Provider Change Trigger

Recheck scope, responsibilities, access, and proof when the MSP changes

A CMMC evidence transition plan for MSP changes: responsibilities, provider outputs, account access, diagrams, SSP, CRM/SRM, logs, tickets, and inherited evidence.

Run a change-trigger review Discuss evidence coordination

Export evidence and activity history before access ends

Map responsibilities from old provider to new provider

Update SSP, diagrams, CRM/SRM, and owner records

Route boundary significance to qualified review

Preserve the old provider record before cutover

Provider changes often remove access to ticket history, reports, attestations, configurations, and administrative contacts. Create an approved export and provenance manifest before termination, subject to contract and data-handling requirements.

Map the transition objective by objective

The new provider may implement the same service differently or decline responsibilities the old provider performed.

Old provider responsibility and last supporting evidence
New provider responsibility and first required output
Client-owned work during the transition
Accounts, repositories, integrations, and access changes
SSP, diagram, inventory, and CRM/SRM updates
Qualified decision on scope or reassessment implications

Do not label inherited evidence current automatically

A historical report from the old environment may remain part of the record, but it does not prove the new environment operates the same way. Establish the new provider’s evidence cadence and first current outputs.

What the work produces

Concrete, client-owned operating records

Provider transition evidence inventory

Responsibility crosswalk

Access and repository handoff

Document and diagram update queue

New-provider evidence calendar

Responsibility boundary

Facts, not verdicts

Gridex coordinates evidence continuity. Technical migration, architecture, contract interpretation, and reassessment decisions remain with the responsible experts and parties.

Questions buyers ask

Frequently asked questions

Does changing MSPs automatically require a new CMMC assessment?

Not every provider change does. Significant architecture or boundary changes require qualified evaluation and may require a new assessment.

What should be exported from the old MSP?

The answer depends on scope and contracts, but may include relevant reports, tickets, configurations, attestations, responsibility records, account history, and evidence provenance.

Primary references

Source context

DoD CMMC Level 2 Scoping Guide v2.13 Defines the assessment scope, asset categories, ESP relationships, and responsibility documentation. DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods.

Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

Run a change-trigger review →