External service provider (ESP)
In CMMC scoping, an external service provider is an outside company that runs IT or security services for a contractor and stores, processes, or transmits its CUI or security data in doing so.
Defense contractors rarely do all their own IT. Managed service providers, cloud services, and software vendors with remote access can all end up as ESPs. When they do, they become part of the contractor's assessment scope: the shop has to show how that provider is managed, what it can reach, and how its responsibilities are documented. A cloud service that stores CUI also falls under the FedRAMP Moderate equivalency requirement.
For a small shop, the ESP question often comes up through remote support. A vendor that can log into a system holding CUI, even occasionally, may count as an ESP, which means more documentation and more questions from an assessor. Your assessor and the current DoD scoping guidance are the authority on how a given provider is classified.
Traveler's Shop Server has no vendor remote access by default. Shop Server Defense support is designed to come from US persons only, and only when you grant access, so whether Traveler enters your scope is a choice you make and can document.
Related
Want this handled without the spreadsheet?
Traveler Cloud is quote-to-invoice for small machine shops at $109/month flat, unlimited users. It's in early access — leave your email and we'll bring you in by wave. No sales calls.
Free, no signup: Bar Stock Calculator →