Distinction
CUI cloud is its own category.
A Cloud Service Provider that processes, stores, or transmits CUI is expected to arrive with authorization and a Customer Responsibility Matrix. That is not the same proof as a managed IT provider assessed against CMMC for services it operates.
| Managed IT in the boundary | CSP handling CUI | |
|---|---|---|
| Typical firm | Managed operations, SOC, vCISO tooling on the customer estate | IaaS, PaaS, SaaS, GovCloud, enclave host |
| What CMMC wants | Provider status for in-scope services plus a CRM | FedRAMP Moderate or equivalent plus a CRM |
| Where they list | Not this directory | This directory |
| Failure mode | Managing tools without being in scope | Calling a region CMMC ready without inheritance |
If you run managed services on top of your own authorized cloud, apply here for the cloud offering only.