# MSP Earns CMMC Level 2 Certification

An unnamed managed service provider (MSP) says it passed its CMMC Level 2 assessment on the first attempt, with every control rated “Met.” The MSP described certification as voluntary for its business and said preparation began in February 2026. The accompanying discussion highlights planning for accidental CUI spillage even when routine CUI processing is not intended, and describes using an internally operated GCCH tenant through an AOS-G arrangement rather than outsourcing that environment. No contract or solicitation was identified.

- For defense contractors evaluating MSPs that may handle CUI, the discussion underscores checking assessment scope and documented procedures for accidental CUI exposure, including when routine processing is not intended.
- MSPs may find the example relevant to readiness planning: the discussion identifies staff capacity, spillage procedures, and executive buy-in as considerations, although it provides no quantified cost or schedule.
- Because the MSP described certification as voluntary and no procurement opportunity was identified, buyers should distinguish this example from contract-specific CMMC requirements and evaluate providers against the terms of each solicitation.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 06, 2026

### Key Quotes
> We setup robust spillage procedures because humans are humans. The errant CC on the wrong email address, accidently sharing files you shouldn't. Just anything really. We setup our policies that we don't STP CUI but are ready just incase it gets introduced.
> — Commenter

> It takes a considerable amount of work and a healthy amount of trust and buy in from the MSP C-Suite, but it will pay dividends in the end.
> — Original poster

### Sources
- [MSP completed L2 Certification on first attempt](https://www.reddit.com/r/CMMC/comments/1wytnsh/msp_completed_l2_certification_on_first_attempt) - reddit-cmmc