ESP explained
What is an ESP? External Service Providers and CMMC scope
An External Service Provider supplies services your organisation relies on. Record the actual service, information handled and customer responsibilities.
Examples and responsibilities
Managed IT and security services are common examples. Record administrative access, data handling and which controls each party operates. A supplier name alone does not establish coverage.
CMMC assessment scope
For non-cloud providers handling CUI, Part 170 describes documenting services and responsibilities in the SSP and assessing relevant services within the organisation’s assessment scope.
Next step
Add the service to Scope and connect it to the vendor record. Request a service description and customer responsibility matrix. Confirm the arrangement against the applicable assessment requirements.
Official sources
Reviewed 2026-09-22. Check current sources and your contract when making assessment or eligibility decisions.