An OSC is planning to have a C3PAO perform a CMMC Level 2 assessment. When validating the OSC’s proposed assessment scope, you realize they use an ESP for various cybersecurity services. What action must you, as a CCA, take regarding the ESP?

As a Certified CMMC Assessor (CCA), your duty is to validate the assessment scope against official CMMC requirements. The CMMC Assessment Process (CAP) explicitly states that if an External Service Provider (ESP) manages any part of the OSC’s CUI environment, the ESP must possess a CMMC certification at the same or higher level as the OSC. Therefore, the CCA's mandatory first action is to verify that the ESP holds a valid CMMC Level 2 or higher certification. This ensures that the protection of CUI is maintained consistently across all in-scope environments and that the assessment can proceed on a valid basis.

B. The CCA must actively validate the scope against CMMC requirements, not just passively accept the OSC's proposal. This includes verifying the ESP's compliance.

C. This is premature consultative advice. The CCA's primary duty is to first verify the current ESP's certification status, not recommend a business change.

D. A self-assessment is insufficient for a Level 2 assessment. The ESP must have a formal CMMC certification from a C3PAO, not just a self-attestation.

---

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2, Version 5.1.1, July 2023.

Section 3.4.3, External Service Providers (ESPs), Page 16: "If the OSC uses an External Service Provider (ESP) (e.g., Managed Service Provider (MSP) or Managed Security Service Provider (MSSP)) to manage its CUI environment, the ESP must have a CMMC certification at the same or higher level as the OSC."

2. CMMC Scoping Guide: Level 2, Version 2.1, December 2023.

Section 2.4.3, External Service Provider (ESP) Systems, Page 10: This section details how ESP systems that process, store, or transmit CUI are considered in-scope for the CMMC assessment, reinforcing the need for them to meet CMMC requirements. It clarifies that the responsibility for protection remains with the OSC, necessitating verification of the ESP's compliance.