How to Choose a CMMC RPO or MSP: Scorecard for Defense Contractors

Defense contractors should evaluate a CMMC Registered Provider Organization (RPO) or CMMC-focused MSP on three things: whether it can get you assessment-ready, how it handles the evidence an assessor will examine, and whether it can keep you compliant after the assessment. Verify the basics first with pass/fail gates, then score finalists on a weighted scale.

The pause changed the calendar, not the work. The Department of Justice announced on September 1, 2026, that Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations tied to NIST SP 800-171 gaps on one network between 2020 and 2023, long before any CMMC assessment requirement existed. Your SPRS score and your senior official's affirmation are still legal representations, and the provider you hire shapes whether they hold up.

This guide gives you a scorecard to compare providers on the same terms. If you are also choosing an assessor, our CMMC Level 2 C3PAO Selection Framework covers that decision.

In this article

• RPO vs. CMMC MSP vs. C3PAO: who does what
• Why the RPO badge is not enough
• Five pass/fail gates
• The weighted provider scorecard
• Strong and weak answers to listen for
• Red flags
• How to run the evaluation
• Frequently asked questions

RPO vs. CMMC MSP vs. C3PAO: who does what 

Most defense contractors hire more than one provider, and the roles are easy to blur. The distinction matters because it decides what your provider can legally do for you and what the assessor will examine.

Many firms combine the first two roles: an MSP that is also a listed RPO. That combination can work well, because the team that advises you is also the team that operates the controls. It also raises the stakes of the decision, because that provider's own tools and practices become part of what the assessor examines.

The rule is explicit. Under 32 CFR 170.19, an ESP that is not a cloud provider and handles your CUI is in your assessment scope, and an ESP that handles only Security Protection Data is assessed as a Security Protection Asset. The same section requires the ESP's role to be documented in your SSP and in the provider's customer responsibility matrix. The ESP may voluntarily pursue its own certification to reduce the work during your assessment.

Why the RPO badge is not enough 

The Cyber AB lists RPOs in its Marketplace. An RPO listing tells you an organization has registered with the Cyber AB and employs trained Registered Practitioners. It does not measure engineering capability, past assessment results, or whether the provider can run a compliant environment day to day.

That gap matters more now than it did a year ago. The SBA estimates total compliance costs can reach about $593,800 for small firms requiring third-party assessment and $388,600 for firms eligible for self-assessment. Most of that money goes to implementation and operations, not the assessment itself. The provider you choose spends most of your budget.

Scope is also where costs swing. In its comments to the Reform Task Force, the SBA Office of Advocacy reported that the most frequent concern among small contractors was uncertainty about what counts as CUI and which systems fall inside the assessment boundary, not the assessment fee. A provider that scopes poorly pulls too much of your business into the boundary, and you pay to protect all of it.

Five pass/fail gates 

Apply these before you score anything. A provider that fails one should not advance, no matter how strong its pricing or presentation.

Gate 3 is where many contractors get surprised. Your MSP's remote management platform, SIEM, and identity tools usually handle Security Protection Data, which puts them in your assessment scope even when the provider never touches a CUI file.

The weighted provider scorecard 

Score only providers that clear every gate, and set the weights before any proposal arrives. These weights reflect how CMMC programs usually succeed or fail; adjust them to your situation.

Rate each category on the same scale used in our MSP and MSSP RFP template:

• 0: No answer or a non-answer.
• 1: Generic language that could describe any provider.
• 2: Specific and complete, describing how this provider actually works.
• 3: Specific, complete, and backed by evidence such as a sample SSP section, a redacted inheritance package, or a named reference.

Divide each category average by 3 and multiply by its weight. A provider averaging 2.4 in evidence handling earns 20 of 25 points. If you are running a formal procurement, the RFP template's sections on security operations, exit, and change of ownership pair well with this scorecard.

Strong and weak answers to listen for 

The fastest way to separate providers is to ask the same question of each one and compare the answers side by side.

The pause question is new, and it is revealing. Prime contractors set their own supplier deadlines, and some kept Level 2 certification requirements in place after the suspension. A provider that tracks your primes' flow-down language is watching the right signal.

Red flags 

• A pass guarantee. No provider controls the assessor's determination. A trustworthy one commits to readiness and remediation support, not an outcome.
• A rented enclave with no exit. Some providers host your CUI in an environment they own. If that provider closes or is acquired, your compliant environment can go with it. We have seen what happens when a CMMC-specialized MSP closes; ask who owns the tenant, and favor an environment built in your own. Our guide to where you store CUI covers the trade-offs.
• Checklists without engineers. Policies written from templates fail when an assessor asks your staff to demonstrate them. Ask who configures MFA, logging, and FIPS-validated encryption, and ask to meet them.
• An unnamed SOC. If monitoring is delivered by a white-label partner, that partner's tools and people are in your scope too.
• Stale timelines. A provider still selling against November 10, 2026, without mentioning the suspension, is not tracking the program closely enough to advise you.

How to run the evaluation 

1. Map your CUI first. List the contracts, data types, systems, and people involved. Every provider should price the same scope.
2. Confirm your requirement with each prime. Ask whether your subcontracts still require Level 2 certification or only self-assessment, and on what date.
3. Apply the five gates. Remove anyone who fails.
4. Send the same questions to two or three finalists. Use the answer table above, or the full RFP template for a formal process.
5. Score independently, then compare. Reconcile any category where evaluators differ by more than one point.
6. Ask for a sample. A redacted responsibility matrix or inheritance package tells you more than a sales deck.
7. Write the answers into the contract. Evidence ownership, exit terms, incident notification timelines, and the named team belong in the agreement.

How CompassMSP approaches this. CompassMSP is a listed RPO and a managed IT and security provider, so we sit on the readiness side of the line and never on the assessment side. We publish a responsibility matrix, prepare inheritance packages for the controls we operate, and build compliant environments in tenants our clients own. Send us the questions in this guide and score us against anyone else.

Start with our CMMC readiness services, book a 30-minute CMMC strategy session, or follow the Reform Task Force outcome in The Fine Print, our compliance newsletter.