Any MSPs receiving. Processing, or storing CUI data must have a CMMC Level 2 Certification. There are still decisions the DoD is making regarding this subject, so in the meantime It is recommended that you obtain the MSPs documentation and link it to yours.