.png)
Why ESP Baselines Matter
MSPs and MSSPs often hold privileged access to many client environments at once. A weakness at one provider can affect every organization it supports, which is why clients, insurers and regulators increasingly expect providers to show how they protect that access.
The ESP baselines were developed with the Cyber Accreditation Body (Cyber AB) and the ESP Collective. They take a tiered approach that is not tied to any single law, regulation or framework. Providers build reasonable security and resilience practices, and compliance with overlapping obligations follows from that work. The current baselines are designed for providers in North America.
The ESP baselines are part of the CORE initiative, which the SCF Council created to turn the comprehensive SCF catalog into focused, actionable baselines. Each ESP level is derived from the Common Controls Framework (CCF) and calibrated to the size, client base and threat profile of service providers, so MSPs and MSSPs have a defined starting point they can tailor to their own operations.
Build Credibility
Show clients a defined, independently verifiable standard of practice.
Win Larger Contracts
Meet the expectations of clients with regulated data and critical operations.
Manage Overlapping Obligations
Address multiple client requirements through one set of SCF controls.
Volunteer-Driven & Creative Commons Licensed
The ESP baselines are developed by volunteer cybersecurity practitioners and released under a Creative Commons license. There is no cost to access or implement them.
ESP Level 1, Level 2 & Level 3
The ESP baselines are tiered so a provider can match its protections to the clients it serves and the threats those clients face. Each level is described in its own section below.
Level 1
Foundational
Building credibility for security, compliance and resilience capabilities.
Level 2
Critical Infrastructure
Enhanced reliability for sensitive and regulated data environments.
Level 3
Advanced Threats
Robust capabilities to protect against more advanced threats.
The complete control set for each level is in the SCF download and is updated with each SCF release.
Foundational
ESP Level 1 is designed for Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) of any size or industry specialization that want to build credibility for their security, compliance and resilience capabilities.
Every MSP and MSSP holds some level of access to its clients' systems and data, which makes cybersecurity a critical capability for any provider. Level 1 defines the reasonable practices every provider should have in place, so clients have a clear, independently verifiable standard to evaluate a provider against.
Level 1 is also the starting point for providers that expect to move to a higher level as they take on clients with greater regulatory obligations or threat exposure.
Aligned With
- SCF CORE Fundamentals
- NIST Cybersecurity Framework (CSF) 2.0
- FAR 52.204-25 (NDAA Section 889)
- NIST SP 800-161 (supply chain risk management)
Critical Infrastructure
ESP Level 2 is intended for MSPs and MSSPs that support critical infrastructure clients, such as military, government, utilities, healthcare and transportation organizations. That includes environments that handle Controlled Unclassified Information (CUI) or Federal Contract Information (FCI).
Critical infrastructure clients operate under stricter regulatory and contractual obligations, and a disruption at their provider can affect essential services. Level 2 provides enhanced reliability for sensitive and regulated data environments.
Aligned With
- SCF CORE Fundamentals
- NIST Cybersecurity Framework (CSF) 2.0
- FAR 52.204-25 (NDAA Section 889)
- NIST SP 800-161 (supply chain risk management)
- NIST SP 800-171
- DHS CISA Trusted Internet Connections (TIC) 3.0
Advanced Threats
ESP Level 3 is built for MSPs and MSSPs that are reasonable targets for advanced persistent threats (APTs) because of the clients they serve and the data they support.
Well-resourced attackers target service providers because a single compromise can open a path into many client environments. Level 3 adds the robust capabilities needed to protect against these more advanced threats.
Level 3 includes every Level 2 control and builds on it with additional protections.
Aligned With
- SCF CORE Fundamentals
- NIST Cybersecurity Framework (CSF) 2.0
- FAR 52.204-25 (NDAA Section 889)
- NIST SP 800-161 (supply chain risk management)
- NIST SP 800-171
- DHS CISA Trusted Internet Connections (TIC) 3.0
- NIST SP 800-172
Which ESP Level Applies To Your Organization?
A provider's level depends on its clients' obligations and the threats it is likely to face. These questions help determine the right level:
Are you subject to NIST SP 800-171 or CMMC Level 2?
Do you market your services as “elite” or “advanced” levels of protection?
Are you subject to CMMC Level 3?
Are you a legitimate target for advanced persistent threats?
The flowchart to the right shows how the answers lead to a level, along with the scoping and add-on capabilities for each.
Industry Overlays
Providers can add overlays for the laws and frameworks that apply to the industries they serve, such as HIPAA business associate requirements, FedRAMP or NY DFS 23 NYCRR Part 500.
Independent Assessment Through SCR CAP
The ESP baselines are designed for independent third-party assessment through the SCR Conformity Assessment Program (SCR CAP). Accredited Third-Party Assessment Organizations (3PAOs) evaluate each control using the examine, interview and test methodology, giving clients documented evidence of the provider's practices.
%20(white).png)