NinjaOne: How MSPs Can Inherit CMMC Controls via FedRAMP

Name: NinjaOne: How MSPs Can Inherit CMMC Controls via FedRAMP
Uploaded: 2026-07-10T11:49:18-04:00
Duration: 58 s
Description: CMMC is showing up in active DoD contracts now, and the MSPs who've done the prep work are the ones getting (and keeping) those accounts. MSPs who haven't are finding out the hard way. So, we want to help. We recorded a panel with MSP leaders at Exec...

NinjaOne

07/10/2026

0 (0%)

Report Like Favorite

TL;DR

FedRAMP authorization is the only accreditation whose controls can be inherited during a CMMC assessment, reducing the technical burden on MSPs.
MSPs using NinjaOne can reference its FedRAMP status in their SSP, signaling to assessors that key controls like FIPS encryption are already satisfied.
Remote access tools must use FIPS-validated cryptography to meet CMMC requirements — NinjaOne's FedRAMP-backed tooling addresses this directly.

Summary

This short clip, drawn from a longer NinjaOne panel featuring MSP leaders from Executech and Axiom, highlights one of the most practical CMMC compliance advantages available to managed service providers: control inheritance through FedRAMP-authorized tooling. The speaker explains that FedRAMP authorization is the only accreditation whose controls can be directly inherited during the CMMC assessment process. Because NinjaOne holds FedRAMP authorization, MSP clients can reference that status in their System Security Plan (SSP) and expect assessors to accept it without requiring further technical scrutiny. Specific examples include FIPS-validated encryption and boundary protection — both critical requirements for DoD-adjacent environments. The speaker also addresses a common MSP challenge: ensuring that remote access agents deployed on client machines use FIPS-validated cryptography. NinjaOne's FedRAMP-backed remote access capability is cited as a direct solution to this requirement, reducing the compliance burden on the MSP and strengthening their overall CMMC posture. For MSPs pursuing or maintaining DoD contracts, this clip underscores the strategic value of selecting tools that carry FedRAMP authorization, as it can meaningfully reduce the scope and complexity of a CMMC assessment.

Chapters

0:00 - FedRAMP & Control Inheritance
0:16 - SSP Documentation & Assessors
0:32 - Remote Access & FIPS Requirements

Key Quotes

0:00 "... the only accreditation that can be inherited during your CMMC process."
0:05 "I can inherit some of the controls that Ninja has. So, like, their FIPS encryption that they have, the boundary protection around the tools that they have, those types of things."
0:16 "... because they have their FedRAMP authorization, I can provide that as an example and the assessor will be like, okay, I'm not going to dig further because of the fact that they have that."
0:41 "... you want to make sure your remote access tool has a FIPS validated cryptography that's going to allow the remote access capabilities. And that's something that we leveraged through Ninja, which has been a huge help for us."

FAQ

What does it mean to 'inherit' controls during a CMMC assessment?

Control inheritance means an MSP can reference a vendor's existing FedRAMP authorization in their System Security Plan to satisfy certain CMMC technical requirements — such as FIPS encryption or boundary protection — without needing to independently demonstrate compliance for those controls.

Why does FedRAMP matter specifically for CMMC compliance?

FedRAMP is the only accreditation recognized for control inheritance in the CMMC process. If an MSP's tooling holds FedRAMP authorization, assessors will generally accept that as evidence for the covered controls and will not dig further into those specific requirements.

Categories:

» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Becoming Agent Ready with Cyera: Essential Strategies and Insights

Verge.io: Can You Afford Your Next Storage Refresh?

Summer of Satori: FunFoneFarm's Transformation of Fraud into Seamless Integration

Invisible Data: Understanding What Needs Protection

Embrace AI Adoption While Maintaining Robust Security Measures