CMMC Shared Responsibility Matrix Worksheet
When an MSP runs your patching, a cloud service stores your CUI, and your own team approves the access, no one owns the whole control. A shared responsibility matrix says who does what and where the proof sits, so the assessor does not have to guess.
| Practice | Topic | Responsible party | Provider or tool | Customer share (%) | Provider share | Customer evidence | Provider evidence | Customer hours per year | |
|---|---|---|---|---|---|---|---|---|---|
40% | |||||||||
80% | |||||||||
70% | |||||||||
75% | |||||||||
0% |
Providers should supply their own responsibility matrix. If a cloud service stores or processes CUI, the CMMC rules expect it to meet FedRAMP Moderate or an equivalent. If an MSP or MSSP touches your in scope assets it is an External Service Provider and is assessed against the requirements it performs. Check the current rule for details.
Review your provider split
Optional: send the matrix and we will point out practices where the split looks thin. The worksheet is free either way.
Optional. The tool and every export work without this. No spam.
How to use it
Add a row for each practice that any provider touches, not just the ones you outsourced entirely. Choose the responsible party, name the tool or provider, and estimate the customer share of the work. Record the customer evidence and the provider evidence separately: configuration exports, reports, tickets, certificates. The computed provider share is simply 100 minus the customer share. Total hours show the work your own staff still performs, which is almost never zero. Ask your provider for their matrix and merge it with this sheet.
What inheritance means
A control is inherited when the provider's implementation satisfies the objective for your environment, and you have evidence of that. You still describe how you use the service in your SSP, configure the settings that are yours, and keep the provider's artifacts. Typical inherited items are physical protection of a data center and FIPS validated encryption modules. Typical retained items are user lifecycle, configuration choices and incident coordination. Cryptography claims should point to the validation certificate, not a marketing page.
- List providers that process, store or transmit CUI
- List providers that deliver security protection
- Get their responsibility matrix in writing
- Reflect the same split in your SSP
Common mistakes
Teams assume that buying a compliant service makes them compliant. The assessor will still test your configuration and your processes. Another mistake is the matrix that says Shared with no detail, which gives no one accountability. Check that the contract with the provider commits them to produce evidence, support the assessment and report incidents on a timeline that meets DFARS 252.204-7012. Review the matrix at every renewal and whenever a provider changes tooling.
Frequently Asked Questions
Is my MSP in scope for CMMC?
If it manages or has access to your in scope assets, or provides security protection for them, it is treated as an External Service Provider and must meet the requirements for the services it performs. Confirm details in the current rule and with your assessor.
Where do I get the provider matrix?
Ask the provider for its customer responsibility matrix or CRM. Cloud providers that hold FedRAMP authorizations publish one. If an MSP has none, build it together with them using this worksheet.
Does inheritance remove the need for evidence?
No. You still need evidence of your own configuration, the provider's artifacts, and a description of the split in the SSP. Inheritance reduces the work, not the proof.
How often should I update it?
At each contract renewal, when a provider changes products, when your scope changes and before each assessment or annual affirmation.
If incident data and evidence live partly with a provider, we can help design a private workflow that pulls both sides together for assessment preparation.
Related Tools
CMMC Practice Evidence Tracker Worksheet
One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
Compliance & ContractsCMMC C3PAO Assessment Day Prep Checklist
A four part checklist covering documents, evidence, people and logistics before a third party assessor arrives, with the items that sink assessments marked critical.
Aerospace & DefenseDFARS Flowdown Subcontractor Risk Tracker
An editable worksheet that records CUI exposure, flowdown status and cyber maturity per subcontractor and scores risk so you know whom to chase first.
More Compliance & Contracts tools
See all- SPRS Score Recovery Timeline Calculator
- CUI Banner and Dissemination Control Marking Reference
- ITAR Technical Data Handling Procedure Template
- CMMC Level 2 Checklist Worksheet
- CMMC Level 1 Checklist (15 Practices) with Evidence Tracker
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
Keep exploring
Free tools
- CMMC Practice Evidence Tracker WorksheetOne row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
- CMMC Level 2 Checklist WorksheetAn editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel.
- CMMC Level 1 ChecklistTick through every CMMC Level 1 practice for Federal Contract Information, see example evidence for each, and finish with the annual affirmation steps.
ERP fixes and how-tos
- Costpoint Cloud or On-Prem for a Contractor Handling CUI?Deciding between Deltek Costpoint cloud and self-hosted for a defense contractor with CUI: scope, shared responsibility, cost, control, what to verify.
- On-Prem vs Cloud ERP AI for Regulated ManufacturersHow CIOs at ITAR, CMMC, and export-controlled manufacturers should weigh on-prem versus cloud AI for their ERP, including what actually needs to stay on-prem and what does not.
- IFS Cloud Versions: Release Names, Solution Sets and How to Check YoursHow IFS Cloud versions are named (22R1, 23R2 and so on), what solution sets such as aerospace and defense mean, and how to check your version.
Guides
- ERP Requirements for Contract Manufacturers and EMS ProvidersERP requirements for contract manufacturers: customer-owned inventory, multi-customer traceability, quote-to-cash speed, EDI onboarding and margin visibility.
- Building a CUI Enclave for Defense ManufacturingHow to build a CUI enclave for defense manufacturing: scope NIST SP 800-171 and CMMC boundaries, isolate ERP and engineering data, and cut assessment cost.
- ITAR and CMMC: Handling Technical Data in AI WorkloadsHow ITAR and CMMC apply to AI workloads: technical data boundaries, CUI handling, assessed environments, and where on-prem AI is the only option.
AI on your ERP
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.
Manufacturing hubs
- Alabama automotive manufacturing corridorAlabama's automotive plants and tier suppliers in Vance, Lincoln, Montgomery and Huntsville: IATF 16949, PPAP, EDI, ERP and private AI for supplier plants.
- Aerospace and Defense Subcontractors on Long Island, New YorkLong Island aerospace and defense subcontractors: machining, fabrication and electronics shops, anchors, AS9100, ITAR and CMMC needs, and ERP and quoting problems.