It’s official, with the recent publication of the CMMC Proposed Rule, IT Managed Service Providers will now need a CMMC certificate. This is before any of their clients will be able to get their own CMMC certificate. What does this mean for organizations seeking compliance?

“External Service Provider (ESP) means external people, technology, or facilities that an organization utilizes for provision and management of comprehensive IT and/or cybersecurity services on behalf of the organization. In the CMMC Program, CUI or Security Protection Data ( e.g., log data, configuration data), must be processed, stored, or transmitted on the ESP assets to be considered an ESP.”

“If the OSA utilizes an External Service Provider (ESP), other than a Cloud Service Provider (CSP), the ESP must have a CMMC Level 2 Final Certification Assessment.”

CMMC will officially be in contracts in 2025. This means that now both you and your MSP have until then to each get a CMMC certificate. If your MSP isn’t already working towards getting their certification, then it is already too late.

Don’t put your DoD contracts at risk. Go with the proven team at FirstCall Consulting who have helped hundreds of companies meet these requirements. With our combination of Technology and Compliance expertise, we are able to support your organization with our 3 step process:

1. Decide which compliance option is the best for your organization:
   1. GCC High All-In
   2. GCC High Enclave
   3. Commercial M365 + PreVeil
2. Implement solutions and develop documentation
3. Audit Support

Don’t wait until it’s too late. Contact us today