CMMC Level 1 Shared Responsibility Matrix
by Vertask (verified provider)
A CMMC 2.0 Level 1 shared responsibility matrix for Organizations Seeking Certification and their MSPs. Assign all 59 assessment objectives to OSC, MSP or Shared and finish with an evidence record across 15 controls.
Free with a Vertask account. New workspaces start with a 30-day Pro trial, so you can import it straight away.
- 59 checklist items
- 6 sections
- 9 columns
- Version 1.0
- Updated Oct 30, 2026
About this template
When a managed service provider runs part of your IT, CMMC Level 1 work gets split between two parties. Someone still has to show, objective by objective, who handles each requirement and what proves it. This workbook is that matrix. It lists every CMMC 2.0 Level 1 assessment objective with its control statement. For each one, you record whether the OSC, the MSP or both are responsible, and what evidence backs it up.
What the sections cover
- Access Control: authorized users, processes and devices, permitted transactions and functions, external connections, and keeping Federal Contract Information (FCI) off public systems.
- Identification and Authentication: identifying users, processes and devices, and verifying them before they get access.
- Media Protection: sanitizing or destroying media that holds FCI before disposal or reuse.
- Physical Protection: limiting physical access, escorting and monitoring visitors, physical access logs, and managing access devices.
- Systems and Communications Protection: defining and protecting external and key internal boundaries, and separating publicly accessible components.
- System and Information Integrity: flaw remediation timeframes, malicious code protection and updates, and periodic and real-time scanning.
Working through it well
- Settle responsibility first. Go through each section with your MSP and agree on OSC, MSP or Shared before anyone collects evidence.
- For Shared objectives, write down where the split falls. For example, the MSP manages endpoint protection and your staff escort visitors.
- Make evidence specific. Name the policy, system setting, log or record an assessor could ask to see, not just "in place."
- Watch the objectives that ask you to define something, such as flaw-remediation timeframes and scan frequency. The definition itself needs evidence, separate from proof that you follow it.
- Use the row status to track progress, and mark an objective Completed only when its responsibility and evidence are both filled in.
Built for: Organizations Seeking CMMC Level 1 certification, and the MSPs supporting them, dividing and documenting responsibility for each objective
What you get
- All 15 CMMC 2.0 Level 1 controls broken into 59 assessment objectives, one row each
- 6 sections organized by control category, from Access Control to System and Information Integrity
- Each control statement and assessment objective prefilled, so you work from the requirement text
- A clear OSC, MSP or Shared assignment for every objective
- A finished evidence record you can review with your MSP and bring into assessment preparation
- Per-row status so you can see which objectives are still open
What you’ll record
Filled in for you
- Category Name · short text
- CMMC Control · short text
- CMMC Control Name · short text
- Control Statement · long text
- Assessment Objective # · short text
- Assessment Objective · long text
You fill in
- Responsibility · dropdown: OSC, MSP, Shared
- Evidence or clarification · long text
- Notes · long text
A look inside
Access Control 19 items
| Category Name | CMMC Control | CMMC Control Name | Control Statement | Assessment Objective # | Assessment Objective | Responsibility you fill in | Evidence or clarification you fill in | Notes you fill in |
|---|---|---|---|---|---|---|---|---|
| Access Control | AC.L1-B.1.i | Authorized Access Control | Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). | AC.L1-B.1.i[a] | authorized users are identified; | OSC / MSP / Shared | ||
| Access Control | AC.L1-B.1.i | Authorized Access Control | Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). | AC.L1-B.1.i[b] | processes acting on behalf of authorized users are identified; | OSC / MSP / Shared | ||
| Access Control | AC.L1-B.1.i | Authorized Access Control | Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). | AC.L1-B.1.i[c] | devices (and other systems) authorized to connect to the system are identified; | OSC / MSP / Shared |
Identification and Authentication 6 items
| Category Name | CMMC Control | CMMC Control Name | Control Statement | Assessment Objective # | Assessment Objective | Responsibility you fill in | Evidence or clarification you fill in | Notes you fill in |
|---|---|---|---|---|---|---|---|---|
| Identification and Authentication | IA.L1-B.1.v | Identification | Identify information system users, processes acting on behalf of users, or devices. | IA.L1-B.1.v[a] | system users are identified; | OSC / MSP / Shared | ||
| Identification and Authentication | IA.L1-B.1.v | Identification | Identify information system users, processes acting on behalf of users, or devices. | IA.L1-B.1.v[b] | processes acting on behalf of users are identified | OSC / MSP / Shared | ||
| Identification and Authentication | IA.L1-B.1.v | Identification | Identify information system users, processes acting on behalf of users, or devices. | IA.L1-B.1.v[c] | devices accessing the system are identified | OSC / MSP / Shared |
+ 53 more items in 4 more sections
Every section
- Access Control 19
- Identification and Authentication 6
- Media Protection 2
- Physical Protection 10
- Systems and Communications Protection 10
- System and Information Integrity 12
Questions
What is a CMMC shared responsibility matrix?
It is a record of which party handles each CMMC requirement when an outside provider manages part of your environment. This workbook assigns every Level 1 assessment objective to the OSC, the MSP or both, and captures the evidence for each.
Which CMMC level does this template cover?
It covers CMMC 2.0 Level 1: 15 controls broken into 59 assessment objectives across 6 categories. It does not include Level 2 requirements.
What do OSC and MSP mean in the Responsibility column?
OSC is the Organization Seeking Certification, meaning your company. MSP is your managed service provider. Shared means both parties carry part of the objective.
Can I use it if we do not work with an MSP?
Yes. You can mark objectives as OSC and still use the evidence and notes fields to build your Level 1 record. The matrix is most useful when responsibilities are split, though.
Does completing this workbook mean we are CMMC compliant?
No. The workbook organizes who is responsible and what evidence exists for each objective. Whether the controls are actually implemented is up to your organization and your assessment.
Does the template include the requirement text?
Yes. Each row includes the category, control identifier, control name, control statement, and the specific assessment objective, so you do not need to copy them in.
Do I need a paid plan to use this template?
Getting the template is free with a Vertask account. Importing it into a working checklist uses Workbooks, which is on the Pro plan; new workspaces start with a 30-day Pro trial.
Can I change it after importing?
Yes. Importing creates your own copy: rename, add or remove sections, rows and columns. The template itself never changes, and you can clone your copy per client, property or device.
Provided as-is.
How to use it
- Sign up free We take you straight to this template afterwards.
- ImportIt becomes a working checklist with an owner, a status and a date on every line.
- Make it yoursEdit any step, add your own, then clone it per client, property or device.
Useful for