ND-ISAC wrote the questions every defense contractor should ask an MSP. Here are our answers.

What the guide is — and the teeth in it

The working group wrote it for the contractors the defense supply chain actually runs on — the build-to-print machine shops, forges, and finishers — who must hand day-to-day security to an outside provider while still owning the compliance risk. It is a living document in plain language, organized into five areas: basic introductions, risk management, insurance, certifications and compliance, and business history. The recurring method is the same everywhere: ask for the policy, the matrix, the certificate, the org chart — and treat a provider who references a document but will not show it as a red flag.

The teeth are in the level-setting. If a provider stumbles on the opening questions — DFARS 252.204-7012 flowdowns, NIST SP 800-171, CMMC — ND-ISAC’s advice is that “it may be best to move on to another MSP.” Most of the remaining questions are not designed to disqualify anyone; they exist to make the risk you are transferring visible before you sign, not after the incident.

The first bar is CMMC — and it is the one we clear by the widest margin

Question one is not about help desks. It asks whether the provider knows NIST SP 800-171, DFARS 252.204-7012, and CMMC; whether it will accept the 7012 flowdown; whether it intends to certify, and at what level; and how many customer Level 2 assessments it has actually supported. The working group’s recommendation is unambiguous: choose proven experience — and if you expect to be CMMC Level 2 certified, you should expect your MSP to be CMMC Level 2 certified too.

• CLOUD2E holds CMMC Level 2 as an organization — our own enclave, our own SSP, our own C3PAO assessment, passed. The story is in our Level 2 preparation practice. And yes, we accept DFARS 7012 flowdowns — we operate under the same clause ourselves.
• We are a Cyber AB Registered Provider Organization with a Registered Practitioner principal, and our listing in the MSP Collective’s ESP Directory was validated with the C3PAO that issued our certificate — third-party checks, not self-attestation.
• Framework alignment — the guide’s second question: NIST SP 800-171 natively, practiced from a NIST SP 800-53 and RMF background. Where our engineers come from explains why that lineage matters.
• Certificate details on request, SSP available under restricted viewing — precisely the verification mechanism the guide endorses. Ask. We will not flinch.

Our answers to the questions that thin the herd

• MFA for administrative, remote, and application access — question ten: the guide treats this as non-negotiable, and so does NIST SP 800-171. We enforce it on ourselves — our Level 2 assessment examined it — and we build it into every client environment.
• How we touch your environment — question eleven: named accounts, never shared credentials; break-glass access that alerts when used; just-in-time elevation, which the guide reads as the mark of a mature MSP; and no technician in your systems without your knowledge.
• U.S. persons — question five: yes. Every CLOUD2E engineer is a U.S. person — the same team that holds TS and higher clearances — so ITAR and export-controlled data needs no carve-out clause with us.
• Where your data lives — questions six and eight: in your tenant, under your ownership. We design Microsoft 365 GCC High enclaves in the client’s name, and our CMMC Tracker deploys into your GCC High tenant, not ours. The guide’s position is that MSPs generally should not retain customer files; we agree so strongly we built our flagship product around not holding your data.
• Subcontracting — question twelve: none for engineering. The people who map your controls are the people who implement them, so there is no second org chart to ask us for.
• Incident response — questions seventeen and eighteen: roles, response expectations, and after-hours coverage agreed in writing before they are needed, and we support DFARS 252.204-7012 reporting — the 72-hour clock to the DoD Cyber Crime Center through DIBNET — as part of our incident response practice.
• The SSP and SPRS questions — question twenty-one: we maintain our own SPRS posture and an assessed SSP, and we will walk you through both under restricted viewing. An MSP that will not discuss its SSP is answering a different question than the one you asked.
• Business identity — question thirty-two: look us up yourself on SAM.gov — CAGE 9ZVC1, UEI FVCCF2PC6878. Thirty seconds, no sales call.

Two questions we would add

• Ask how the provider enters your assessment scope. Under the CMMC rule, an MSP that touches your CUI or runs your security tooling is an External Service Provider — it walks into your assessment with you. The guide never uses the term; your assessor will. Ask for third-party validation of ESP status, not a logo wall — here is what validated looks like.
• Ask who sits in the room during assessment week. A questionnaire establishes whether an MSP can run your environment; assessment week reveals whether they can defend it. We attend our clients’ assessments — put that in the contract.

Use the guide — on us first, if you like

Download the questionnaire from ND-ISAC and hand the questions-only version to every provider you are considering — including us. Then cross-examine: our guide to choosing a CMMC compliance company covers the questions ND-ISAC leaves out, the 2026 cost breakdown tells you what the answers should cost, and our CMMC certification guide maps the whole path your MSP is supposed to walk with you.

We like ND-ISAC’s guide for the same reason we publish our own answers: this market runs on claims, and the cure is paperwork. Bring the questionnaire to the first call. We will bring the documents.