The CMMC Final Rule removed the difficult and expensive FedRAMP requirement for cloud services that only store Security Protection Data (SPD). But the requirement for the Customer Responsibility Matrix (CRM) remained. Defense contractors must give their clients the CRMs for the security tools they use as part of their documentation packet.

If your MSP partners support defense contractors, they’re being asked for something most vendors can’t produce: an accurate and thorough assessment-ready CRM that maps your service responsibilities to CMMC Level 2 assessment objectives—up to all 320.

I've seen so-called 'CMMC CRMs' that were nothing more than marketing fluff and others that were so incomplete that any CMMC assessor with integrity would not accept the document. That puts their partner's client relationships at risk, which put their vendor's partner relationships at risk. Some of the CRMs were done by well-meaning security specialists who weren't formally trained or certified in CMMC and did not understand how different it is from other regulations. Some ignored the fact that vendors can access their partners' data.

When your answers are vague, inconsistent, created by staff members without CMMC certifications or are “AI-generated,” you don’t just lose deals—you create risk for your partners and their clients.

Why are MSPs demanding CRMs right now and threatening to leave if you don't deliver? Two reasons.

Some MSPs are committed to CMMC and have voluntarily chosen to pass their own Level 2 certification assessment. They need to provide your CRM to their assessors.

MSPs that have been preparing defense contractor clients for their assessments now must deliver all the required documentation - including the CRMs from their security stack vendors - so their clients can schedule their assessments.

Not having an CRM or having one that won't pass scrutiny leaves your partners no other choice than to stop working with you.

Doing it right costs a lot less than you stand to lose.