Login

u/broketobreak

▲ 3 r/CMMC

Best practices for MSPs managing GCC High enclaves without being "in scope" for CUI?

We’re currently managing a 5-user GCC High environment for a client chasing CMMC L2. We’ve implemented the standard controls, but we’re looking to refine our long-term management strategy.
Specifically, we want to maintain the seat-based management but keep our own MSP tools/staff out of the CUI scope as much as possible (least-privilege, consent-based access, etc.).
Does anyone have a preferred "Co-Managed" or "White-Label" framework for this? We're trying to figure out if it's better to:

  1. Build a rigid internal compliance wing (expensive/slow).
  2. Partner with a specialist who handles the "Compliance/CUI" side while we handle the "M365/User" side.
    If you’ve successfully partnered with a CCP or another MSP for this, what did that hand-off look like?
reddit.com
u/broketobreak — 11 days ago