Yes, MSPs working with the DoD or its supply chain must be CMMC compliant by October 1, 2026. Organizations should verify if their MSP is compliant or working towards compliance to avoid risking their own compliance.