3 Steps to Evaluate CMMC Services for MSPs Before Committing

CMMC appears to be a growth opportunity. You’re looking at new clients, higher-value contracts, and long-term revenue tied to regulated work. But it’s not a service you casually add.

In a previous post, we broke down why CMMC changes how your business operates; cost, liability, and zero room for improvisation. You’re taking on responsibility for how controls are implemented, documented, and defended under assessment.

That’s not just a small shift, that’s a different business altogether.

So now you’re left with the real question: Do you actually want to do this?

CMMC is something you decide first. Before you touch tools, hiring, or certifications, you need to make a call. Are you in or are you out?

Here’s how to decide.

The CMMC Go / No-Go Filter 

Since this is a business decision, before you commit to anything, you need to run a simple filter that forces clarity on whether CMMC belongs in your business at all.

Step 1: Quantify Your Exposure

Start with revenue. Look at how much monthly recurring revenue is tied to CMMC-affected clients, how many clients that represents, and how concentrated that revenue is across your base. This gives you a grounded view of what’s actually at stake.

If a meaningful portion of your business depends on these clients, the decision may already be leaning toward commitment because walking away would have a real financial impact. If the exposure is minimal, that’s equally important. In that case, you’re not protecting existing revenue; you’re evaluating whether it makes sense to take on additional cost and risk.

To make this concrete, ask:

• How much MRR is directly tied to CMMC-related clients?
• If we lost these clients, what would the impact be on the business?
• Are these clients concentrated enough to create dependency?

Step 2: Calculate the Real Cost of Entry

Next, assess what it will actually take to operate in this space. The cost is not limited to tools. It includes the expertise required to interpret and implement controls correctly, the processes needed to document and enforce those controls, and the operational discipline required to stand up to an assessment.

In practice, this often means investing in training, bringing in experienced resources, and reworking how your team operates day to day. The shift is structural, not incremental, and it affects how your business delivers services across the board.

To pressure-test your assumptions, ask:

• Do we currently have the expertise to interpret and implement CMMC controls correctly?
• What new processes would we need to build and enforce?
• What investment in training, hiring, or outside expertise would this require?

Step 3: Make a Clear Decision

With that context, the final step is to choose a direction. For some MSPs, that means committing fully and building the capability to operate in a regulated environment. For others, it means partnering with organizations that already have that capability in place. And in some cases, it means deciding not to pursue this market at all.

What creates problems is staying in between, continuing to take on CMMC-related work without the investment or structure to support it. That’s where delivery breaks down, margins erode, and risk accumulates quickly.

To move from analysis to action, ask:

• Are we willing to invest in building this capability properly?
• Would partnering be a better path than building from scratch?
• If we don’t commit, are we prepared to walk away from this work?

Running this filter won’t answer every question about CMMC, but it will answer the most important one: whether this is a direction your business should take.

Turning a Decision Into a Standard  

Making the decision is one part. Getting your team to operate consistently around it is another.

The problem is not with understanding what CMMC requires at a high level, MSPs struggle with applying that understanding the same way across the business.

A framework like this only works if it becomes repeatable, something your team can follow without relying on one person to interpret it every time.

With Empath, you can take a decision model like this and turn it into something your entire team understands and applies consistently. From there, the platform acts as a learning and accountability layer for your team. It allows you to take how your business evaluates opportunities like CMMC and turn it into a shared standard your team can consistently follow.

That creates alignment.

Instead of reacting case by case, your team operates from a shared standard. And that’s what prevents you from drifting into work your business isn’t built to handle.

Make the Call With Clarity 

If you’re still evaluating whether this market makes sense for your MSP, Empath Navigator and Compliance Veteran Jennifer VanderWier’s course Should My MSP Service CMMC Clients? walks through the realities in detail.

Start your free trial to access the full course and work through the decision with your eyes open. If you’re already thinking about how to operationalize this across your team, you can also book a demo to see how Empath helps turn these decisions into consistent, enforceable standards.

Because the difference between a successful CMMC practice and a costly misstep usually comes down to one thing: Making the call early, and making it deliberately.

Like this? You'll love our newsletter.

Get our weekly emails packed with more expert insights, new courses, and community events you won't find anywhere else.