thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

External Service Provider (ESP)

CMMC term for an external organization providing IT or cybersecurity services that handle CUI or Security Protection Data.

Definition

ESPs include managed service providers, managed security service providers, and cloud service providers. A CSP handling CUI must be FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency; non-CSP ESPs are in scope of the contractor's assessment. Responsibilities are documented in a customer responsibility matrix.

Example

An MSSP operating a contractor's SIEM is an ESP within assessment scope.

Exam tip

CSPs storing CUI must be FedRAMP Moderate or equivalent.

Related terms