# CMMC Shared Responsibility Matrix Worksheet > Source: https://netray.co/tools/cmmc-shared-responsibility-matrix-msp-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Record who implements each practice, where the evidence lives and what share is yours. Useful when an MSP, MSSP or cloud service provider runs part of your CUI environment. ## Category compliance-legal ## Industry Defense ## Audience - IT manager - Compliance lead - Operations manager - Consultant ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Practice **Key:** practice **Type:** text #### Topic **Key:** topic **Type:** text #### Responsible party **Key:** owner **Type:** select **Options:** - Customer - MSP or MSSP - Cloud provider - Shared #### Provider or tool **Key:** provider **Type:** text #### Customer share **Key:** cust_pct **Type:** number **Unit:** % **Help:** Percent of the work the customer still performs #### Provider share **Key:** prov_pct **Type:** number **Expr:** 100 - cust_pct **Format:** percent #### Customer evidence **Key:** cust_evi **Type:** text #### Provider evidence **Key:** prov_evi **Type:** text #### Customer hours per year **Key:** hrs **Type:** number **Rows:** #### Account authorization **Practice:** AC.L2-3.1.1 **Owner:** Shared **Provider:** Identity provider **Cust pct:** 60 **Cust evi:** Joiner and leaver tickets **Prov evi:** Tenant config export **Hrs:** 24 #### FIPS validated cryptography **Practice:** SC.L2-3.13.11 **Owner:** Cloud provider **Provider:** Cloud storage **Cust pct:** 20 **Cust evi:** Configuration of encryption settings **Prov evi:** CMVP certificate numbers **Hrs:** 6 #### Audit logging **Practice:** AU.L2-3.3.1 **Owner:** MSP or MSSP **Provider:** Managed SIEM **Cust pct:** 30 **Cust evi:** Log source list **Prov evi:** Retention and review reports **Hrs:** 40 #### Flaw remediation **Practice:** SI.L2-3.14.1 **Owner:** MSP or MSSP **Provider:** Managed patching **Cust pct:** 25 **Cust evi:** Approved maintenance windows **Prov evi:** Patch compliance reports **Hrs:** 30 #### Physical access **Practice:** PE.L2-3.10.1 **Owner:** Customer **Provider:** None **Cust pct:** 100 **Cust evi:** Badge logs and visitor log **Hrs:** 18 **Totals:** #### Average customer share **Key:** cust_pct **Agg:** avg **Format:** percent #### Customer hours per year **Key:** hrs **Agg:** sum **Format:** number #### Practices listed **Key:** practice **Agg:** count **Format:** integer **Summary:** #### Customer hours per practice **Key:** hours_per_practice **Expr:** sum_hrs / count **Format:** decimal **Primary:** true #### Average share inherited from providers **Key:** inherit **Expr:** 100 - avg_cust_pct **Format:** percent **Notes:** Providers should supply their own responsibility matrix. If a cloud service stores or processes CUI, the CMMC rules expect it to meet FedRAMP Moderate or an equivalent. If an MSP or MSSP touches your in scope assets it is an External Service Provider and is assessed against the requirements it performs. Check the current rule for details. ## Content **Intro:** When an MSP runs your patching, a cloud service stores your CUI, and your own team approves the access, no one owns the whole control. A shared responsibility matrix says who does what and where the proof sits, so the assessor does not have to guess. **Sections:** #### How to use it **Body:** Add a row for each practice that any provider touches, not just the ones you outsourced entirely. Choose the responsible party, name the tool or provider, and estimate the customer share of the work. Record the customer evidence and the provider evidence separately: configuration exports, reports, tickets, certificates. The computed provider share is simply 100 minus the customer share. Total hours show the work your own staff still performs, which is almost never zero. Ask your provider for their matrix and merge it with this sheet. #### What inheritance means **Body:** A control is inherited when the provider's implementation satisfies the objective for your environment, and you have evidence of that. You still describe how you use the service in your SSP, configure the settings that are yours, and keep the provider's artifacts. Typical inherited items are physical protection of a data center and FIPS validated encryption modules. Typical retained items are user lifecycle, configuration choices and incident coordination. Cryptography claims should point to the validation certificate, not a marketing page. **Bullets:** - List providers that process, store or transmit CUI - List providers that deliver security protection - Get their responsibility matrix in writing - Reflect the same split in your SSP #### Common mistakes **Body:** Teams assume that buying a compliant service makes them compliant. The assessor will still test your configuration and your processes. Another mistake is the matrix that says Shared with no detail, which gives no one accountability. Check that the contract with the provider commits them to produce evidence, support the assessment and report incidents on a timeline that meets DFARS 252.204-7012. Review the matrix at every renewal and whenever a provider changes tooling. **Cta:** If incident data and evidence live partly with a provider, we can help design a private workflow that pulls both sides together for assessment preparation. **Faq:** #### Is my MSP in scope for CMMC? **Answer:** If it manages or has access to your in scope assets, or provides security protection for them, it is treated as an External Service Provider and must meet the requirements for the services it performs. Confirm details in the current rule and with your assessor. #### Where do I get the provider matrix? **Answer:** Ask the provider for its customer responsibility matrix or CRM. Cloud providers that hold FedRAMP authorizations publish one. If an MSP has none, build it together with them using this worksheet. #### Does inheritance remove the need for evidence? **Answer:** No. You still need evidence of your own configuration, the provider's artifacts, and a description of the split in the SSP. Inheritance reduces the work, not the proof. #### How often should I update it? **Answer:** At each contract renewal, when a provider changes products, when your scope changes and before each assessment or annual affirmation. ## Search terms cmmc shared responsibility matrix template, customer responsibility matrix cmmc, msp cmmc responsibility, external service provider cmmc, csp customer responsibility matrix, fedramp moderate equivalent crm, cmmc inherited controls, esp responsibility matrix excel --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json