CMMCpedia
Work with me

Terms / Scope and assets

External service provider

An outside provider handling your CUI or your security protection data. What it handles decides how it enters your assessment.

Also called ESP, external service providers.

Official Source Material

External Service Provider (ESP) means external people, technology, or facilities that an organization utilizes for provision and management of IT and/or cybersecurity services on behalf of the organization. In the CMMC Program, CUI or Security Protection Data (e.g., log data, configuration data), must be processed, stored, or transmitted on the ESP assets to be considered an ESP.

Source: 32 CFR 170.4, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

A provider only counts when it handles your information or your security data.

The definition has two halves. The provider supplies or manages IT or cybersecurity services for you, and your controlled information or your security protection data lives on its systems. A vendor that does neither is not an external service provider under this program, whatever your contract calls it. Test both halves before you add a provider to your plan.

Table 4 answers the scoping question in four lines, and it is worth reading directly.

Table 4 to 170.19(c)(2)(i) sorts providers by what they handle and whether they are a cloud service provider. A cloud provider handling Controlled Unclassified Information must meet the FedRAMP requirements in DFARS 252.204-7012. A non-cloud provider handling it is assessed as part of your assessment. A provider handling only security protection data is assessed as a security protection asset. A provider handling neither is not an external service provider at all.

Your support provider is in scope.

A managed service provider with administrative access to your assessed environment holds configuration data and credentials, which are security protection data. AC.L2-3.1.20 asks you to verify and control connections to external systems. That brings its services into your scope. Ask early, because a provider that cannot describe its own controls becomes your problem during your assessment.

Three documents settle the relationship, and you should have all three.

The rule asks that the provider, the relationship, and the services appear in your system security plan, and that the provider supply a service description and a customer responsibility matrix. Ask for the last two in writing. A provider that has never produced them is telling you something useful about how many defense clients it has carried through an assessment.

What falls short

  • A provider named in the plan with no description of the services it delivers. The rule asks for the relationship and the services, not the company name.
  • A cloud service holding controlled information with no authorization evidence. The FedRAMP requirement comes from the safeguarding clause, so the evidence belongs in your file.
  • An assumption that a provider's own certification covers you. It can reduce effort, and your plan still has to describe the service and the split of duties.

Edge cases

  • Your provider handles neither your information nor your security data, such as a company that ships hardware. It is not an external service provider, and it may still matter to supply chain risk.
  • A provider stores your logs and nothing else. Log data is security protection data, so the service is in scope as a security protection asset.
  • Your provider offers to undergo its own assessment. That is allowed and voluntary, and the minimum type follows your own contract requirement.

Over-engineering

  • Requiring every vendor to complete a security questionnaire. The definition narrows this to providers handling your information or your security data.
  • Moving away from a working provider because it is not certified. A clear responsibility matrix and evidence of the controls it runs are what your assessment needs.