Vertical Deep-Dive • CMMC for MSP Clients

CMMC Compliance Your Defense Clients Cannot Afford To Fail

Every MSP serving the Defense Industrial Base supply chain needs a CMMC Level 2 answer. Petronella Technology Group, Inc. puts a CMMC Registered Practitioner Team behind your MSP, delivers gap assessments through assessment readiness, and joining as a Petronella Partner costs $0.

Apply free as a Petronella Partner Optional: MSP Stack Membership

How can an MSP deliver CMMC Level 2 to defense-contractor clients?

An MSP delivers CMMC Level 2 by pairing its IT operations with a Registered Provider Organization for the advisory work. Petronella Technology Group, Inc. is Cyber AB RPO #1449 with a CMMC Registered Practitioner Team. Your MSP keeps running the environment while Petronella performs the gap assessment, SSP and POA&M authoring, and assessment readiness. MSPs join free as a Petronella Partner, and CMMC and CUI engagements are approved deal by deal.

What Level 2 covers: the 110 security requirements of NIST SP 800-171 Rev 2, under the CMMC program rule at 32 CFR Part 170.
Firm: founded April 5, 2002 in Raleigh, NC; Cyber AB Registered Provider Organization #1449; BBB A+ accredited since 2003; a CMMC Registered Practitioner Team; a 24/7 SOC; a 2-hour response commitment.
Founder: Craig Petronella, CMMC-RP, CCNA, CWNE, Digital Forensic Examiner #604180, MIT-Certified in AI and Blockchain, with 30+ years of personal experience.
Cost to join: $0. Choose a 10% referral commission or a per-deal white-label wholesale quote.
What Petronella does not do: the certification assessment itself. That is performed by a C3PAO the client selects.

The CMMC 2.0 Landscape for MSPs

CMMC 2.0 is no longer a future requirement. The Department of Defense has codified the rule. Prime contractors are flowing down CMMC Level 2 requirements to subcontractors, and subcontractors are calling their MSPs asking for help. The MSP that can answer "yes, we handle CMMC" keeps the client and wins a five-to-six-figure compliance engagement. The MSP that says "we don't do that" loses the client to a specialized compliance firm that will eventually take over the managed-services contract too.

The challenge is not the credential alone. The real barrier is depth of experience across all 110 NIST SP 800-171 requirements. An MSP with one newly certified RP and no track record of delivering gap assessments, authoring System Security Plans, or walking clients through C3PAO assessments is going to struggle with the first engagement. That is where Petronella comes in.

The MSP's Compliance Gap

Most MSPs can install endpoint protection, configure MFA, and manage a firewall. Those are necessary but not sufficient for CMMC Level 2. The 110 practices span 14 control families including access control, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, physical protection, personnel security, risk assessment, security assessment, system and communications protection, system and information integrity, and awareness and training.

Why Role-Based Training Is the Moat

The awareness and training family is where most MSPs and their generic-training vendors fail. NIST SP 800-171 separates two requirements: 3.2.1 (make managers, administrators and users aware of security risks) and 3.2.2 (train personnel to carry out their assigned security duties). The first covers general workforce awareness. The second asks for training matched to the roles and responsibilities of each person who handles CUI.

Generic security-awareness platforms help with awareness. On their own they rarely answer role-based training, because they deliver the same phishing simulations and awareness modules to every employee regardless of role. A system administrator handling CUI in an enclave needs different training than a procurement clerk with email-only access. Role-based training evidence usually means curricula mapped to job functions, documented per-role training plans, and evidence that each individual completed the training appropriate to their access level.

Petronella's MSP Stack includes the CMMC Bootcamp (67 lessons) and the 39-Layer Curriculum (54 lessons), which give your team structured CMMC and security curricula to build role-based training on. This is the competitive moat that separates Petronella partners from MSPs that rely solely on commodity awareness platforms.

What Petronella Provides to MSP Partners

CMMC Bootcamp (67 Lessons)

Full CMMC Level 1 through Level 2 readiness curriculum delivered via the Training Academy. Covers SSP drafting, POA&M construction, audit-evidence packaging, and assessor preparation. Available immediately through MSP Stack membership.

39-Layer Curriculum (54 Lessons)

Petronella's signature sellable framework. Use it as your own commercial framework with regulated-SMB clients. Covers layered security from physical controls through application security. Available through MSP Stack membership.

SSP and POA&M Authoring

Petronella writes the client's System Security Plan and Plan of Action and Milestones as part of the scoped engagement, mapped to the 110 NIST SP 800-171 requirements and the client's actual environment.

Gap Assessment Delivery

Full 110-practice gap assessment against your client's environment. Delivered as a prioritized remediation roadmap with effort estimates, tooling recommendations, and evidence-collection templates.

Credentialed Work Under Our Name

Documents signed by a CMMC Registered Practitioner in that capacity, and anything prepared for an assessor, always issue under the Petronella Technology Group, Inc. name. Your MSP keeps running the client's environment.

Assessment Readiness Walkthrough

A mock assessment with a Petronella Registered Practitioner acting as the assessor. Surfaces documentation gaps and evidence chain-of-custody issues before the real C3PAO walks in the door.

Fleet for Compliance-Aware Prototyping

When a CMMC engagement also involves private AI infrastructure, the Petronella Fleet $75,000 Compliance-Aware Prototype tier maps CMMC Level 2, HIPAA, and NIST 800-171 controls directly onto the AI architecture. The prototype deliverable includes SSP artifacts, an audit-evidence package, and a compliance overlay document the MSP's end client can present to their C3PAO. This is increasingly common as DIB contractors adopt AI for engineering knowledge bases, ITAR-aware document drafting, and CUI-safe compliance workflows.

Operator Council for Serious MSPs

MSP owners at $3M to $15M in annual revenue who want peer calibration and strategic counsel alongside compliance capability should apply for the Petronella Operator Council. The Council is a 20-seat cohort with a 12-week async onboarding curriculum, monthly live Q&A with Craig Petronella, quarterly outside-expert sessions, P&L benchmarking, and a deal-flow channel that routes engagements to members with matching capacity.

Charter Cohort 1 pricing starts at $45,000 per year for the first 12 seats (25% below steady-state $60,000/yr). The onboarding curriculum includes dedicated CMMC weeks (Weeks 4 and 5) covering gap-assessment process, Level 2 delivery, and pricing strategy for compliance engagements.

Petronella's CMMC Registered Practitioner Team

Every member of the Petronella team holds the CMMC Registered Practitioner credential. Founder Craig Petronella also holds CCNA, CWNE, Digital Forensic Examiner #604180 and MIT certification in AI and Blockchain, with 30+ years of personal experience.

Petronella Technology Group, Inc. is Cyber AB Registered Provider Organization #1449, BBB A+ accredited since 2003, and has operated from Raleigh, NC since April 5, 2002. Full practice details at CMMC compliance and CMMC assessment.

CMMC timing in 2026: why the work has not paused

Defense clients hear mixed news about CMMC this year, and MSPs field the questions. The facts: DoD paused CMMC Phase 2 on July 13, 2026, and a September 3, 2026 class deviation lets contracting officers accept Level 1 and Level 2 self-assessments. The DFARS 252.204-7012 duty to implement NIST SP 800-171 did not pause. A client with CUI in its environment still has to implement the 110 requirements, keep a System Security Plan, and be able to show evidence when a prime or contracting officer asks.

For an MSP, that means the conversation shifts from "when is your assessment" to "can you prove the controls work today". A gap assessment and a current SSP answer both, whichever way the schedule moves.

Where the work splits between your MSP and Petronella

Work item	Your MSP	Petronella Technology Group, Inc.
Day-to-day IT operations, endpoints, identity, backups	Owns and runs	Advises on configuration to meet the requirements
Gap assessment against the 110 requirements	Provides access and system knowledge	Performs and reports
System Security Plan and POA&M	Supplies configuration facts	Authors
Remediation of technical findings	Implements, where it is in your scope	Guides and verifies
Role-based training evidence	Tracks completion	Provides curriculum options
Assessment readiness	Prepares the environment	Runs the mock assessment
Certification assessment	Performed by a C3PAO the client selects, never by Petronella

The split lets your MSP bill for the operational work it already does well, while the advisory work that needs Registered Practitioner depth comes from Petronella.

How a CMMC deal moves through the partner program

Register the client. Submit the prospect through deal registration before anything is quoted. Petronella approves or declines within 5 business days. CMMC and CUI engagements are approved deal by deal.
Scope together. Petronella scopes the engagement with you: CUI locations, systems in scope, current documentation and the client's contract clauses.
Choose the structure. Under referral, Petronella contracts with the client directly and pays you 10% of the services revenue it receives in the first 12 months. Under white label, Petronella gives you a per-deal wholesale quote, and you resell at your own price.
Deliver. Petronella performs the advisory work. Credentialed documents carry the Petronella Technology Group, Inc. name. Your MSP keeps operations and the day-to-day relationship.
Hand off to assessment. When the client is ready, it selects a C3PAO for the certification assessment, or completes a self-assessment where its contract allows one.

Six questions to ask a defense client on the first call

You do not need to be a CMMC expert to qualify a CMMC opportunity. These questions surface the scope in one conversation, and the answers are exactly what Petronella needs to review a deal registration.

Which DFARS clauses are in your current contracts? Ask the client to check for 252.204-7012, 7019, 7020 and 7021. The 7012 clause is the one that requires NIST SP 800-171 today.
Do you receive or create Controlled Unclassified Information? Drawings, specifications and technical data marked CUI put the client in Level 2 territory. Federal Contract Information alone points to Level 1.
Where does that information live? Email, file shares, cloud storage, engineering workstations and shop-floor systems all count. The answer defines the assessment scope and often the cost.
Do you have a System Security Plan, and when was it last updated? A missing or stale SSP is the most common starting point.
Has a prime asked for your SPRS score or a CMMC status? A prime's request usually sets the real deadline, whatever the federal schedule says.
Who inside the company owns compliance? Someone has to sign off on the plan. If nobody owns it, that is a vCISO conversation as well.

Write the answers into the deal registration. A complete registration speeds the review, and it lets Petronella tell you early whether the deal fits referral or white label.

Who This Is Built For

MSPs serving DIB primes and subs with DFARS 7012, 7019, 7020, or 7021 clauses in active contracts
MSPs whose defense-contractor clients have received a CMMC Level 2 flow-down requirement with a deadline
MSPs that can handle IT operations but lack in-house CMMC-RP credentialed engineers for advisory and assessment work
MSPs that want to build internal CMMC capability over time using Petronella's curriculum and templates as the foundation
MSPs serving healthcare, legal, or financial clients with dual-compliance scope (HIPAA plus CMMC, or NIST 800-171 plus industry regulation)

What Does Not Fit

Clients with zero DoD exposure who do not need CMMC Level 2
Clients asking for CMMC Level 3 (requires a different specialized partner; Petronella refers)
Clients asking the MSP to rubber-stamp a self-attestation with no controls work (Petronella will not sign off on shortcuts)

Petronella Partner, $0 to join

The fastest way to offer CMMC to your defense clients is the free partner agreement. There is no membership fee. You sign one Petronella Technology Group, Inc. partner agreement and choose how you want to work on each client deal: referral, white label, or both. CMMC and CUI engagements are approved deal by deal.

Option A: Referral

You introduce the client. Petronella Technology Group, Inc. sells, contracts and delivers under its own name. You earn 10% of the services revenue Petronella actually receives from that client during the first 12 months of the client's agreement. Fees for work performed by Petronella personnel count; hardware, third-party licenses, platform and pass-through costs do not. Commissions are paid within 30 days after the month the revenue is received, with a commission statement.

Option B: White label

You sell under your own brand at the price you set, and Petronella delivers as your subcontractor at a per-deal wholesale quote, valid for 30 days. You are the customer of record. Fixed-fee wholesale fees are paid 100% upfront when the order is signed, and recurring fees are billed in advance. The client stays with your MSP: Petronella will not solicit a white-label end customer for the same services, during the agreement or for 24 months after it ends.

Terms that apply to both options

Register each client deal before it is quoted. Petronella approves or declines a registration within 5 business days. An approved registration is valid for 90 days and can be renewed while the opportunity is active.
Some documents always carry the Petronella Technology Group, Inc. name and cannot be rebranded: attestation letters, documents signed by credentialed personnel (for example a CMMC Registered Practitioner), submissions to regulators, assessors or auditors, and Business Associate Agreements.
The agreement runs for 1 year and renews automatically unless either side gives 30 days' notice. It is non-exclusive for both sides.

What happens after you apply: send the free application and choose Petronella Partner. Our team reviews it within two business days. If it is a fit, we send the partner agreement for electronic signature, and you elect referral, white label or both when you sign.

Apply free as a Petronella Partner Apply for white label

Want training and a member community as well? Petronella MSP Stack is the optional paid membership. It is not required to be a partner.

Related MSP-Partners Resources

MSP Partners program hub - the free Petronella Partner entry and the optional paid tiers
Petronella MSP Stack - optional paid membership from $1,997/mo with the CMMC Bootcamp and the 39-Layer framework
Digital Forensics for MSP Clients - for incidents that also trigger DFARS 252.204-7012 reporting
Petronella Operator Council - 20-seat peer cohort, $45K charter / $60K steady-state, includes CMMC-focused onboarding weeks
Petronella Fleet - $75K Compliance-Aware Prototype tier maps CMMC/HIPAA/NIST 800-171 onto AI architecture
Private AI Solutions for MSP Clients - vertical deep-dive for AI engagements in regulated environments
HIPAA Compliance - for dual-compliance clients (healthcare plus defense)
CMMC Assessment Practice - Petronella-direct assessment capability details

Frequently Asked Questions

Why not just get one of our engineers registered as a CMMC-RP?

You can, and many MSPs do over time. The bottleneck is depth of experience on the 110 practices, not the credential itself. A practical path is to bring Petronella in on your first client engagements under the partner agreement, then build internal capability from the SSPs, evidence lists and remediation plans delivered as part of that work.

Does Petronella perform the formal C3PAO assessment?

No. Petronella is an RPO (Registered Provider Organization), not a C3PAO (Certified Third-Party Assessment Organization). An organization that advises a client should not also assess it, so Petronella prepares the client through assessment readiness and the client selects its own C3PAO. There is no referral fee between Petronella and any C3PAO. After remediation closes the 110-control gaps, point your client to our C3PAO selection guide so they can run a vendor-neutral comparison and avoid choosing a C3PAO that creates conflict-of-interest concerns.

What if our client already failed a CMMC assessment?

Failed assessments are a common entry point. Petronella runs a failure-mode analysis against the assessor's report, produces a prioritized POA&M, and stands up remediation. Some clients reach readiness on a second attempt; some need to reduce CUI scope. Petronella advises honestly on which path fits.

How does the pricing work for the MSP?

Joining as a Petronella Partner is $0. For each client deal you choose referral (Petronella contracts with the client and pays you 10% of the services revenue it receives in the first 12 months) or white label (Petronella gives you a per-deal wholesale quote and you set your own price to the client). MSP Stack is an optional paid membership for curriculum and community, and Fleet prototyping is scoped per engagement.

Can the CMMC deliverables carry our MSP's brand?

Operational work can be delivered under your brand through the white-label option. Documents signed by a CMMC Registered Practitioner in that capacity, and anything prepared for an assessor or regulator, always carry the Petronella Technology Group, Inc. name. Your MSP may not present Petronella's credentials as its own.

Are CMMC deals available under the white-label option?

CMMC and CUI engagements are approved deal by deal. Register the client first; Petronella reviews the scope, the CUI involved and the contract clauses, then confirms whether the deal runs as referral or white label.

Does the Phase 2 pause mean our clients can wait?

No. DoD paused CMMC Phase 2 on July 13, 2026, and a September 3, 2026 class deviation lets contracting officers accept Level 1 and Level 2 self-assessments, but the DFARS 252.204-7012 duty to implement NIST SP 800-171 did not pause. Clients handling CUI still need the controls in place and documented.

How long is a registered deal protected?

Petronella approves or declines a deal registration within 5 business days. An approved registration is valid for 90 days and can be renewed while the opportunity stays active. While it is valid, Petronella will not pursue that prospect directly or through another partner for the registered opportunity.

Non-Refundable & No-Guarantee Notice: All fees paid under membership, assessment, and compliance engagements are non-refundable. No guarantees of any business outcome - including CMMC certification pass rates, revenue lift, deal flow, or client compliance readiness - are made or implied. Results depend on MSP execution and end-client environment. The MSP Stack Stripe checkout requires a terms checkbox acknowledging these terms.

Ready To Add CMMC To Your Service Catalog?

Join free as a Petronella Partner and bring your first defense client to us. MSP Stack is the optional paid membership if your team also wants the curriculum and community. Questions? Call (919) 348-4912 or contact us.

Apply free as a Petronella Partner Optional: MSP Stack - From $1,997/mo