cmmc level 2 compliance msp
When a defense contract brings Controlled Unclassified Information onto your production floor, security gaps can affect contract eligibility, engineering files, and delivery schedules. Understanding what cmmc level 2 compliance msp support covers starts with separating your company’s certification obligations from the services a provider can perform.
Key Takeaways
- CMMC Level 2 certification is your company's obligation, and a managed IT provider can support the work but cannot hold the certification for you.
- When a defense contract puts Controlled Unclassified Information (CUI) on your production floor, security gaps put contract eligibility and delivery schedules at risk.
- A qualified MSP should document controls, monitor systems, and maintain evidence you can present during a CMMC assessment.
- Many plants need network segmentation so legacy controllers that cannot be patched no longer share a network with office systems handling CUI.
- Ask any prospective provider for documented processes and measurable outcomes rather than promises about passing the assessment.
At Level 2, the work goes beyond installing security tools. Your organization must implement required controls, document its environment, and show how sensitive contract information is protected, including when systems support production.
CMMC Level 2 on the Plant Floor: What the Standard Actually Requires
What CMMC Level 2 Is and Why It Lands on Manufacturers
The Cybersecurity Maturity Model Certification (CMMC) program, established in 32 CFR Part 170, sets cybersecurity requirements for defense contractors handling Federal Contract Information or Controlled Unclassified Information. Level 2 applies when a contract requires CUI protection. The Department of Defense determines the applicable level through contract requirements, so check the solicitation and confirm expectations with your contracting officer.
The 110 NIST SP 800-171 Controls in Plain Terms
Level 2 requires implementation of 110 security requirements from National Institute of Standards and Technology (NIST) Special Publication 800-171. They cover access control, authentication, audit logging, configuration management, incident response, system protection, and other safeguards. Assessment procedures examine 320 objectives, so a policy alone does not establish that a requirement is met. Evidence must show how the control operates in your environment.
On a plant floor, that can mean limiting who can reach engineering workstations, recording administrative access, and controlling connections between office systems and operational technology (OT), the hardware and software that monitor or control production.
Where CUI Hides in a Manufacturing Business: CAD Files, ERP, MES, and OT
CUI may move through more systems than the server labeled “engineering.” Trace contract information through design, production, storage, and support workflows. Check areas such as:
- Computer-aided design (CAD) files and technical drawings stored on engineering workstations or shared drives.
- Enterprise resource planning (ERP) records containing contract, delivery, or controlled technical details.
- Manufacturing execution system (MES) data linked to controlled job instructions or production records.
- Backups, file transfers, remote access sessions, and OT-connected systems that process or store CUI.
Do not assume every machine controller contains CUI. Map the information flow, identify where CUI is stored or transmitted, and document system boundaries. Legacy programmable logic controllers (PLCs) may not handle CUI directly, yet connections to in-scope systems still need review.
The Documentation You Cannot Skip: SSP, POA&M, and SPRS Scores
Your System Security Plan (SSP) describes the covered environment, system boundaries, and how security requirements are implemented. A Plan of Action and Milestones (POA&M) records eligible unmet requirements, planned corrective actions, and target dates. The Supplier Performance Risk System (SPRS) holds the organization’s assessment score submission. These records must match systems and practices operating at your plant.
- Maintain an SSP that identifies in-scope systems, connections, and control implementation.
- Use a POA&M to track permitted gaps and corrective work, not as a substitute for required implementation.
- Keep assessment evidence, such as access records, configuration records, and incident procedures, organized and current.
- Submit and maintain the required assessment information in SPRS.
Andromeda’s IT Compliance Support can support customer-driven compliance alignment, audit-ready documentation, and security oversight. Your organization remains accountable for the accuracy of its scope and records.
Does Your MSP Need to Be CMMC Level 2 Certified? Sorting Out Who Owns What
Your MSP as an External Service Provider: How It Changes Your Assessment Scope
External Service Provider (ESP) means a provider that supports your systems or security functions. If an MSP manages assets that process, store, or transmit CUI, or provides security protection for those assets, its services may affect your assessment scope. Evaluate cloud hosting, identity administration, endpoint monitoring, backups, and remote support based on what the provider does and what information it can access.
Do not treat a vendor’s certification status as a shortcut around scoping. Document service responsibilities, system connections, access paths, and available evidence for the services your company relies on.
When an MSP Must Pursue Its Own Certification (and When It Does Not)
An MSP does not automatically need its own Level 2 certification merely because it supports a manufacturer pursuing Level 2. The answer depends on the contract, the data the MSP handles, and whether its systems or services fall within applicable CMMC requirements. When a provider processes, stores, or transmits CUI, or supplies security protection for covered assets, determine applicable assessment and contractual obligations rather than relying on a general “CMMC-ready” claim.
Ask the provider to explain its role in your scope and supply supporting documentation. IT Compliance Support can assist with compliance alignment and documentation, but it does not transfer your organization’s certification responsibility to the provider.
The Manufacturer-MSP Responsibility Matrix for CMMC Level 2
Shared work needs named owners. Identify who performs each activity, who approves it, and what evidence your assessment team can review. Adjust assignments to match your contract, system boundary, and service arrangement.
| Activity | Manufacturer owns | MSP may support |
|---|---|---|
| Define CUI scope | Identify contract data, workflows, and covered systems. | Provide system inventories and connection details. |
| Implement technical controls | Approve risk decisions and operational changes. | Configure access, monitoring, endpoint protection, and backups within its service role. |
| Maintain SSP and evidence | Confirm accuracy and approve the organization’s documentation. | Supply service descriptions, logs, configurations, and change records. |
| Assessment and affirmation | Coordinate assessment, attest to organizational status, and address findings. | Explain its services and provide relevant evidence when requested. |
What Happens When Neither Party Owns the Gap
Unassigned work can leave a control incomplete even when both parties believe the other is handling it. A manufacturer may expect the MSP to retain evidence, while the MSP assumes the customer owns documentation. The gap often surfaces during assessment, when no one can demonstrate who approved access, reviewed alerts, or corrected a weakness.
- A backup service stores CUI, but no one confirms its access controls or recovery evidence.
- Remote access reaches plant systems, but account review or logging responsibilities are unassigned.
- A control changes after a system update, yet no owner revises the SSP or supporting records.
Record each responsibility in writing, including subcontractors and cloud services. That keeps compliance tasks connected to production systems and accountable people.
What a Real Manufacturing-Grade MSP Provides (and What It Cannot Do for You)
What Your MSP Can Deliver: Controls, Monitoring, and Assessment Evidence
A capable provider can operate technical safeguards within its assigned role and give your team records showing how they work. That can include access administration, endpoint protection, security monitoring, change logs, and incident response support. IT Compliance Support provides customer-driven compliance alignment, automated tracking, real-time dashboards, change logs, continuous monitoring with real-time risk alerts, and audit-ready documentation with version control.
Ask for evidence tied to your systems, not a general statement that the provider is “ready.” Useful records include system configurations, access reviews, alert handling, and change history. Andromeda reports a 12.0-minute median ticket response time and resolution of 97% of issues within 8 business hours. Those measures describe support performance, not a certification outcome.
- An MSP can: configure agreed controls, monitor covered systems, retain service records, and explain its role during assessment.
- An MSP cannot: define your contract obligations, approve your risk decisions, or attest to your organization’s compliance on your behalf.
What Stays on Your Desk: Governance, Affirmations, and Triennial Recertification
Your leadership team remains responsible for the organization’s scope, policies, risk acceptance, and accurate compliance records. The company must review evidence, resolve gaps, and make required annual affirmations. CMMC Level 2 certification is valid for three years, with recertification requirements your organization must plan for. An MSP can help prepare records, but it cannot make the company’s affirmations for you.
IT Compliance Support can assist with documentation and control alignment, while your designated leaders approve the content and own the decisions. Assign people to review provider evidence, approve system changes, and confirm written procedures match production practice.
Why OT and Legacy Equipment Demand a Specialist, Not a Generalist
Plant controls often cannot follow the same patching schedule as office computers. A legacy controller may run an unsupported operating system, depend on a vendor-approved configuration, or require a planned maintenance window. A manufacturing-aware MSP should map connections, coordinate changes with operations, and protect access without assuming production equipment can be taken offline for routine IT work.
That experience matters when CUI touches engineering files, ERP workflows, or systems connected to OT. Andromeda’s documented Chicagoland multi-site manufacturer case study reports roughly a 50% decrease in IT issues. The decline followed stabilization work, not an instant change, and it does not predict every plant’s outcome. When evaluating cmmc level 2 compliance msp support, look for a provider that can explain how its controls and evidence fit your production environment.
How to Vet an MSP for CMMC Level 2 Support: A Manufacturer's Checklist
Credentials and Evidence to Demand Before You Sign
A provider’s claim of “CMMC readiness” is not evidence that its services meet your contract or assessment needs. Before signing, ask for a written description of its role, the systems it supports, and how its services affect your assessment boundary. If it claims certification, request scope and status documentation, then verify that coverage applies to the services you plan to use.
Ask how the provider manages subcontractors, cloud platforms, and other service dependencies. Request sample records showing how it documents access, security events, system changes, and incident handling. Andromeda’s IT Compliance Support can support customer-driven compliance alignment and audit-ready documentation, while your organization remains responsible for validating scope and evidence.
- Written service boundaries and a clear responsibility assignment.
- Evidence that applies to your systems, not only policy templates.
- Documented oversight of subcontractors and cloud services.
- A process for preserving records when systems or services change.
Questions That Separate Real Compliance Experience from Marketing Claims
Ask for examples that reflect your plant’s constraints. A useful answer should explain the method, evidence, and owner, not simply name a security tool. Ask a provider supporting manufacturing:
- How will you help map CUI flows through engineering, ERP, and production support systems?
- What records can you provide for controls you operate, and how often are they reviewed?
- How do you coordinate access changes or maintenance when a plant cannot take equipment offline?
- Which subcontractors can access our systems, and how do you oversee their work?
- What happens when an assessment identifies a gap in a service you manage?
Watch for promises of guaranteed certification, refusal to identify subcontractors, or claims that purchasing a security platform alone satisfies the requirements. Ask how the provider supports your CMMC Level 2 compliance for manufacturing without assuming every controller can be patched or interrupted.
A Scoring Checklist You Can Use in Your Next MSP Conversation
Use an evidence-based scorecard: mark each area “documented,” “partially documented,” or “not provided.” Do not award credit for verbal assurance without supporting records. A strong candidate can describe ownership, produce relevant evidence, and explain how changes will be coordinated with operations.
Include scope definition, control ownership, evidence retention, subcontractor oversight, incident escalation, and plant change coordination. A good CMMC Level 2 compliance partner makes responsibilities and limitations clear before an assessment exposes a gap. Andromeda’s IT Compliance Support can assist with documentation and compliance alignment, but it does not replace your organization’s decisions or attestations.
Frequently Asked Questions About CMMC Level 2 and Your MSP
If My MSP Is Certified, Does That Shrink My Assessment Scope?
Not automatically. Your scope depends on the CUI environment and the services that support it. An MSP’s certification may help document its role, but it does not remove your responsibility to define and support your assessment boundary.
Can My MSP Talk to the C3PAO Assessor for Me?
Your MSP can explain its services and provide relevant evidence during the assessment. Your organization must coordinate the assessment and remain accountable for its statements, records, and decisions.
What Are the Consequences of Non-Compliance for My Plant?
Failure to meet contract requirements can affect eligibility for defense work and trigger contractual or other consequences. Confirm obligations with your contracting officer and review the applicable contract language. Do not assume an IT provider can determine your contract’s outcome.
Self-Assessment vs. Third-Party Assessment: Which Applies to Level 2?
The CMMC Program Office and 32 CFR Part 170 define program requirements. The assessment path depends on the applicable contract and CMMC requirements. Confirm whether your work requires a C3PAO assessment or permits a self-assessment before planning your schedule.
If you are mapping provider responsibilities or evidence needs, Andromeda’s IT Compliance Support can help organize compliance work without taking ownership away from your team. For a practical next step, schedule a 30-minute discovery call or use the IT Drag™ Calculator if you are not ready to talk.
Frequently Asked Questions
What is CMMC compliance?
CMMC compliance means meeting the cybersecurity requirements the Department of Defense set under 32 CFR Part 170 for contractors handling Federal Contract Information or Controlled Unclassified Information (CUI). At Level 2, that means implementing 110 security requirements from NIST SP 800-171 and proving through assessment evidence, not just policies, that the controls operate in your environment.
When is CMMC compliance required?
CMMC compliance is required when a Department of Defense contract calls for it, and the level is set by contract requirements. Level 2 applies when a contract requires CUI protection. Check the solicitation and confirm expectations with your contracting officer before scoping the work.
What are the CMMC compliance levels?
The Cybersecurity Maturity Model Certification has multiple levels, with Level 2 applying to contractors who handle Controlled Unclassified Information. Level 2 requires implementing 110 NIST SP 800-171 security requirements, and a C3PAO accredited through the Cyber AB assesses 320 objectives to verify implementation.
How do I prepare for a CMMC assessment?
Preparation starts with mapping where CUI moves through your systems, documenting boundaries, and building your System Security Plan (SSP). Use a Plan of Action and Milestones (POA&M) to track eligible gaps, keep evidence like access and configuration records current, and submit your assessment score in SPRS. Evidence must show how controls actually run in your plant.
Does my MSP need to be CMMC Level 2 certified?
An MSP does not automatically need its own Level 2 certification just because it supports a manufacturer pursuing compliance. The answer depends on the contract, whether the MSP processes, stores, or transmits CUI, and whether its services provide security protection for covered assets. Ask your provider to explain its role in your scope with supporting documentation.
Where does CUI hide in a manufacturing business?
CUI often moves through more systems than the server labeled engineering. Trace contract information through CAD files, ERP records, MES job instructions, backups, file transfers, remote access sessions, and OT-connected systems. Map the information flow and document system boundaries rather than assuming which machine controllers are in scope.
What does an MSP actually do for CMMC Level 2 compliance?
An MSP can support compliance alignment, audit-ready documentation, and security oversight for systems that handle CUI, including cloud hosting, endpoint monitoring, and backups. What a provider cannot do is take over your certification responsibility. Your organization remains accountable for the accuracy of its scope and records.