What CMMC enclave scoping tells MSPs and RPOs about data licensing

What does CMMC scoping tell an MSP about data licensing?

CMMC scoping tells an MSP which of a defense supplier's systems hold controlled unclassified information (CUI) and which hold ordinary commercial records. Everything inside the CUI boundary is out of any licensing conversation. Commercial, non-CUI operating records outside it, such as service tickets, finance workflows and internal documentation, are the only material an introduction to SourceX can even discuss, and only if the company has the rights.

If you run an MSP or work as a registered provider organization (RPO), you are already drawing that boundary for clients. The same diagram that shows an assessor where CUI lives shows you where it does not.

CMMC is being phased in under the Department of Defense's rule, so many suppliers are mapping their environments now. Confirm the current phase dates and requirements for each client with the DoD and with a certified assessor; this page does not restate them.

Why are MSPs and RPOs well placed to introduce clients?

You see three things most advisers do not: the system inventory, the retention settings and the people who can approve an export. During a readiness engagement you build the asset list, the data flow diagrams and the system security plan inputs. You also sit in the monthly business review with the owner or COO.

That makes you the person who can say, accurately, "this client has a ticketing system with eight years of history, a finance platform outside the enclave and a documentation wiki that never touched CUI." AI developers training agents to perform operational work value exactly that kind of connected record of how work was requested, routed, solved and closed.

This page is general information about how scoping relates to licensing. Whether a given record is CUI is a determination for the contractor, its contracting officer's requirements and its assessor, not for SourceX or for you.

How do you read a scoping package for licensing signals?

Treat the package as a screening tool. For each system, ask what sits inside the assessment boundary and what sits outside it.

A system on the out-of-scope list is only a candidate. Out of CMMC scope does not mean the client has licensing rights; customer contracts, export-control marking and prime-contractor flow-downs can still restrict use.

The enclave-out screen

Use five questions per client, in this order. A no on the first or second stops the conversation.

• Boundary: is the records source clearly outside the CUI boundary, with no CUI ever copied into it?
• Marking: have staff marked or segregated export-controlled and customer-restricted material, and can the client explain how?
• Rights: did the client create the records, and do customer and prime contracts allow licensing a de-identified copy?
• Depth: does the client have 50+ full-time employees at peak (contractors excluded) and several years of documented operations?
• Sponsor: can the owner, CEO or CFO authorize an exploratory conversation?

The company fit checker runs a preliminary, non-binding version of the depth and sponsor checks without contact details.

Which MSP and RPO moments are the right ones to raise it?

Raise it where the client is already thinking about records and cost.

Compare how other MSP specialties spot the same signal in the guides for manufacturers' legacy ERP servers, construction closed-job archives and architecture and engineering CAD and BIM archives.

How does the introduction work without touching client data?

You introduce; you never handle records, and nothing from the enclave is described to anyone.

1. Ask the client's COO or owner whether they would hear about a licensing option, outside any compliance billing.
2. Send your referral link, or file the company through the referral form with four facts only: size, years in business, industry and an executive contact.
3. SourceX checks headcount, history, breadth of systems and rights directly with that executive.
4. The client's counsel and compliance lead decide which commercial systems enter the data inventory, and CUI-path systems never do.
5. Price and terms are settled before any buyer sees the opportunity; the client signs only if they work.
6. Delivery follows an executed agreement, under redaction rules agreed in advance.

You never export, upload or describe confidential records, and as a service provider you should not touch a client's records for this purpose at all.

What should you say to a client?

The introduction email builder can draft a longer version.

How do partner rewards work for an MSP?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; a lead, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. It is a share of SourceX's fee and is never deducted from what the company receives.

Check your client agreements and any vendor or assessor-independence rules before accepting a referral reward from a client you also assess or advise. RPOs in particular should confirm with the CMMC accreditation body's rules and their counsel. See the program terms for current details. This is general information, not legal, tax or financial advice.

When should an MSP skip the conversation?

• The only long-history records sit inside the CUI enclave.
• The client is a small shop with fewer people than the 50+ full-time employee baseline at peak.
• Contracts with primes or agencies bar any secondary use of operating records.
• The client's tools were reset or archives deleted.
• No executive can approve or own an inventory.

A client that fails today can be reconsidered after a migration preserves a clean commercial export.

Next step

Pick one client whose scoping package is finished and run the enclave-out screen. If it passes, register as a partner, then have the sponsor apply at sourcex.si/apply with your referral link, and see the managed service provider referral guide for the wider playbook. The who qualifies page lists the full baseline.