I have a client with a deep rooted MSP, providing help desk ticketing, DLP, email security, and a couple others. I need some kind of evidence to show them that their MSP is also going to be required CMMC (level2), which they have been preparing to get for the last two years, through the MSP’s “professional” services. The MSP had no idea what they were getting into, I am concerned for my client because of this. I’m trying to get my client to start flipping some of these services under their own ownership before it gets too close to 2025.

Is there hard evidence I can show them that says this MSP is going to require the same level of CMMC certification?