will not publish a list of approved tools and will not comment on specific products. That means no tool is pre-certified for CMMC. Your team or implementation partner selects the products, and your assessor judges whether each one, as configured, supports the practice it is meant to implement. Ask your assessor early whether a planned tool approach is acceptable before you buy.

Many technologies can meet a requirement

The rule says a wide range of technologies may be used to implement the Level 2 requirements. The same practice, such as access control or log review, can be met with different products, including open-source platforms running in your own environment. The question is not which brand you bought but whether the implementation covers every assessment objective and produces evidence in final form.

Managed provider tools can be in scope

If a managed service provider handles CUI or security functions for you, its tools may fall within your assessed scope, and the provider's services are assessed against the Level 2 requirements it performs. Its customer responsibility matrix must name who does what. Before signing, confirm with your assessor and the provider which of its tools touch CUI and how they are documented.

Open source needs the same evidence

An open-source tool carries no exemption. Its configuration, logs, update records and access controls must produce evidence an assessor can review, just as a commercial product would. Plan for the support model, version tracking and patching responsibilities that come with self-hosted software, and document who owns them so the evidence does not depend on a single maintainer.

Every tool choice in the SSP

The system security plan must describe the tools that implement each requirement, how they are configured and who operates them. A tool that is not in the SSP is a gap an assessor can record, even if the tool works well. Keep the SSP current when you add, replace or retire a product, and align the tool list with your asset inventory and boundary diagram.

Confirm specifics with your assessor

Because the rule sets outcomes rather than products, the details of your tool stack depend on your environment and your assessor's reading of the evidence. Before committing budget, ask your C3PAO or your assessor to review the planned architecture, the tools in scope and the evidence each one will generate. Their written feedback is more useful than a vendor's claim of compliance.

Which CMMC work fits outsourcing and which stays in-house

This table compares common CMMC work areas against three owners: your own team, outsourced with oversight, or a managed service provider. Read each row for the reason the split works, and treat the Affirming Official's decisions as the one column that never moves out of the company. The main takeaway is that outside help can prepare systems and evidence, but the organization owns its controls and the assessor must stay independent.

Work area	Owner and reason
SSP ownership	In-house. The system security plan describes your boundary, your systems and your decisions, so your team must own and maintain it, with partner drafting support.
Control operation	In-house, with an MSP for routine tasks. Day-to-day operation of access, patching and backups can move to an MSP, but accountability stays with you and the MSP's role must be documented.
Evidence collection	Outsourced with oversight. A partner can set up collection routines, but your staff should review each artifact for final form before it is relied on.
POA&M decisions	In-house. Deciding what to accept, defer or fix carries risk-acceptance authority that belongs to the Affirming Official and leadership.
Affirmation	In-house only. The Affirming Official must be a senior representative of your organization who can affirm continuing compliance; no consultant or MSP can sign for you.
Scanning and logging operations	Outsourced to an MSP with oversight. Routine vulnerability scans and log collection are well suited to an MSP, provided you review results and confirm log coverage.
Policy writing	Outsourced with oversight. Partners can draft policies, but your leadership must adopt and enforce them so they reflect how your organization actually operates.
Assessment	Neither. The C3PAO or assessor performs the assessment independently, and consultants who helped you prepare may be barred from assessing you.

Questions buyers ask before outsourcing CMMC work

Can the consultant that prepared us also be our C3PAO?

No. Under 32 CFR 170.8(b)(17)(i)(G), a CMMC ecosystem member may not take part in a Level 2 certification assessment of an organization it served as a consultant to prepare for any CMMC assessment within the previous 3 years. The restriction applies to the firm and the people who worked on your preparation, so the same company cannot prepare you and then judge you. Check the lookback period for every firm and individual in your bid, including subcontractors and staff who moved between organizations. Ask each candidate C3PAO to confirm in writing that it has no prior consulting relationship with your organization. In practice, your readiness partner and your assessor should be different organizations from the start, and you should settle the assessment team before you sign a consulting statement of work.

What must the Affirming Official personally confirm before we submit?

The Affirming Official must be the senior representative in your organization who is responsible for ensuring CMMC compliance and who has authority to affirm continuing compliance for that organization. A consultant cannot hold that role for you, and the affirmation is yours to make. Before affirming, personally confirm that the scope and System Security Plan describe your actual environment, that each in-scope requirement has a named owner, and that evidence is in final form rather than draft. Confirm that each external service provider's customer responsibility matrix is current and that you know which party holds which responsibility. Ask your team for a walkthrough of the evidence behind each claim. The affirmation is a continuing obligation that applies after the assessment, so keep the record in your contract compliance file and revisit it when systems change.

How does using a managed service provider change our CMMC scope?

It depends on what the provider does, because the CMMC final rule sorts external service providers into categories. An ESP used as staff augmentation, where you supply all processes, technology and facilities, needs no CMMC assessment. A non-cloud ESP that provides technical support is a managed service provider, and its services are assessed within your scope against all applicable Level 2 requirements. A cloud service provider that handles CUI must meet the FedRAMP requirements referenced in DFARS 252.204-7012. An ESP that manages a third-party cloud service for you is not itself a cloud service provider. Whatever the category, document the service in your System Security Plan and obtain a service description and customer responsibility matrix covering every requirement the provider performs wholly, partly or jointly. For a non-cloud ESP, you remain accountable for every user with access to CUI through its service.

Do we get to choose our own security tools for CMMC?

Yes. DoD said it cannot comment on specific products, that a wide range of technologies may be used to implement CMMC requirements, and that it will not publish a list of approved tools. Tool choice is therefore a decision your team makes and owns. The test is whether the tool produces evidence that satisfies the assessment objectives in NIST SP 800-171A. Ask each vendor what the tool records, how long logs are retained, who can administer it and where its data resides. Open-source platforms self-hosted inside your own environment can meet the same requirements, but the assessor tests the configuration and the evidence, not the brand name. Record each tool in your System Security Plan with a named owner, and document whether your team accepted or rejected each consultant's recommendation so the decision trail is clear.

How much effort will our internal staff need to put in?

Your staff will own decisions and evidence even when partners build the controls. No effort figure applies here, so ask each provider to estimate effort in writing against your defined scope. The main drivers are the number of in-scope systems, how many external service providers and cloud services sit inside the boundary, how complete your existing logs and access records are, and how many requirements lack a documented owner. Some effort recurs: someone must collect evidence in final form, keep the System Security Plan current, track plan of action items, answer assessor questions and recheck controls after configuration changes. A requirement counts as MET only when all applicable NIST SP 800-171A objectives are satisfied with evidence in final form, so drafts and unsigned policies will not carry weight. Assign an internal owner for each domain before you engage any partner.

What should we confirm about CMMC Phase II before buying services?

Confirm the current status with your contracting officer and the DoW CIO's CMMC page before you sign. On 13 July 2026, the Department of War suspended Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. The suspension started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. As of 17 October 2026, the DoW CIO page says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2, while the eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule. Scope your engagement against the requirement your contract actually states, and write in a clause that lets the work pause if that requirement changes.

Can a consultant write our System Security Plan and policies for us?

A consultant can draft them, but your organization must own and operate what they describe. The System Security Plan must document your actual boundary, your external service providers and how each requirement is implemented, and the assessor will test whether practice matches the document. Ask a partner for drafts you review line by line, and require a named internal approver for each policy. Keep version history and dated approvals so the assessor can see that each document was current when it was assessed. Be cautious with any document that describes controls you do not run. The assessor compares the plan to observed behavior and evidence, so an overstated plan creates findings that a missing document alone would not.

What a fixed-scope partner engagement hands over

A fixed-scope engagement with DeployOpen hands over prepared systems, documented controls and draft evidence, all inside your own cloud accounts, data centers or air-gapped networks. The scope, deliverables and timeline are agreed in writing before work starts, so you can check each item against what your Affirming Official is accountable for. In practice that usually means a configured environment for the Level 2 domains you scoped in, a draft customer responsibility matrix for any external service provider in your boundary, and the artifacts an assessor will ask for, such as configuration baselines, audit log samples and scan outputs. Ask the partner to list each deliverable by requirement ID, for example AC.L2-3.1.1, so gaps are visible before any assessor arrives.

DeployOpen does not issue reports, attestations or certificates, and it does not guarantee any assessment result. Those outcomes belong to your organization, which owns its controls and signs the affirmation under 32 CFR 170.22, and to the independent C3PAO that performs any certification assessment. The same firm cannot both prepare your environment and assess it: under 32 CFR 170.8(b)(17)(i)(G), ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant for within the previous 3 years. Before signing, confirm with the partner that its written scope names who reviews and accepts each draft evidence item, and that your internal owner, not the partner, makes the final decisions on policy and risk acceptance.

Treat the handover as the start of your own maintenance, not the end of the work. Requirements such as periodic control assessment and ongoing monitoring under the CA domain depend on your staff continuing to collect and review evidence after the engagement closes. Agree in advance who will update the SSP and the responsibility matrix when a system, provider or boundary changes, and whether any ongoing support or continuous testing will be a separate retainer with its own written scope. Confirm current assessment timing and phase requirements directly with your contracting officer and the CMMC Program rule, since the DoW has suspended Phase II, and do not plan around dates that have not been confirmed.

How DeployOpen scopes, implements and prepares evidence for CMMC

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems and evidence behind your CMMC boundary are ready for assessment. We prepare systems, controls and evidence, but your organization owns its controls and an independent C3PAO makes the assessment decision.

How we scope

We agree a written scope that names which systems, enclaves and CUI flows sit inside your assessment boundary.
The scope lists which practices we implement or document, and which remain with your team or another provider.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work starts.

How we build

We configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
We document each control implementation in the system security plan drafts for your Affirming Official to review.
We run security testing against in-scope systems and record findings for remediation before any assessment.

How we hand over

We deliver a customer responsibility matrix that states which party performs each in-scope practice, wholly, partly or jointly.
Evidence is delivered in final form, with owners, collection dates and locations that your team can produce on request.
Your team receives runbooks and training so that staff can operate and maintain the controls after our work ends.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial work is complete.
Retainers can keep configurations, evidence and POA&M items current between assessments, as your organization decides.
We do not issue assessment results, affirmations or certifications, and we will not assess systems we helped build.

What to outsource for CMMC and what to keep in-house