CMMC MSP Partner Program and PAM Reseller Margins
Managed Service Providers (MSPs), resellers, and value-added resellers (VARs) search for a Cybersecurity Maturity Model Certification (CMMC) partner program and a Privileged Access Management (PAM) reseller program that pays on renewals, does not take the services work, and answers the phone. This page compares Analog Informatics Corporation (AIC) partner economics with the published partner programs of CyberArk, Delinea, BeyondTrust, PreVeil, Exostar, FutureFeed, and Vanta.
AIC expects an MSP to bill more than four times the AIC subscription in services on a typical CMMC Level 2 customer. The software discount is the smaller half of the practice. The services stay with the partner.
Why MSPs, resellers, and VARs choose AIC
- Services stay with you. AIC licenses software. AIC does not sell managed CMMC, gap assessments, System Security Plan (SSP) writing, or assessment support against the partner. The customer grants the partner scoped, revocable administrative access inside the customer boundary.
- More than 4x the subscription in services. On a Level 2 kit at $19,800 for Year 1, AIC expects partner services to exceed $79,200. Scoping, gap work, remediation, documentation, training cycles, assessment support, and monthly operation are the partner's invoice.
- Published software discount, including renewals. On-premises Year 1 is 30 percent when the opportunity is registered in advance, or 20 percent if it is not. Later years stay at 20 percent when the partner remains registered and bills the customer. Cloud Marketplace influence is 10 percent in Year 1 and 5 percent later. The same rates apply to MSPs and resellers. Competitive Switch Credit orders are the exception: no software commission and no prepay discount. Partners bill services on the switch. Later-year software compensation follows the Fee Schedule when the Partner of Record registers the renewal.
- Competitive Switch Credit is a services motion. AIC credits unused prepaid Competitor remaining term against Year 1 so the customer can move. Partners do not earn software commissions on that order. The practice revenue is implementation, gap work, documentation, training cycles, assessment support, and monthly operation.
- Support from the people who build it. Unlimited partner support requests at no charge, with escalation to the engineers who write the product. Not a ticket queue that stops at a first-line desk.
- Partners and customers guide the roadmap. Features we do not have yet are marked Planned and built in the order partners and customers ask for them.
- One kit to learn and operate. Privileged Identity Management (PIM), Privileged Access Management (PAM), Privileged User Management (PUM), configuration compliance, training and attestation, and the Assessment Binder in one console. The same kit structure at every customer.
- A team that already works with services delivery. AIC developers and support engineers have built standard security software for enterprises, government, Defense Industrial Base (DIB) suppliers, and the Intelligence Community since 1993. Partners who delivered those programs already know the people.
- Not-for-resale (NFR) Level 2. Registered partners run a full Level 2 kit for internal use, demos, and labs at no charge.
Scorecard layout (At a Glance columns and a Winner per published row): Partner program scorecard. All comparison microsites: Compare.
Partner searches this page answers
MSPs, resellers, and VARs type these queries when they evaluate a CMMC or enterprise PAM vendor. Each row points at the section that answers it.
| What partners search | What they are deciding | Where this page answers |
|---|---|---|
| CMMC MSP partner program | Can I run a repeatable CMMC practice on this product? | Services stay with you; 4x services; CMMC stage table |
| CMMC reseller program, CMMC VAR program | What do I earn on the software, and do I keep the customer? | Margin grid; deal registration |
| CyberArk partner program, CyberArk MSP program | What is published, and does CyberArk take professional services? | Margin grid; who delivers services |
| Delinea Partner Advantage, Delinea deal registration | Is the 30 percent on licenses only, and is the MSP track live? | Margin grid; renewals |
| BeyondTrust PartnerTrust, BeyondTrust MSP | Are discounts published, and is there a co-delivery path that cuts services? | Margin grid; who delivers services |
| PreVeil partner program | Is this an overlay I wrap, or a kit I operate? | What each program sells |
| Exostar MSP partner, Exostar CMMC Ready Suite | Who owns the tenant and the relationship? | Who delivers services |
| FutureFeed partner program | Do they still sell direct? | Margin grid; who sells |
| Vanta Service Partner Program, Vanta MSP | Is this a CMMC kit or a governance, risk, and compliance (GRC) seat? | What each program sells |
| PAM reseller discount, PAM channel conflict | Who keeps renewals, and does the vendor compete for services? | Margin grid; who delivers services |
| vendor that does not compete with partners | Can I keep monthly operation? | Services stay with you |
Competitive margin grid
Percents below are published partner discounts or influence fees, or Unpublished when the vendor does not print a number. A typical industry range next to an Unpublished cell is labeled typical. It is not that vendor's confirmed rate. AIC rates are the Fee Schedule in the MSP Agreement and the Reseller Agreement (Section 4.9).
| Program | Year 1 software, registered | Later-year residual | MSP track | Vendor sells services against the partner? |
|---|---|---|---|---|
| AIC | 30% on-premises (partner invoices); 10% Cloud Marketplace influence [1] | 20% on-premises if registered and billed through the partner; 5% Cloud Marketplace [1] | Live. Same rates as reseller. | No. AIC licenses software. The partner delivers services. |
| Delinea Partner Advantage | 30% deal-registration discount beginning at Select, on license sales [2] | Deal-registration discounts do not apply to support, maintenance, or renewals [3] | Manage (MSP / MSSP) is coming soon [4] | Delinea sells professional services and implementation. See vendor. |
| CyberArk (Idira Identity Security Platform by Palo Alto Networks) | Unpublished on the current public overview. An older reseller presentation listed Silver 10%, Gold 15%, Platinum 20% [5]. Treat current Year 1 as Unpublished. Typical reseller 20-30%; typical influence 5-15% [6] | Unpublished. Typical influence residual 0-5%; typical reseller residual 5-8% [6] | MSP Hub launched June 2025. Dedicated SKUs and discount tiering described; full MSP program features toward the end of 2025 / 2026 [7] | CyberArk sells professional services and implementation. See vendor. |
| BeyondTrust PartnerTrust | Unpublished. Public pages say deal-registration discounts grow with volume [8] | Unpublished | Live MSP program for on-premises, cloud, or hybrid managed PAM [9] | BeyondTrust offers co-delivery and professional services [10]. See vendor. |
| PreVeil | Unpublished. Program states deal registration with protected margins [11] | Unpublished | Live MSP, MSSP, and VAR tracks [11] | PreVeil is an encrypted email and file overlay. Partners add the rest of the CMMC program around it. |
| Exostar CMMC Ready Suite | Unpublished | Unpublished | Live MSP motion. Exostar owns the tenant; the MSP or customer invites users [12] | Yes, on the managed tenant. Exostar manages the compliant environment. The MSP is not the landlord of the stack. |
| FutureFeed | Unpublished. Registered membership is free [13] | Unpublished | Powered-by-FutureFeed for partners who manage 10 or more clients [14] | FutureFeed still sells direct and reserves the right to route inbound inquiries as it sees fit [13] |
| Vanta Service Partner Program | Unpublished. Program states partners capture margins through discounts on resold products [15] | Unpublished | Live MSP / vCISO / MSSP program with multi-tenant console and NFR licenses [16] | Vanta is a GRC and trust platform. It does not replace privileged access or a CUI enclave. Partners package services around it. |
How to read the grid
- Delinea's 30 percent is a license discount, not a renewal residual. The deal-registration datasheet states that those discounts do not apply to support, maintenance, or renewals [3]. AIC pays 20 percent on later years when the partner stays registered and bills the customer [1].
- CyberArk and BeyondTrust do not publish a current percent on the pages we collected. Do not treat an older reseller PDF or a typical industry range as that vendor's current card.
- Exostar's MSP motion keeps the tenant with Exostar [12]. That is a different practice from operating AIC inside the customer's boundary.
- Marketplace influence is not a reseller sale. AIC Cloud Marketplace is 10 percent Year 1 and 5 percent later [1]. That is the influence check, not the on-premises 30 / 20 percent card.
What 4x the subscription looks like
AIC list prices are the CMMC price list dated October 9, 2026. The services column is the partner's invoice, not AIC's. Figures are an example for a 25-user, 25-system Level 2 customer. Partners set their own rates.
| Line | Who bills it | Year 1 example |
|---|---|---|
| AIC CMMC Level 2 software (25 systems, 25 users) | Partner (on-premises) or AIC (marketplace) | $19,800 |
| Partner software compensation, on-premises, registered | AIC pays the partner | $5,940 (30% of $19,800) |
| Scoping and gap assessment | Partner | $15,000 |
| Remediation and documentation (SSP, Plan of Action and Milestones) | Partner | $20,000 |
| Workforce training cycles and attestation support | Partner | $8,000 |
| Assessment support (read-only binder, evidence walks) | Partner | $10,000 |
| Monthly operation, $4,000 per month | Partner | $48,000 |
| Partner services total | Partner | $101,000 |
| Services as a multiple of the AIC subscription | 5.1x |
A partner who bills $4,000 per month for operation and $31,200 for Year 1 project work still exceeds 4x on the $19,800 subscription, with total services above $79,200. Raise the monthly fee toward the $5,000 to $8,000 range many CMMC MSPs already charge, and the multiple rises. The software discount is extra on ordinary paid orders. On a Competitive Switch Credit order, Year 1 software compensation is $0; the expected services total remains above four times the subscription.
| AIC package | Year 1 software | Expected services |
|---|---|---|
| Level 1 | $1,788 | $7,152 |
| Level 2 compliance tracking | $1,428 | $5,712 |
| Level 2 Essentials | $5,988 | $23,952 |
| Level 2 (25 / 25) | $19,800 | More than $79,200 |
| Level 3 (25 / 25) | $63,000 | $252,000 |
| AIC Privileged Access (5 privileged users) | $5,340 | $21,360 |
What each program sells (so the margin is on the right product)
| Program | What the partner resells | What the partner still has to deliver |
|---|---|---|
| AIC CMMC Complete | One Level 1, Level 2, or Level 3 kit: vault, sessions, elevation, configuration compliance, CUI email and files, training, Assessment Binder | Scoping, gap work, remediation, monthly operation, assessment support |
| CyberArk | Privileged access platform. Binder, CUI email, training, and configuration compliance are separate purchases | Those missing pieces, plus CyberArk implementation if the partner does not own it |
| Delinea | Privileged access platform. Same gap as CyberArk on the CMMC kit | Same |
| BeyondTrust | Privileged access platform. Same gap | Same |
| PreVeil | Encrypted email and files, plus a documentation package [17] | Privileged access, configuration compliance, training workflow, live binder evidence |
| Exostar CMMC Ready Suite | A managed Microsoft 365 tenant Exostar owns [12] | User and team administration; the MSP is not the operator of the tenant |
| FutureFeed | CMMC and NIST SP 800-171 GRC tracking [18] | The controls, the enclave, privileged access, and operation |
| Vanta | Trust and GRC automation, including a NIST SP 800-171 / CMMC framework add-on [16] | Privileged access, CUI email and files, configuration compliance with repair |
AIC Level 2 Year 1 is $19,800. The PreVeil stack we priced for 25 users, plus privileged access and tracking, was $54,702. The Exostar stack was $24,702. See CMMC solution comparison.
Who delivers services
| Motion | AIC | Typical named programs |
|---|---|---|
| Who licenses the customer | AIC licenses the customer directly. No sublicense [1] | Resellers often sublicense. AIC does not. |
| Who writes the SSP and runs monthly operation | The partner | Exostar manages the tenant [12]. CyberArk, Delinea, and BeyondTrust sell professional services. FutureFeed still sells direct [13]. |
| Who the customer calls for product defects | AIC engineering, through unlimited partner support | Partner portal plus vendor professional services, depending on the program |
| Who owns the customer relationship | The partner. AIC works with the MSP, reseller, or service provider the customer already uses | Exostar's Ready Suite keeps the compliant environment with Exostar [12] |
Support, roadmap, and a team partners already know
| Partner need | AIC |
|---|---|
| Product support | Unlimited requests at no charge. Escalation to the engineers who build the product |
| Partner enablement | Free training for the partner's staff and its customers. NFR Level 2 for registered partners |
| Roadmap | Partners and customers submit requests. Planned features are built in the order they ask |
| Product quality | One integrated kit instead of a vault plus an overlay plus a GRC seat plus consulting to tie them together |
| Innovation | Configuration compliance with repair, Assessment Binder from live control evidence, and privileged access in the same product the MSP operates |
| History with services delivery | Building cybersecurity software since 1993 for enterprises, government, DIB suppliers, and the Intelligence Community. Partners who delivered those programs already know the AIC team |
CMMC services the MSP keeps
| CMMC stage | MSP service | AIC tool |
|---|---|---|
| Scope | Inventory and scoping workshop | Discovery, system component inventory, scoped roster |
| Gap assessment | Gap report against the requirement set | Current State Compliance (CSC) |
| Remediate | Credential, session, and elevation controls | PIM, PAM, PUM, configuration compliance |
| Document | SSP and Plan of Action and Milestones (POA&M) | Assessment Binder, POA&M items, risk register |
| Train | Workforce training cycles | Training assignments and signed attestations |
| Assess | Assessment support | Read-only assessor access and Binder export |
| Monitor | Monthly operation and reporting | Continuous rescan, alerts, Security Information and Event Management (SIEM) forwarding |
Frequently Asked Questions
What is the CMMC MSP partner program at AIC?
You operate one AIC CMMC Complete kit per customer boundary. You keep scoping, gap work, remediation, documentation, training, assessment support, and monthly operation. AIC licenses the software and supports you. Partner discounts apply on every new sale and every renewal. See Managed Service Providers.
What margin do CMMC resellers and VARs get?
On-premises Year 1 is 30 percent when the deal is registered in advance, or 20 percent if it is not. Later years stay at 20 percent when you remain registered and bill the customer. Cloud Marketplace influence is 10 percent in Year 1 and 5 percent later. MSPs and resellers use the same rates [1].
Does AIC compete with MSPs for services?
No. AIC does not take managed CMMC, implementation, or assessment-support work from the partner. The customer delegates administration to the partner.
How much can an MSP earn on CMMC Level 2?
AIC expects the MSP to receive more than four times the $19,800 Level 2 subscription in services. Actual services revenue depends on the work the partner scopes and bills.
Why would an MSP leave CyberArk, Delinea, or BeyondTrust?
Those platforms are privileged access products. A CMMC Level 2 program still needs configuration compliance, training and attestation, CUI email and files, and a binder the assessor can read. Their published partner cards either omit the current percent, omit renewals (Delinea deal registration [3]), or are still standing up the MSP track (Delinea Manage is coming soon [4]). AIC publishes the residual and does not sell services against you.
Does Delinea's 30 percent beat AIC?
On a new license sale, both print 30 percent for a registered partner [1] [2]. Delinea's 30 percent does not apply to support, maintenance, or renewals [3]. AIC's 20 percent later-year rate does, when you stay registered and bill the customer [1]. The larger number for a CMMC MSP is the services multiple, which stays with you on AIC.
Can I keep selling Microsoft 365 GCC or GCC High?
Yes. AIC Privileged Access adds vault, sessions, elevation, and evidence at $89 per privileged user. See For Microsoft CMMC partners.
What does partner support cost?
Nothing. Standard support is included with unlimited requests for customers and partners.
Help set our roadmap
Partners and customers guide our feature set. If your customers need something we list as Planned, or something we do not list at all, tell us.
Become a partner | Reseller program | Request a demo | All comparisons
Sources and notes
- Analog Informatics Corporation MSP Agreement and Reseller Agreement, Fee Schedule (Section 4.6): Cloud Marketplace 10 percent Year 1 and 5 percent later years; on-premises 30 percent Year 1 if pre-registered, 20 percent Year 1 if not, 20 percent later year if registered and billed through the partner; Provider Direct 10 percent if registered in advance. Same rates for MSP and Reseller. Competitive Switch Credit orders: no software compensation, Influence Fee, or partner discount; later-year software compensation when the Partner of Record registers the renewal. Provider licenses the customer directly. No sublicense. Internal restatement:
docs/go-to-market/contracts/msp/msp-compensation-vs-competitors.md. AIC CMMC list prices: Level 1 $149 per month ($1,788 Year 1), Level 2 $1,650 per month ($19,800 Year 1), Level 3 $5,250 per month ($63,000 Year 1), AIC Privileged Access $89 per privileged user per month ($5,340 for 5 users). Price list dated 2026-10-09. - Delinea Partner Advantage: deal registration 30 percent discount beginning at the Select tier; teaming protections 20 percent at Premier to 25 percent at Elite. https://delinea.com/blog/delineas-partner-program-built-for-the-new-identity-security-challenge-of-ai. Retrieved 2026-10-09.
- Delinea deal-registration datasheet: deal-registration discounts apply on license sales (net new or upsells) and do not apply on support, maintenance, or renewals. https://f.hubspotusercontent10.net/hubfs/19928113/Delinea/partner%20publications/delinea-datasheet-deal-registration-eng.pdf. Retrieved 2026-10-09.
- Delinea partners page: Sell is available now. Manage (MSP / MSSP) is coming soon. https://delinea.com/partners. Retrieved 2026-10-09.
- CyberArk reseller program presentation (distributor copy): Silver 10 percent, Gold 15 percent, Platinum 20 percent basic discount, plus other discounts described as considered by the value-added distributor. https://softprom.com/sites/default/files/materials/Cyber-Ark_PartnerProgram_Resellers.pdf. Retrieved 2026-10-09. This file is not dated as the current 2025-2026 CyberArk Partner Program Overview. Treat current percents as Unpublished unless CyberArk confirms them.
- Typical industry rates when a vendor is Unpublished: referral / influence 5-15 percent of year-1 annual recurring revenue, often 0 after Year 1; reseller 20-30 percent Year 1 and 5-8 percent later if still active. https://channels-as-a-strategy.com/saas-reseller-commission-structure/. Retrieved 2026-10-09. Typical, not a named vendor's confirmed rate.
- CyberArk MSP Hub and MSP-optimized partner program: dedicated SKUs and discount tiering; Channel Insider, June 16, 2025; Business Wire, June 11, 2025 (full MSP program features toward the end of 2025). https://www.channelinsider.com/news-and-trends/cyberark-msp-updates-june-2025/. https://www.businesswire.com/news/home/20250611995990/en/CyberArk-for-MSPs-Enhanced-Console-and-New-Program-Enable-MSPs-to-Build-Differentiated-Converged-Identity-Security-Services. Retrieved 2026-10-09. Current influence and residual percents remain Unpublished on the public overview.
- BeyondTrust enhanced partner program, April 27, 2022: partners realize higher programmatic discounts for deal registration as they grow. No percent published. https://www.beyondtrust.com/press/beyondtrust-enhanced-partner-program-simplifies-incentives-and-enables-partners-to-maximize-profits. Retrieved 2026-10-09.
- BeyondTrust MSP program: on-premises, cloud, or hybrid PAM managed service. https://www.beyondtrust.com/partner/msp. Retrieved 2026-10-09.
- BeyondTrust PartnerTrust enhancements, May 17, 2023: co-delivery program for implementation. https://www.beyondtrust.com/press/beyondtrust-enhances-its-partner-program-to-support-better-enablement-greater-engagement-and-simplified-processes. Retrieved 2026-10-09.
- PreVeil Partner Program announcement: deal registration with protected margins; distinct licensing models for MSPs and VARs. No percent published. https://www.preveil.com/blog/partner-program-announcement/. Retrieved 2026-10-09. Partner network: https://www.preveil.com/partners-network/. Retrieved 2026-10-09.
- Exostar CMMC Ready Suite for MSP partners: Exostar owns the tenant; the customer or MSP invites users and creates teams. https://www.exostar.com/products/cmmc-compliance-with-ready-suite/cmmc-compliance-for-msps/. Retrieved 2026-10-09.
- FutureFeed Partner Program Agreement: registered membership is currently free; the company still entertains requests from the public and sells direct while transitioning; it reserves the right to refer inbound inquiries as it sees fit. https://futurefeed.co/partner-program-agreement/. Retrieved 2026-10-09.
- FutureFeed partners page: Powered-by-FutureFeed for partners who manage 10 or more client relationships. https://futurefeed.co/partners/. Retrieved 2026-10-09.
- Vanta Service Partner Program: partners capture margins through discounts on resold products and packaged offerings. No percent published. https://www.vanta.com/resources/vanta-accelerates-growth-with-new-service-partner-program. Retrieved 2026-10-09.
- Vanta MSP Partner Program: multi-tenant console, complimentary NFR licenses, monthly billing. https://www.businesswire.com/news/home/20230301005504/en/Vanta-Accelerates-Global-Growth-With-New-Managed-Service-Provider-Partner-Program-Launch. Retrieved 2026-10-09. Service providers page: https://www.vanta.com/partners/service-providers. Retrieved 2026-10-09.
- PreVeil Pass, $450 per month for 3 users, 12-month contract paid up front; documentation package. https://www.preveil.com/preveil-pass/. Retrieved 2026-10-09. Feature gaps versus AIC Level 2: PreVeil comparison.
- FutureFeed Innovator, $99 per month, plus the CMMC Level 2 framework at $1,008 per year. https://futurefeed.co/pricing/. Retrieved 2026-10-09.
About this comparison
Competitor information comes from the public sources listed above and was collected on October 9, 2026. Partner discounts, packages, and program tracks change, and a signed partner agreement may quote different rates. This information is not guaranteed to be accurate or complete. Confirm current terms with each vendor before you enroll. Figures marked as typical are industry ranges, not a named vendor's confirmed rate. Figures marked as examples are examples. AIC software prices are list prices from the AIC CMMC price list dated October 9, 2026. AIC partner rates are the Fee Schedule in the MSP Agreement and the Reseller Agreement.
CyberArk, Delinea, BeyondTrust, PreVeil, Exostar, FutureFeed, Vanta, and Microsoft are trademarks of their owners. AIC is not affiliated with or endorsed by them.
An assessment organization, certification body, or regulator decides whether a requirement is satisfied. These pages describe product availability and partner program terms. They are not an assessment result, a certification, or legal advice.