CMMC Level 2 Scoping: Architecting ESP and Cloud Service Provider Boundaries

The Scoping Imperative in CMMC Level 2 Assessments

With the finalization of the Cybersecurity Maturity Model Certification (CMMC) Program rule codified under 32 CFR Part 170 and its acquisition implementation under DFARS Subpart 204.73, defense contractors face rigorous third-party assessment scrutiny. A frequent point of audit failure during Certified Third-Party Assessment Organization (C3PAO) reviews is not the failure of an individual technical control, but an incorrectly scoped boundary regarding External Service Providers (ESPs) and Cloud Service Providers (CSPs).

Under NIST SP 800-171 Rev. 2, which governs current CMMC Level 2 evaluations, contractors handling Controlled Unclassified Information (CUI) must maintain defensible system boundaries. When an organization utilizes an ESP for managed security services or an external CSP for hosting, those service entities expand the contractor's assessment scope.

Dissecting the Asset Categories: CUI Assets vs. Security Protection Assets

Auditors dissect system security plans into precise categorization models specified under DoD CMMC Scoping Guidance:

• CUI Assets: Systems that process, store, or transmit CUI. These systems must fully satisfy all 110 NIST SP 800-171 requirements and undergo direct evaluation during a Level 2 assessment.
• Security Protection Assets (SPAs): Systems, services, or personnel that provide security capabilities to the CUI assessment scope without directly storing or processing CUI (e.g., external Security Information and Event Management [SIEM] systems, endpoint management, vulnerability scanners, identity providers). These assets fall directly within the assessment scope and must be assessed against applicable controls.
• Out-of-Scope Assets: Systems physically or logically isolated from CUI assets and SPAs via verified controls (such as firewalls, unidirectional gateways, or air-gapping). Isolation must be systematically validated with audit logs, architecture diagrams, and network configuration tables.

CSP Requirements: FedRAMP Moderate Equivalency

When a defense contractor leverages a Cloud Service Provider to store, process, or transmit CUI, DFARS clause 252.204-7012 mandates that the CSP meet security requirements equivalent to the FedRAMP Moderate baseline.

Contractors cannot rely on self-declarations from cloud vendors. If the CSP does not possess an active FedRAMP Moderate Authorization displayed on the official FedRAMP Marketplace, the prime contractor must provide an exhaustive FedRAMP Equivalency package. This package requires a comprehensive System Security Plan (SSP), a security assessment report prepared by an accredited 3PAO, and evidence of closed Plans of Action and Milestones (POA&Ms) for critical vulnerabilities. Choosing an authorized commercial enclave often represents the most cost-effective path to audit defense.

Scoping Managed External Service Providers (ESPs)

Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) often manage the Active Directory, network firewalls, and endpoint protection for Defense Industrial Base (DIB) suppliers.

1. The Shared Responsibility Matrix (SRM): Every contractor utilizing an ESP must establish a signed Shared Responsibility Matrix. This document legally and technically defines which entity is responsible for each of the 110 NIST SP 800-171 controls.
2. ESP Certification and Attestation Scope: If an ESP stores, processes, or transmits CUI, it must possess a CMMC Level 2 certificate. If the ESP acts strictly as an SPA without accessing CUI, its management tools, administrative access vectors, and remote management bastions must still be assessed against relevant controls.
3. Incident Reporting Alignment: DFARS 252.204-7012 requires reporting cyber incidents to the DoD within 72 hours. Your contract with the ESP must enforce rapid incident escalation clauses and mandate raw forensic log preservation to ensure compliance.

Actionable Pre-Assessment Audit Workflow

Before booking a C3PAO, organizations must conduct an internal boundary validation drill:

• Update network diagrams to reflect every API integration, remote desktop gateway, and identity sync bridge connecting to outside environments.
• Verify that all multi-factor authentication (MFA) mechanisms accessing SPAs or CUI enclaves use FIPS-validated cryptographic modules.
• Confirm your current Supplier Performance Risk System (SPRS) score is supported by validated objective evidence across every internal and external asset.