The year-two problem
The hard part isn't reaching a compliant state — it's still being there eighteen months later, with evidence current enough to prove it. That's true whether your verification is a CMMC certificate, a GSA authorization with continuous monitoring behind it, or an annual self-assessment a prime can audit. Drift is silent: a Conditional Access exception here, an unlabeled share there, a POA&M item that stopped burning down. Managed compliance is the operational discipline that catches drift while it's a ticket, not a finding — because the real objective is continuously protected CUI, and the compliance artifacts are its exhaust.
What operations include
- Managed IT foundation — service desk, patching, and monitoring for the compliant environment, run inside the boundary rather than around it.
- Evidence refresh on schedule — screenshots, configurations, and logs re-captured against assessment objectives on a rolling calendar, so the evidence package never ages out.
- Control validation — periodic re-testing of implemented controls, the internal version of the mock-assessment gate that shipped your certification.
- POA&M burn-down — open items tracked, remediated, and closed against the CMMC POA&M rules — including the 180-day closeout clock.
- Change control for the boundary — new tools, users, and contracts evaluated for scope impact before they quietly expand your assessment.
- Authorization maintenance — for agency lanes with a continuous-monitoring obligation (see GSA), the reporting rhythm and re-evaluation readiness that keep the authorization decision standing.
- Baseline watch — Rev. 3 adoption, agency policy changes, and new clause language tracked against your contract mix, so transitions arrive as planned deltas.
Shared responsibility, held honestly: as your ESP we are inside your assessment scope — which is exactly why our own CMMC Level 2 certification matters. Our controls and evidence are inheritable. That's the difference between an ESP that strengthens your package and one that becomes your finding.
Want the boundary operated as a product? CUIckStart is our managed CUI enclave on Microsoft 365 GCC High, with compliance management at a published $6,500 a year: the SSP and the remaining customer work are kept current, and your MSP keeps the corporate network. See the published price or cuickstart.com.
Questions contractors ask us
Why does compliance need to be 'managed'? We passed.
Because every verification — a CMMC certificate, an agency authorization, a self-assessment score — measures a moment, and environments drift from that moment on. Evidence goes stale, staff changes break process, new tools enter the boundary. Year two is where certifications and authorizations quietly die — managed compliance is how the posture you proved stays true between reviews.
How is this different from a normal MSP contract?
A generic MSP keeps systems running. Managed compliance keeps systems provable: every patching cycle, access review, and configuration change is executed against the control set and captured as evidence at the assessment-objective level. And because we hold CMMC Level 2 ourselves, our posture as your ESP is inheritable rather than being your weakest link.
Does our MSP being in scope really matter?
Yes. An external service provider that touches your CUI or security functions is inside your assessment under shared responsibility — their posture becomes your finding. Ask any MSP bidding for your business what their own SPRS score is. A CMMC certification and an SPRS Basic Assessment score are different records; ask for the relevant scope and supporting evidence.
Keep the certification you paid for.
Tell us where your environment stands — certified, mid-remediation, or drifting — and we'll scope the sustainment operation. Or email rj@indirectit.com directly.