That’s an easy place to land once a prime or general contractor starts asking about CMMC, because a single quote can bundle several jobs under one name. The Department of Defense’s rule for the program, 32 CFR Part 170, gives those jobs separate roles and separate limits. Once you know which job you’re buying, the price and the promises get easier to judge.
Four different parties usually take part in CMMC compliance support, and each one can promise something different. So two quotes with the same headline can describe very different purchases.
Who Are the Four Parties in CMMC Compliance Support?
A readiness consultant, an assessor, a managed IT provider, and your own staff each carry a different part of the work. Here’s what each one does, what it can and can’t promise, and where the rule draws the line.
| Party | What it does | What it can promise | What it can’t promise | Where to find it |
|---|---|---|---|---|
| Readiness consultant | Reviews your setup, finds gaps, and helps you document your practices | Honest advice and organized preparation | A passing result or a certification | §170.13(a) |
| Assessor | Tests your environment against the requirements and reports what it finds | An independent review under a code of conduct | A result in advance, or an assessment of a company it consulted for in the past three years | §170.8(b)(17)(ii)(G) |
| Managed IT provider (MSP) | Runs and supports your day-to-day systems | Operating the systems it manages | A certification, or a pass for your company | 89 FR 83092 (preamble) |
| Your own staff | Owns scoping decisions, daily security habits, and the affirmation | Accountability for the program | Handing the affirmation to a vendor | §170.4(b), §170.22 |
Section numbers refer to 32 CFR Part 170 unless noted. Match each line of your quote to one of these rows, and ask about any line that doesn’t fit.
What Can a Readiness Consultant Promise?
A readiness consultant can find your gaps and give you straight advice, but it can’t promise you a pass.
Part 170 gives the two certified roles different jobs. CMMC Certified Professionals (CCPs) provide advice, consulting, and recommendations, while CMMC Certified Assessors (CCAs) make the final determinations on an assessment. A consultant who guarantees an outcome is claiming more than that division allows. The code of professional conduct behind these roles also bars exaggerating the services a firm can deliver.
A good consultant’s quote reads like a list of work. It names what the consultant will review, what it will document, and what you’ll hold when the engagement ends. Once the documentation exists, someone independent has to test it, and that’s the assessor’s job.
What Does a CMMC Assessor Do?
A CMMC assessor tests your environment against the requirements and reports what it finds. Which assessment path applies to you depends on your CMMC level. Our breakdown of CMMC levels from Level 1 to Level 3 explains how those paths differ.
Part 170 holds CMMC third-party assessment organizations (C3PAOs), CCAs, and CCPs to a shared code of professional conduct. That code includes independence rules—and one of them applies if a provider offers both jobs.
How the Three-Year Independence Rule Works
A firm that consulted to prepare an organization for CMMC can’t take part in that organization’s Level 2 certification assessment within three years.
In practice, an assessment firm that prepared you has to wait three years before it can assess you. C3PAOs must also keep assessment records for six years, and those records cover the organizations they provided consulting services to. If a provider offers to do both, ask how it squares with that rule. You can read the independence language yourself in the public text of 32 CFR Part 170.
How the Suspension Changed Assessments
The suspension changed when third-party assessments become mandatory, and it left the four roles as they were. On July 13, 2026, the Department of War (the Department of Defense) announced the immediate suspension of CMMC Phase 2. Phase 2, originally set for November 10, 2026, would have expanded third-party assessment requirements. Phase 1 self-assessment requirements remain in place, according to the DoD CIO’s CMMC page. So does the obligation to protect information under DFARS 252.204-7012.
The Department also established a CMMC Reform Task Force to review the program, and as of publication, no restart date has been announced. The roles described here come from the text of Part 170, which remains in the Code of Federal Regulations. Someone still has to run the systems an assessor will eventually test, and that’s usually your MSP.
Where Does Your MSP Fit?
Your managed service provider (MSP) runs your daily systems and may count as an external service provider (ESP). Whether yours does depends on what it handles for you, so ask it directly.
The Department of Defense addressed this in the preamble to the final rule, published in the Federal Register. An ESP that doesn’t process, store, or transmit Controlled Unclassified Information (CUI) needs no assessment of its own. The assessor reviews its services within your scope. The useful question for you is whether your MSP falls inside that scope. If it does, ask how it plans to support the assessor.
An MSP can operate the systems in scope, but it can’t certify your company or pass an assessment for you. Some parts of the program stay with you regardless of who runs the systems.
What Stays With Your Own Staff?
Your own staff keeps the Affirming Official role, the scoping decisions, and the daily security habits, and no vendor can take those over. Part 170 defines the Affirming Official as a senior-level representative from within the organization seeking assessment. The affirmation comes from a person inside your company.
Scoping decisions stay with you too. Someone at your company has to decide which people and systems handle controlled information, and an advisor can inform that choice without making it for you. Habits like multi-factor authentication, patching, and careful file handling happen on your side of the contract every day.
A prime may have flowed requirements down to you. Our post on the CMMC 2.0 requirements every subcontractor must know covers what each level asks of you. Those four roles also give you a way to test any quote, and the questions below put that test into words.
What Should You Ask Any Provider Before You Sign?
Ask every provider, including us, to answer questions about its role, its promises, and its limits before you sign anything. Start with these:
- What does the quote prepare, advise on, and document, and what does it leave to you?
- Which results does the provider promise, and which does it say it can’t?
- Which firm will assess you, and how does the three-year rule apply if it’s the same one preparing you?
- How does the provider treat ESP scope for the managed IT services it sells you?
- Who signs the affirmation, and what does the provider expect from that person?
- What happens to the work and the price if the Phase 2 schedule changes?
Matching the Right Help to Your Contract
Preparation, assessment, system operation, and accountability are four different jobs, and a clear quote names the ones it covers. Your contract decides which requirements apply to you, and each provider’s role decides what it can say about them.
Certified CIO helps clients get ready, and it doesn’t render the compliance determination. If you’re holding a quote and can’t tell which jobs it covers, reach out to our team. We’ll talk it through at your pace.
