You are a Managed Service Provider, and a client calls asking about CMMC. They are moving toward defense work and will need to prove that they're compliant to get started.

For an MSP,  this is a nightmare scenario.

Your answer may be some version of "that's not really what we do," to which the client seeks a provider who does. 

If that sounds familiar, we have a better solution!