During a CMMC assessment, as the Lead Assessor, you realize that the OSC relies on a Managed Service Provider (MSP) to oversee some of their IT infrastructure, including a cloud-based storage solution. Employees access the cloud storage remotely through a web browser. The OSC has a Service Level Agreement (SLA) with the MSP outlining security protocols. However, you have limited access to the internal configuration and security controls of the MSP’s cloud environment. What challenges might you encounter when assessing the OSC’s compliance with CMMC’s external connection controls?
Submit