Pentagon Cyber Rules Leave MSPs as Critical Attack Vector

This commentary highlights a significant security gap in the Pentagon’s Cybersecurity Maturity Model Certification (CMMC) program regarding Managed Service Providers (MSPs). While CMMC aims to protect the Defense Industrial Base by enforcing strict standards on contractors handling Controlled Unclassified Information, it treats MSPs as external service providers with voluntary certification requirements. This creates a dangerous vulnerability, as MSPs often hold privileged administrative access to contractor systems. If compromised, these providers can expose entire networks, a risk exemplified by recent attacks like SolarWinds and Kaseya. The authors argue that current regulations allow MSPs to escape equivalent scrutiny despite their operational control over sensitive environments. With thousands of MSPs serving defense contractors but very few certified, the Department of War lacks visibility into this supply chain risk. The article urges the House Armed Services Committee to mandate a survey of MSP usage among contractors and enforce stricter, mandatory certification standards for providers managing military-related data. This legislative fix aims to close the loophole without burdening small businesses, ensuring that third-party IT support does not become an easy entry point for adversaries like China and Russia.