MSP vs GRC Tool vs Enclave Provider for CMMC: Who Does What

Who does what for CMMC Level 2?

An MSP operates your systems, a GRC tool tracks your controls and evidence, and an enclave provider hosts the environment where CUI lives. None of the three assesses you or signs your affirmation. That signature belongs to a senior official at your company. Most small suppliers buy one of the three and assume it covers the rest, and the gap is where assessments fail.

The three roles

	MSP	GRC tool	Enclave provider
What it does	Runs identity, endpoints, network, patching, backups	Maps controls, collects evidence, tracks tasks and policies	Hosts a bounded environment (virtual desktops, GCC High, a segmented cloud) for CUI
Strong at	Technical requirements it operates: 3.1, 3.4, 3.5, 3.13, 3.14 families	Evidence trail, SSP and POA&M drafting, score tracking, keeping the program alive after month one	Shrinking the boundary; inheriting controls from a provider that already meets DFARS 7012 cloud requirements
Weak at	Policy, risk, training, incident ownership, the SSP narrative	Anything it cannot connect to, including the people parts	Everything outside the enclave, which is still your company

What the GRC tools offer, from their own pages

Two named examples, read on 6 October 2026.

Secureframe sells three packages on its pricing page. Fundamentals is listed at "Starting at $7,500/year", according to Secureframe. Complete and Defense are quote only. Defense is the CMMC package, described as "Simplify SSP, POA&M, and other CMMC compliance requirements", and its list includes "SPRS Score Tracker", "System Security Plan (SSP)", "Plan of Action & Milestones (POA&M)", "Managed CUI Enclave", "Managed Virtual Desktops" and "Manage CUI Vendors". That is a GRC tool and an enclave in one subscription. What it does well: the enclave and the tracking live in the same place, so the evidence is generated where the enclave runs.

Vanta's CMMC page says it provides pre-mapped controls aligned to NIST SP 800-171 and 800-172, manages SSPs and POA&Ms, and tracks an SPRS score from one dashboard. Vanta states that it "partners with Cyber AB-listed RPOs for readiness and C3PAOs for certification" and names A-LIGN and Schellman as examples. Vanta publishes no prices; its pricing page lists four tiers and asks you to request a demo for a quote. What it does well: the integration library and the partner network, which hands you to a readiness firm or an assessor when you need one.

Both are good tools. Neither turns on MFA for you or escorts the visitor. Our Vanta comparison and Secureframe comparison go deeper.

What the MSP covers, and what it brings into scope

A capable MSP can implement most of the technical requirements: MFA, endpoint hardening, logging, patching, backups, FIPS-validated encryption and network segmentation.

Two cautions. First, 32 CFR Part 170 treats an external service provider that processes, stores or transmits CUI as part of your assessment scope, so ask the MSP in writing which of your requirements it meets and how it evidences them. Second, DFARS 252.204-7012 requires that any cloud used for covered defense information meet FedRAMP Moderate or equivalent. An MSP that moves your CUI into a commercial tenant without checking has created a finding, not a fix.

What the enclave provider changes

The boundary. A 30-person supplier with four engineers who touch drawings can put those four into a hosted enclave and leave the other 26 at Level 1 for FCI. The assessor now walks four virtual desktops, one identity provider and a file store.

The enclave provider does not write your SSP, decide what is CUI, train your people or own the 72-hour incident report. Level 1 vs Level 2 covers the scoping logic, and our readiness timeline shows where the enclave decision sits in the schedule.

Where the program stands

Phase 1 self-assessments have appeared in solicitations since 10 November 2025. Phase 2 third-party assessments were suspended on 13 July 2026, and the class deviation of 3 September 2026 removes the C3PAO requirement from contracts for now, with no end date and no repeal. DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS scores and the 72-hour incident report still apply. AccuSights is not a C3PAO.

The combination that works for a small supplier

1. Decide the boundary first, enclave or not. Every later cost depends on it.
2. Give the MSP a written list of the requirements it owns and the evidence it will produce.
3. Use a GRC tool if you have many integrated systems; a spreadsheet and a shared drive if not. Assessors accept both.
4. Keep the SSP, the POA&M, the risk assessment and the incident response plan with a named owner at your company.
5. Post an honest score. How to calculate your SPRS score shows the method.

The missing role in most setups is the one that reads the requirements the way an assessor will. That is readiness, and it is a service, not a subscription.

Where AccuSights fits

We are the readiness partner: scoping, the gap assessment, the SSP and POA&M, the fixes alongside your MSP, and a mock assessment, with a named engineer and a fixed fee in writing within 24 hours of the intake form. The endpoint agent is built in, so device evidence needs no separate MDM. We are not a C3PAO. Start with the CMMC framework page, the NIST SP 800-171 page, or a free Risk Diagnosis and we will tell you which of the three you actually need.