Companies selling to the U.S. Department of Defense are facing a new certification requirement: Cybersecurity Maturity Model Certification, or CMMC. Over 300,000 will need to meet some level of compliance to keep their contracts, and around 80,000 of those face the more rigorous Level 2 process before the November 2026 deadline. Many are small businesses who lack the resources to tackle it on their own.
That leaves a big opportunity for MSPs, but also a challenge. The same issues that make it hard for small businesses to navigate—the depth of documentation, the number of controls, the evidence required—make it easy for MSPs to lose money if every engagement starts from scratch.
MSPs who are building sustainable CMMC practices have figured out how to standardize their delivery without sacrificing quality. This post covers how they do it, from defining your role upfront to scoping CUI environments, building reusable assets, and using tooling to make the whole thing repeatable.
1. Define Your Role: Are You Leading, Supporting, or Implementing?
As we covered in our previous post on CMMC 2.0, one of the first decisions MSPs need to make is what role they're actually playing: technical implementation, compliance readiness, or both. That decision shapes everything downstream, from how you staff engagements to how you manage scope.
If you plan to lead CMMC rather than just support on the technical side, going through the process and becoming certified yourself can be a helpful first step. For those who have a few engagements under their belts already, David Winn, Cybersecurity Compliance Director at Compliance Cavalry, says: "If you're looking to be that leader in the industry, I would get a few CCPs in your staff." It's not essential when you're first starting out, but that kind of in-house expertise can help you scale your program and make it more efficient as you roll out across more clients.
2. Standardize How You Define the CUI Boundary
Controlled unclassified information (CUI) is the category of sensitive data that CMMC exists to protect, and scoping it accurately is where most engagements either find solid footing or start to unravel. Before any controls can be implemented or evidence collected, you need to know where CUI actually lives.
"A lot of people don't even know where their CUI is, let alone how it flows through things," says David. "Knowing where CUI is and how it flows through your business is probably one of the most critical things to do first."
The goal isn't just to document where CUI lives today, but to help the client actively reduce their CUI exposure. The smaller and more intentional the assessment boundary, the easier it becomes to standardize controls, collect evidence, and maintain the program over time. Enclaves are particularly useful here: by isolating CUI to a segmented portion of the environment, MSPs can keep scope manageable and make their delivery model more consistent from one client to the next.
Every client environment is different, but the process of discovering where CUI enters, moves, and exits doesn't have to be reinvented each time. MSPs can build a repeatable method for this and apply it across engagements.
3. Build Reusable Assets for Every Engagement
Once the CUI boundary is defined, the next challenge is moving from scope to delivery without starting from scratch each time. RACI matrices, policy libraries, evidence request lists, and remediation plan templates are the kinds of assets that pay off across multiple engagements once they're built.
"Most of our clients are not big clients. They're small clients that usually don't have documentation," says David. That's where templates can come in handy, as they provide a starting point for clients and a reusable process for MSPs. "It's much easier to edit than to create," he adds.
Robert Duchesne, CEO and Cybersecurity Lead at RD3 Technologies, makes a strong case for building those templates yourself rather than buying them. Having scaled CMMC across nearly 100 projects, he's seen MSPs spend $5,000 to $7,000 on third-party templates that could have been built in-house. "Those are just costs that don't need to exist," he said. "You can build these documents, and after you do it the first time, it scales." The templates still need to be tailored to each client, but adapting a solid foundation is far more efficient than building from zero every time.
4. Treat the SSP and SPRS as Delivery Outputs, Not End-Of-Project Paperwork
The SSP (System Security Plan) and SPRS (Supplier Performance Risk System) score are two of the most important outputs of any CMMC engagement. The SSP documents how a client's environment meets CMMC requirements; the SPRS score is what gets submitted to the government. Both tend to get treated as final deliverables—things to produce once the "real" work is done. That's where a lot of time gets lost.
A more efficient approach is to build both into the delivery process from the start. When scope decisions, control ownership, implementation notes, and evidence are captured as the engagement progresses, the SSP essentially writes itself. The SPRS score follows from the work rather than requiring a separate scramble at the end.
The goal for both is to standardize the structure while customizing the client-specific content. That way, the MSP has a consistent framework to work from across engagements, and the client has ongoing visibility into their readiness and remaining gaps.
5. Use a Compliance Platform to Turn Templates Into Repeatable Workflows
Templates and checklists get you a long way, but there's still a lot of manual work involved in coordinating ownership, tracking status, mapping evidence to controls, and keeping everything current as an engagement progresses. A purpose-built compliance platform like ControlMap turns those static assets into a living, repeatable workflow.
The biggest operational advantage is reusability. Rather than configuring a new workspace for each client from scratch, MSPs can clone an existing project structure with preloaded control mappings, policy templates, and evidence requests already in place. The more standardized the workspace setup, the less time each new project requires to get off the ground.
Robert described one of the more tangible benefits from his own C3PAO assessment experience using ControlMap: "One artifact can map to multiple controls and objectives. You can just gather one artifact and—shazam—it maps across." You create it once and can reuse it over and over, leading to compounding efficiencies.
6. Use AI to Accelerate Documentation, Not Replace Expertise
AI is increasingly useful in CMMC delivery, particularly in documentation-heavy areas like policy drafting, gap analysis, and SSP language. "What AI honestly thrives in, is structured data," says Dan Fox, Group Product Manager, Risk at ScalePad. "Compliance is all extremely well-documented and well-structured." When the controls are clearly defined and the inputs are clean, AI can meaningfully reduce the manual effort involved.
That said, it's a tool for acceleration, not a replacement for expertise. "AI is so strong these days, and it still makes a ton of mistakes," says Robert. "Don't create templates [with AI] and think they're going to be great. You're gonna have to fact check them."
MSPs still need qualified people to validate evidence, interpret client context, and ensure documentation reflects what's actually implemented. The goal is to use AI to move faster, not to hand off the judgment calls.
In every case, treat the output as a starting point. A qualified person still needs to review, adapt, and sign off before anything goes to a client or an assessor.
The Real Goal: A CMMC Service You Can Sell and Deliver Consistently
The end goal isn't just to complete CMMC projects more efficiently. It's to build a service model you can sell, deliver, and support consistently, without the delivery depending on heroic effort or individual knowledge every time.
The more standardized your delivery model, the more scalable the whole thing becomes — and that clarity makes it easier to price the service, communicate its value, and grow it deliberately.
Start with the model, build the assets, standardize the workflow. Each project makes the next one faster. That's the whole point.
For a deep dive into scaling CMMC programs with David, Robert, and Dan, watch the full webinar now.