ยท CMMC
CMMC ESP Requirements: When a Service Provider Becomes In-Scope
A service provider enters your CMMC scope once its systems process, store, or transmit CUI or Security Protection Data for you, which triggers documentation, shared responsibility, and assessment requirements that you control and must evidence.