Quick answer. As of September 2026, 32 CFR 170.4 makes your Microsoft staff augmentation partner an External Service Provider in your CMMC Level 2 assessment only if your CUI or Security Protection Data, such as configuration data, logs or admin credentials, is processed, stored or transmitted on the partner’s own assets. If it is, and the partner is not a cloud service provider, table 4 of 32 CFR 170.19 puts the partner’s services in your assessment scope, assessed as part of your assessment for CUI or as Security Protection Assets for security data, and the relationship has to be documented in your SSP and described in the partner’s service description and customer responsibility matrix. When DoD published the rule in the Federal Register on October 15, 2024, it said in its responses to public comments that staff augmentation where you provide all the processes, technology and facilities does not need a CMMC assessment, and that engineers using remote-access systems you provide work under your own policies.
Your outside Microsoft engineers are due to start in the GCC High tenant on Monday. They will reset Conditional Access policies, work in Intune and Purview, and hold admin rights in Microsoft Entra ID. The compliance lead who owns the SSP asks a fair question: does their firm now have to appear in our assessment scope? The regulation answers that by asking where your data will land, not by asking whose payroll the engineers are on.
This guide reads the rule for that one decision. It describes what 32 CFR 170 and DoD’s published explanation say; it does not decide your scope. Specifying the scope is your job, and testing it is your assessor’s.
Why the answer has to be settled before any Level 2 assessment
If you specify your assessment scope first and ask about the outside engineers afterward, the SSP is wrong on the day it is written. 32 CFR 170.19 puts scoping first, for self-assessments and certification assessments alike: “Prior to performing a Level 2 self-assessment or Level 2 certification assessment, the OSA must specify the CMMC Assessment Scope.” The OSA, the organization seeking assessment, is you.
The acquisition rule that carries CMMC into DoD contracts took effect on November 10, 2025, according to the Federal Register. For where the CMMC phase-in stands today, see Which CMMC Level Applies to You, and When Does It Start?; this guide does not track it, because the scoping rule applies whichever kind of Level 2 assessment comes next.
Planning rule: settle how the engineers will work before the scope is specified, not after they start.
The definition turns on where the data lands, not on who the people are
When someone asks whether outside engineers count, the first sentence of the definition seems to say yes. 32 CFR 170.4 reads: “External Service Provider (ESP) means external people, technology, or facilities that an organization utilizes for provision and management of IT and/or cybersecurity services on behalf of the organization.” The second sentence of the same definition is the one that decides: “In the CMMC Program, CUI or Security Protection Data (e.g., log data, configuration data), must be processed, stored, or transmitted on the ESP assets to be considered an ESP.”
Process, store or transmit is defined broadly in the same section of 32 CFR 170.4: data being used on an asset, data at rest on an asset, and data moving from one asset to another all count.
The last row of table 4 in DoD’s rule at 32 CFR 170.19, for a provider that handles neither CUI nor Security Protection Data, reads: “A service provider that does not process CUI or SPD does not meet the CMMC definition of an ESP”.
Planning rule: ask where your CUI and your security data will sit, asset by asset and owner by owner, and never stop at whether the people are external.
Security Protection Data is where administration work lands
If your outside engineers administer the tenant, the data they touch most is often not CUI at all but the security data around it. 32 CFR 170.4 defines both terms. “Security Protection Assets (SPA) means assets providing security functions or capabilities for the OSA’s CMMC Assessment Scope.” And: “SPD is security relevant information and includes but is not limited to: configuration data required to operate an SPA, log files generated by or ingested by an SPA, data related to the configuration or vulnerability status of in-scope assets, and passwords that grant access to the in-scope environment.”
What follows is this guide’s planning reading, not the regulation’s words. An engineer who administers the tenant from a laptop the engineer’s firm owns, keeps exported Conditional Access or Intune configurations in that firm’s repository or ticketing system, or stores your admin credentials in that firm’s password vault can put Security Protection Data on the firm’s assets. None of that requires opening a single CUI document.
Planning rule: list every place the engineers’ work product and credentials will live, and name the owner of each place.
The two arrangements, and what DoD said about each
Before the first engineer signs in, you will be in one of two arrangements, whether you choose it on purpose or not.
Arrangement A. The engineers work on devices you provide, under accounts in your own identity system, only inside your tenant and your tools, and any remote access runs through systems you provide.
Arrangement B. Any of the partner’s own devices, tools, tenants, repositories or vaults will hold your CUI or your Security Protection Data.
DoD described Arrangement A when it published the rule. In its responses to public comments, printed with the rule in the Federal Register on October 15, 2024 (89 FR 83092), DoD said: “An ESP that is used as on-site staff augmentation only, i.e., the OSA provides all processes, technology, and facilities, does not need CMMC assessment.” In the same responses DoD said: “An ESP that provides staff augmentation, where the OSA provides all processes, technology, and facilities, does not need CMMC assessment.” These are DoD’s replies to comments, not the text of 32 CFR 170.
On remote work, DoD’s responses in the same Federal Register publication said, when it published the rule: “The assessment of remote access may fall into several categories and is dependent on the specific architecture used and how the OSA creates its assessment environment.” And: “When an ESP is providing staff augmentation to the OSA and the OSA is providing all the systems used for remote access, then the OSA’s policies and procedures apply and the ESP is not considered to be processing, storing, or transmitting CUI.”
The regulation itself carries one related cell. In table 3 of 32 CFR 170.19, the Out-of-Scope Assets row includes: “An endpoint hosting a VDI client configured to not allow any processing, storage, or transmission of CUI beyond the Keyboard/Video/Mouse sent to the VDI client is considered an Out-of-Scope Asset”.
Arrangement B is where table 4 applies, as the next section shows. Neither description decides your scope: whether your arrangement is the one DoD described is yours to specify and your assessor’s to test.
Two related decisions sit next to this one. The engineers’ accounts belong in your own identity system, and choosing which directory is the authority for your Level 2 boundary is a separate decision from this one. If the engineers will use devices you issue and manage, Is Microsoft Intune CMMC Compliant? What It Covers, and What It Does Not covers the device side.
Planning rule: decide the arrangement in writing before onboarding, and name every asset of the partner’s that will be used, even if that list is empty.
When the partner is an ESP: the table 4 cells
If any of the partner’s own assets will hold your CUI or your security data, table 4 decides how its services are assessed. 32 CFR 170.19 sets the two questions first: “The OSA must consider whether the ESP is a Cloud Service Provider (CSP) and whether the ESP processes, stores, or transmits CUI and/or Security Protection Data (SPD).” Table 4 then gives one cell per answer, quoted here with its row and column from 32 CFR 170.19:
- Row CUI (with or without SPD), column Not a CSP: table 4 of 32 CFR 170.19 reads “The services provided by the ESP are in the OSA’s assessment scope and shall be assessed as part of the OSA’s assessment.”
- Row SPD (without CUI), column Not a CSP: table 4 of 32 CFR 170.19 reads “The services provided by the ESP are in the OSA’s assessment scope and shall be assessed as Security Protection Assets.”
- Row CUI (with or without SPD), column A CSP: table 4 of DoD’s rule at 32 CFR 170.19 reads “The CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012”.
- Row SPD (without CUI), column A CSP: table 4 of 32 CFR 170.19 reads “The services provided by the CSP are in the OSA’s assessment scope and shall be assessed as Security Protection Assets”.
A partner that manages a cloud service for you does not become a cloud service provider by doing so. When DoD published the rule, its responses in the Federal Register said: “An ESP that manages a third-party cloud service on behalf of an OSA would not be considered a CSP.”
The same DoD responses separate two questions that are easy to merge. DoD said: “When ESPs that are not CSPs do NOT process, store, or transmit CUI, they do not require CMMC assessment or certification, however, services they provide are in the OSA’s assessment scope.” And: “Any ESP services used to meet OSA requirements are within the scope of the OSA’s CMMC assessment.” DoD also said in those responses, published in the Federal Register, that a provider can sit inside the same corporate or organizational structure as the contractor, such as a centralized security or network operations center serving several business units, and still be external to the contractor.
What goes in the record, whichever arrangement you choose
If an assessor asks how the outside engineers fit your boundary, the answer has to be written down before the question is asked. For an ESP, 32 CFR 170.19 sets the record: “The use of an ESP, its relationship to the OSA, and the services provided need to be documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix (CRM), which describes the responsibilities of the OSA and ESP with respect to the services provided.”
The same paragraph of 32 CFR 170.19 covers the partner’s own assessment in two sentences. “Note that the ESP may voluntarily undergo a CMMC certification assessment to reduce the ESP’s effort required during the OSA’s assessment.” And: “The minimum assessment type for the ESP is dictated by the OSA’s DoD contract requirement.”
For Arrangement A, the record is yours alone: your SSP describes the engineers’ access as access under your own policies and procedures, on devices, accounts and remote-access systems you provide, which is the situation DoD’s remote-access response in the Federal Register addressed.
Planning rule: whichever arrangement you choose, write it into the SSP in the words an assessor will test, and keep the partner’s service description and responsibility matrix beside it if the partner is an ESP.
What to ask of the partner before the first login
Before the partner’s engineers sign in to your tenant, ask for answers you can put straight into the SSP. Each item below ties to a cell or a record requirement in 32 CFR 170.19:
- State, for each asset the partner owns, whether it will process, store or transmit your CUI or your Security Protection Data.
- State whether any of those assets is a cloud service.
- If any of them will hold your CUI or security data, supply the service description and the customer responsibility matrix the regulation requires.
- State whether the partner has voluntarily undergone a CMMC assessment, and of what type, as information for your record rather than as a ranking.
- Confirm the engineers can work entirely on devices, accounts and remote-access systems you provide.
No staffing firm, managed service provider or assessor is named or compared in that list. For the full set of procurement tests a government contractor runs on an augmented Microsoft team, see Agile Staff Augmentation for Government Contractors: What a Microsoft Delivery Team Must Show, and How You Test It.
When this guide is the wrong starting point
If your situation is one of these, start somewhere else.
- The partner will run your IT or security operations on its own platform. That is a managed service arrangement, not staff augmentation; table 4 governs it from the first cell, and it is not the engagement this guide describes.
- Your question is about CMMC Level 3. This guide covers Level 2 only.
- Your question is who may work on the program. 32 CFR 170 is not where that is answered, and this guide does not answer it.
- Your question is where the CMMC phase-in stands today. The timeline page linked above tracks it.
- You want someone to decide your scope. Specifying it is yours and testing it is your assessor’s; this guide describes the rule and decides no reader’s scope.
How i3solutions answers
If you are adding senior Microsoft engineers ahead of a Level 2 assessment, i3solutions answers with two kinds of work: senior Microsoft specialists embedded in your team to administer or build on Microsoft 365 GCC High, Microsoft Entra ID, Microsoft Intune and Microsoft Purview, and CMMC Level 2 implementation on Microsoft 365, with the arrangement you choose recorded in your SSP by your team.
Senior Microsoft specialists from i3solutions typically embed in the client’s team within two to four weeks of engagement start. Delivery is senior and US-based.
A CMMC Level 2 implementation for a defense contractor with a defined CUI boundary typically ranges from $45,000 to $75,000, covering the Compliance Manager baseline assessment, Conditional Access redesign, DLP policy build and testing, Purview Audit Premium configuration, and post-implementation documentation. That figure is a project price for an implementation, not a rate for embedded specialists.
i3solutions delivers under a partner-led engagement model with named accountability and governance that holds up under a client audit, as distinct from contractor-only staff augmentation.
An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. i3solutions does not scope, assess or certify anyone’s CMMC status; that determination is yours and your assessor’s.
For the wider staffing model, see IT Staff Augmentation Services: Senior Microsoft Talent, Exactly When You Need It.
i3solutions runs migrations against named control families across CMMC, HIPAA, SOC 2, and NIST 800-171, producing artifacts auditors can review.
Key Takeaways
Every fact below is drawn from 32 CFR 170.4, 32 CFR 170.19 and DoD’s responses to public comments published with the rule in the Federal Register on October 15, 2024:
- A provider is an ESP in the CMMC Program only when your CUI or Security Protection Data is processed, stored or transmitted on its assets.
- Security Protection Data includes configuration data, log files and passwords that grant access to the in-scope environment, which is where administration work lands.
- For a provider that is not a cloud service provider, table 4 puts its services in your scope, assessed as part of your assessment for CUI or as Security Protection Assets for security data.
- DoD said, when it published the rule, that staff augmentation where you provide all processes, technology and facilities does not need a CMMC assessment; that is DoD’s reply to comments, not rule text.
- An ESP’s use, relationship and services are documented in your SSP and described in its service description and customer responsibility matrix.
- Specify the scope, including the outside engineers, before any Level 2 self-assessment or certification assessment.
Frequently Asked Questions
Is a staff augmentation firm an External Service Provider under CMMC?
According to 32 CFR 170.4, a provider is an ESP in the CMMC Program only when CUI or Security Protection Data is processed, stored or transmitted on its assets, and according to 32 CFR 170.19, a service provider that does not process CUI or Security Protection Data does not meet the CMMC definition of an ESP. According to the Federal Register record of the rule, DoD said when it published the rule in October 2024 that staff augmentation where the contractor provides all processes, technology and facilities does not need a CMMC assessment. Which arrangement applies is the contractor’s to specify in its SSP.
Does my staff augmentation provider need its own CMMC certification?
According to the Federal Register record of the rule, DoD said when it published the rule in October 2024 that staff augmentation where the contractor provides all processes, technology and facilities does not need a CMMC assessment. According to 32 CFR 170.19, an ESP may voluntarily undergo a CMMC certification assessment to reduce its effort during the contractor’s assessment, and the minimum assessment type for an ESP is dictated by the contractor’s DoD contract requirement.
What is Security Protection Data in CMMC?
According to 32 CFR 170.4, Security Protection Data is security relevant information and includes but is not limited to configuration data required to operate a Security Protection Asset, log files generated by or ingested by one, data related to the configuration or vulnerability status of in-scope assets, and passwords that grant access to the in-scope environment.
Do remote administrators put their firm in my CMMC assessment scope?
According to the Federal Register record of the rule, DoD said when it published the rule in October 2024 that the assessment of remote access may fall into several categories depending on the architecture, and that when an ESP provides staff augmentation and the contractor provides all the systems used for remote access, the contractor’s policies apply and the ESP is not considered to be processing, storing or transmitting CUI. According to 32 CFR 170.19, table 3 treats an endpoint hosting a VDI client configured to not allow any processing, storage or transmission of CUI beyond keyboard, video and mouse as an Out-of-Scope Asset. Where administration work puts Security Protection Data on the firm’s own assets, table 4 of 32 CFR 170.19 applies. What an augmented Microsoft team must show before you trust it with a government program is covered in Agile Staff Augmentation for Government Contractors, while this answer covers only whether the team’s firm falls inside your CMMC assessment scope.
What goes in the customer responsibility matrix for an ESP?
According to 32 CFR 170.19, the use of an ESP, its relationship to the contractor and the services provided need to be documented in the contractor’s SSP and described in the ESP’s service description and customer responsibility matrix, which describes the responsibilities of the contractor and the ESP with respect to the services provided.
Planning the Decision
If outside Microsoft engineers are about to start in your GCC High tenant, decide in writing whether they will work only on your devices, accounts, tenant and remote-access systems, list every asset of theirs that would hold your CUI or security data, and put that answer in your SSP before the scope is specified for your next Level 2 assessment.
