We are currently working through CMMC compliance and evaluating how Acumatica fits within our environment.
For organizations subject to CMMC requirements, particularly those handling CUI, how have you addressed Acumatica? Specifically:
- Are you allowing CUI to be stored or processed within Acumatica?
- If so, how have you addressed the applicable CMMC/NIST SP 800-171 requirements and FedRAMP considerations?
- If not, have you established policies or technical controls that keep CUI out of Acumatica and therefore outside that portion of your CMMC scope?
- Are you using Acumatica SaaS, private cloud, or another deployment model?
- Have you successfully gone through a CMMC assessment with Acumatica somewhere in the environment?
I’d particularly appreciate hearing from other government contractors who have already worked through this with an assessor/C3PAO.
Thank you!