During a CMMC assessment, as the Lead Assessor, you realize that the OSC relies on a Managed Service Provider (MSP) to oversee some of their IT…

The CMMC assessment scope is not limited to an OSC’s on-premises assets; it extends to any system that processes, stores, or transmits Controlled Unclassified Information (CUI), including those managed by an External Service Provider (ESP) like an MSP. The OSC remains responsible for ensuring that CUI is protected in accordance with CMMC requirements. The primary challenge for the assessor in this scenario is the limited visibility into the MSP's environment, which directly impedes the ability to gather sufficient objective evidence that controls for external connections (e.g., AC.L1-3.1.20) are effectively implemented. A Service Level Agreement (SLA) is contractual and may not provide the granular detail or verifiable proof of implementation required for an assessment.

A. Using a web browser is a common method for external connection; it does not negate the need for security evaluation but rather necessitates it, focusing on aspects like encryption and authentication.

C. The CMMC assessment boundary is dictated by the flow and location of CUI, not physical network perimeters. External cloud services handling CUI are explicitly in scope.

D. Employee training is a separate CMMC practice area. The core challenge presented in the scenario is the technical verification of controls within an external, third-party environment.

1. Cybersecurity Maturity Model Certification (CMMC) Scoping Guide, Level 2, Version 2.0 (December 21, 2021): Section 2.4, "External Service Providers (ESPs)," states, "The OSC is responsible for the protection of CUI that is processed, stored, or transmitted by an ESP... The OSC must be able to provide evidence to the C3PAO that the ESP meets the CMMC requirements..." This highlights the OSC's responsibility and the need for assessors to get evidence from the ESP environment.

2. NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" (February 2020): Requirement 3.1.20, "Control connections to and use of external information systems," directly applies. The discussion notes emphasize managing the risks from such connections, which is precisely what the assessor must verify. Limited visibility hinders this verification.

3. CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1 (March 20, 2023): Section 3.4, "Evidence," details that assessors must collect "sufficient" and "appropriate" evidence. It specifies that evidence must be "factual (i.e., objective)." An SLA alone is typically insufficient objective evidence of a control's implementation and effectiveness.