CMMC Level 2 Shared Responsibility Matrix

When a managed service provider runs part of a defense contractor's environment, CMMC Level 2 responsibility is split. Some assessment objectives belong to the MSP, some to the organization seeking certification (OSC), and many are shared. Assessors and auditors expect that split to be written down objective by objective. This workbook gives MSPs, their clients and the auditors reviewing them one place to record it.

What the workbook covers

Everything sits in a single section, CMMC Level 2, with 324 rows. Each row is one assessment objective, shown with its control number, domain, CMMC control identifier and name, the full control statement and the objective text. The domains begin with Access Control and continue through Awareness and Training, Audit and Accountability, Configuration Management and the rest of the Level 2 controls. Because the rows go down to the objective level, you can split responsibility within a control rather than assigning it as a whole. For example, the MSP might enforce session lock settings while the OSC defines the inactivity period.

Working through it well

• Fill it in with the client, not for them. The OSC has to agree to the duties assigned to it.
• Work control by control. Objectives that define a policy or parameter often sit with the OSC, while objectives that enforce it on managed systems often sit with the MSP.
• For shared objectives, state exactly what each party does in its own responsibility field. Avoid a bare "shared."
• Use Notes to point to the tool, policy or contract clause that backs up each answer, so an auditor can trace it.
• Use row status to show which objectives are agreed and which are still being discussed.

The finished matrix documents who is responsible. It does not show that controls are implemented and is not a certification.