- A service feature, an assigned task, and an implemented outcome are different things.
- Shared responsibility becomes clearer when each party explains its own action and dependency.
- A provider's assurance does not automatically establish the customer's readiness.
Learning objectives
This lesson teaches the meaning of shared responsibility through a fictional service arrangement. It is not a purchasing checklist or a substitute for evaluating a real provider. Learners will play customer, provider, and reviewer, then explain how a useful feature becomes an operating outcome only when the necessary actions occur. Read the assets and external-services lesson first if the distinction between a service and the customer's environment is new.
- Separate a provider capability from customer configuration and operation.
- Identify the dependency between two parties' responsibilities.
- Explain what evidence would support the claimed result and what remains unknown.
Use three different sentences
Consider these statements: the service can create an activity record; the customer configured recording for its workspace; a designated person reviews the relevant records. The first describes capability, the second implementation, and the third an operating activity. A claim about one sentence does not prove the others. This is a useful distinction even before a learner encounters a detailed responsibility document.
The external-service-provider provisions in 32 CFR 170.19 address the relationship between the service, the information it handles, and responsibility documentation. Those rules supply context, while the fictional role-play below teaches the underlying reasoning. Do not assume that every supplier relationship has identical CMMC treatment or that a provider's assessment or service description automatically establishes the customer's entire environment.
Set up the role-play
Give the provider a card stating that the fictional service records selected events when the customer enables the option. Give the customer a card stating that its staff must select the relevant settings and review the output. Give the reviewer a card containing the claim: important activity in the training workspace is recorded and reviewed. No real service or security requirement is represented by these invented cards.
Ask each party to explain its task, input, output, and dependency. The provider may need a configuration choice from the customer. The customer may need documentation describing the available events. The reviewer should ask how the claimed outcome can be established. Avoid giving one party all the answers; the learning occurs when participants discover that their responsibilities connect but are not interchangeable.
Worked fictional example: the enabled feature
Fictional customer Maple Research subscribes to a service that includes recording. Its project manager says the provider handles monitoring, so no internal review role is needed. During the role-play, the provider explains that it supplies the records but the purchased arrangement does not include interpreting the customer's project activity. The customer realizes that the claimed operating outcome contains a task nobody was performing.
The learner playing the customer proposes assigning a qualified review role and clarifying the procedure. The learner playing the reviewer asks what would demonstrate that the records cover the intended workspace and that review occurs. The group distinguishes a proposed improvement from an already implemented result. The exercise succeeds when participants can explain the gap without blaming the provider for work it never agreed to do.
Change one assumption and repeat
In a second round, change the provider card so that the service includes a defined review function. Ask what remains with the customer: choosing the correct service, supplying necessary context, responding to notifications, or verifying the arrangement's fit may still matter. The exact responsibilities depend on the facts. The lesson is not that one party always owns a particular task; it is that the claimed outcome requires an explicit explanation.
Have learners draw arrows between the parties' outputs and inputs. If an arrow ends without a recipient, identify the unanswered question. Then ask each person to restate the other party's role accurately. This check reveals whether the team understands the relationship or merely repeats its own responsibilities. Keep the drawing conceptual and fictional rather than placing sensitive service details into a general training artifact.
Self-check and answer
Question: A provider advertises a security feature. A learner concludes that the customer's corresponding requirement must therefore be satisfied. What steps in the reasoning are missing?
Answer: The learner has not established that the relevant service includes the feature, that it is appropriately configured and used, that the customer's remaining responsibilities are performed, or that evidence supports the intended outcome. The applicable requirement and scope must also be understood. A feature may contribute to an implementation, but its existence is not a complete assessment conclusion. The correct response is to identify the missing connections, not to assume that provider services are either universally sufficient or universally unsuitable.
Sources & further learning
Use primary sources and the current requirements relevant to your situation. This guide is a learning resource, not a contract-specific or assessment determination.
Learn how assets and external services fit into the environment
Build on this guide with a connected concept, then explain how the two ideas fit together.
Continue learningWhen the concept becomes a practical question
Use the responsibility questions to evaluate the intended role of readiness software, without assuming that buying a tool establishes an implemented outcome.
Explore CMMC Pulsar as a readiness software exampleSelf-checks are educational reflection activities. They do not confer a credential, demonstrate compliance, or establish certification. Read our editorial approach.