--- title: "CMMC: What can a software vendor do for you?" description: What is CMMC Compliance and how can a software vendor, like SYMPAQ, get you prepared for the hurdles that may lie ahead? image: https://sql.sympaq.com/hubfs/CMMC%20blog.png --- [Contact: 800-437-8151](tel:18004378151) [Help Desk](https://aldebaron.assist.com/portal) [![DCAA Compliant Accounting System | SYMPAQ](https://sql.sympaq.com/hubfs/crop-trans-logo.png "Government Contract Cost Accounting")Project Cost Accounting Software for Government Contractors](https://www.sympaq.com/) - [PRODUCTS](https://www.sympaq.com/) - [SYMPAQ Accounting](https://www.sympaq.com/sympaq-sql/) - [SYMPAQ Time & Expense](https://www.sympaq.com/sympaq-etx/) - [SYMPAQ DEMOS](https://www.sympaq.com/demos/) - [PRICING](https://www.sympaq.com/sympaq-pricing/) - [SERVICES](https://www.sympaq.com/services/) - [AUDITS](https://www.sympaq.com/dcaa-audits/) - [DCAA Audits](https://www.sympaq.com/dcaa-audits/) - [Single Audits](https://www.sympaq.com/a-133-audits/) - [RESOURCES](https://www.sympaq.com/#) - [Events / Webinars](https://www.sympaq.com/events-schedule/) - [SYMPAQ Demos](https://www.sympaq.com/demos/) - [Useful Links](https://www.sympaq.com/useful-links/) - [BLOG](https://sql.sympaq.com/blog) [![REQUEST DEMO](https://no-cache.hubspot.com/cta/default/2695973/fa292e59-f01d-4acf-b907-53fc989efa07.png)](https://cta-redirect.hubspot.com/cta/redirect/2695973/fa292e59-f01d-4acf-b907-53fc989efa07) [![DCAA Compliant Accounting System | SYMPAQ](https://sql.sympaq.com/hubfs/crop-trans-logo.png "Government Contract Cost Accounting")Project Cost Accounting Software for Government Contractors](https://www.sympaq.com/) - [PRODUCTS](https://www.sympaq.com/) - [SYMPAQ Accounting](https://www.sympaq.com/sympaq-sql/) - [SYMPAQ Time & Expense](https://www.sympaq.com/sympaq-etx/) - [SYMPAQ DEMOS](https://www.sympaq.com/demos/) - [PRICING](https://www.sympaq.com/sympaq-pricing/) - [SERVICES](https://www.sympaq.com/services/) - [AUDITS](https://www.sympaq.com/dcaa-audits/) - [DCAA Audits](https://www.sympaq.com/dcaa-audits/) - [Single Audits](https://www.sympaq.com/a-133-audits/) - [RESOURCES](https://www.sympaq.com/#) - [Events / Webinars](https://www.sympaq.com/events-schedule/) - [SYMPAQ Demos](https://www.sympaq.com/demos/) - [Useful Links](https://www.sympaq.com/useful-links/) - [BLOG](https://sql.sympaq.com/blog) [![REQUEST DEMO](https://no-cache.hubspot.com/cta/default/2695973/fa292e59-f01d-4acf-b907-53fc989efa07.png)](https://cta-redirect.hubspot.com/cta/redirect/2695973/fa292e59-f01d-4acf-b907-53fc989efa07) [![DCAA Compliant Accounting System | SYMPAQ](https://sql.sympaq.com/hubfs/crop-trans-logo.png "Government Contract Cost Accounting")Project Cost Accounting Software for Government Contractors](https://www.sympaq.com/) menu close close - PRODUCTS - [SYMPAQ Accounting](https://www.sympaq.com/sympaq-sql/) - [SYMPAQ Time & Expense](https://www.sympaq.com/sympaq-etx/) - [SYMPAQ DEMOS](https://www.sympaq.com/demos/) - [PRICING](https://www.sympaq.com/sympaq-pricing/) - [SERVICES](https://www.sympaq.com/services/) - RESOURCES - [Events / Webinars](https://www.sympaq.com/events-schedule/) - [Useful Links](https://www.sympaq.com/useful-links/) - [BLOG](https://sql.sympaq.com/blog) ## Blog ### Subscribe to our Blog # CMMC: What can a software vendor do for you? [Government Contractor](https://sql.sympaq.com/blog/topic/government-contractor), [Accounting Software](https://sql.sympaq.com/blog/topic/accounting-software), [SYMPAQ Benefits](https://sql.sympaq.com/blog/topic/sympaq-benefits), [Business Tips](https://sql.sympaq.com/blog/topic/business-tips) 02/17/2021 [G. Chris Brown](https://sql.sympaq.com/blog/author/cbrown) ![Software Security](https://sql.sympaq.com/hs-fs/hubfs/CMMC%20blog.png?width=231&name=CMMC%20blog.png)Unless you have been totally focused on other world events in recent months and haven't been paying attention, as a government contractor you probably have heard about [Cyber Maturity Model Certification](https://www.acq.osd.mil/cmmc/) compliance or CMMC. If you're a finance professional, you are probably a bit perplexed by the different requirements and levels (i.e., 1 through 5) and may be fortunate enough to have an individual other than yourself either inside or outside of your company available to help you to meet the extensive certification requirements.  I have fielded several calls from concerned clients in recent months on this topic, and the question that is commonly asked of me is what is it that we can do in order to make CMMC a reality with respect to our hosted cost accounting software offering? The truth is that a software vendor engaged in hosting your applications can help you to meet a limited number of security controls (of which there are many) since most of the processes and controls are the direct responsibility of the contractor. Best practices such as staff "Awareness and Training" and "Personnel Security" involve your people and your [internal controls](https://sql.sympaq.com/blog/your-internal-controls-speed-bumps-guardrails-and-stop-signs). For example, who within your organization determines who among your staff can access certain information technology systems? While all of your staff members may have access to your [time and expense entry](https://www.sympaq.com/sympaq-etx/), a smaller number of individuals will likely be permitted access to your financial system. Achieving Level 1 and Level 2 of CMMC mostly centers around establishing and then documenting your cybersecurity practices, policies and procedures. A good starting point would be to review [FAR 52.204-21](https://www.acquisition.gov/far/52.204-21-0) and NIST SP 800-171 with its guidelines for protecting [Controlled Unclassified Information](https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) (CUI). As you will see, these processes have much to do with limiting internal access to your information technology systems and not as much to do with software that is being accessed.   Now, where your hosted software vendor comes in is by providing a highly secure IT platform that encompasses the practices set forth in achieving what is referred to under CMMC as "Good Cyber Hygiene". These practices include, but are not limited to: - - Providing multi-factor (MFA) authentication for login security  - Creating data backups on a nightly basis with data at rest encryption - Storing data backups in a secure location outside of the network - Applying Operating System and database software updates (patches) on a regular (at least monthly) frequency - Installing Anti-Malware software within the network  - Having a  recovery plan in place to restore your computing environment in a manner of hours. A question that is frequently asked is, "Where exactly is my data stored?". In turns that the aim of this question is less about where data is stored geographically and more about the security of the data center itself. Data centers, such as the Microsoft Azure platform that we primarily use for our hosted networks, are regularly audited for Service Organization Controls (SOC) by third-party auditing teams. The results of these audits are provided in the periodic SOC [audit](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=ce5bfbea-3514-40ae-a8a6-3617106a0b56&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_SOC_%2F_SSAE_16_Reports)[reports](https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3?command=Download&downloadType=Document&downloadId=ce5bfbea-3514-40ae-a8a6-3617106a0b56&tab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb&docTab=7027ead0-3d6b-11e9-b9e1-290b1eb4cdeb_SOC_%2F_SSAE_16_Reports). This represents an ongoing audit process that data centers must undergo in order to determine whether best practices are being observed and, if not, where corrections and improvements must be made. In addition to the above we - as your trusted hosted software vendor - continually strive to keep up with the latest in cybersecurity best practices and will continue to invest in making our hosted infrastructure as secure as possible. What keeps us up at night should not keep our clients up at night!  ### Recent Blogs February, 07 2025 ## [Strong Headwinds Ahead for Federal Government Contractors in 2025](https://sql.sympaq.com/blog/5-challenges-federal-government-contracting-0) [Government Contractor](https://sql.sympaq.com/blog/topic/government-contractor) [Accounting Software](https://sql.sympaq.com/blog/topic/accounting-software) [SYMPAQ Benefits](https://sql.sympaq.com/blog/topic/sympaq-benefits) [Business Tips](https://sql.sympaq.com/blog/topic/business-tips) [Headwinds](https://sql.sympaq.com/blog/topic/headwinds) Poised to bid on contracts with the Federal Government? you will likely encounter challenges with procurement regulations and bureaucracy.[ Read the Blog](https://sql.sympaq.com/blog/5-challenges-federal-government-contracting-0) 0 Comments [Click here to read/write comments](https://sql.sympaq.com/blog/5-challenges-federal-government-contracting-0#comments-listing) January, 10 2025 ## [End of Year Tax Form Filing Has Never Been Easier!](https://sql.sympaq.com/blog/end-of-year-tax-form-filing-has-never-been-easier) [tax](https://sql.sympaq.com/blog/topic/tax) [2024](https://sql.sympaq.com/blog/topic/2024) As we learned last year when the paper filing threshold dropped from 250 for each tax form to 10 tax forms in aggregate (i.e., 1099-NEC plus 1099-Misc plus W2), one should no longer be contemplating t\[...\][ Read the Blog](https://sql.sympaq.com/blog/end-of-year-tax-form-filing-has-never-been-easier) 0 Comments [Click here to read/write comments](https://sql.sympaq.com/blog/end-of-year-tax-form-filing-has-never-been-easier#comments-listing) December, 04 2024 ## [Another Year, Another End-of-Year Update](https://sql.sympaq.com/blog/2024-year-end-of-year-update) [2024](https://sql.sympaq.com/blog/topic/2024) One thing we've learned over the years as a software publisher is that unless you are planning on sunsetting a legacy application, you are never "done" with development.[ Read the Blog](https://sql.sympaq.com/blog/2024-year-end-of-year-update) 0 Comments [Click here to read/write comments](https://sql.sympaq.com/blog/2024-year-end-of-year-update#comments-listing) ![](https://sql.sympaq.com/hs-fs/hubfs/crop-trans-logo.png?width=200&name=crop-trans-logo.png) We are focused on delivering reliable cost accounting, timekeeping and expense reporting solutions to labor-intensive federal government contractors and not-for-profit organizations in search of fully compliant, standards-based, project accounting software. ### Get In Touch [contact@sympaq.com](mailto:contact@sympaq.com) Local phone:[(301) 670-0858](tel:3016700858) Fax: (301) 840-1591 15839 Crabbs Branch Way, Rockville, MD 20855. [Privacy Policy](https://www.sympaq.com/privacy-policy/) [Cookie Policy](https://www.sympaq.com/cookie-policy/) [Terms & Conditions](https://www.sympaq.com/terms-and-conditions/) ### Subscribe to Our Blog Get the latest business resources on the market delivered to your inbox. Copyright © 2023 Aldebaron, Inc. All rights reserved. Website by [IMGdigitalAgency.com](https://www.imgdigitalagency.com/) [![](https://sql.sympaq.com/hubfs/blue-seal-bbb.png)](https://www.bbb.org/us/md/rockville/profile/computer-software-developers/sympaq-0241-236013238#sealclick) ![](https://px.ads.linkedin.com/collect/?pid=1997524&fmt=gif) × ### Speak to a Specialist Find out how SYMPAQ makes DCAA compliance a breeze. Fill out the form below to speak with a SYMPAQ team member. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "G. Chris Brown", "url" : "https://sql.sympaq.com/blog/author/cbrown" }, "dateModified" : "2021-02-17T14:30:00.523Z", "datePublished" : "2021-02-17T14:30:00.000Z", "headline" : "CMMC: What can a software vendor do for you?", "image" : [ "https://sql.sympaq.com/hubfs/CMMC%20blog.png" ], "mainEntityOfPage" : { "@id" : "https://sql.sympaq.com/blog/cmmc-compliance-what-can-a-software-vendor-do-for-you", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://sql.sympaq.com/hubfs/logo-2.png" }, "name" : "Aldebaron, Inc." } } ``` ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "G. Chris Brown" }, "dateModified" : "February 17, 2021, 2:30:00 PM", "datePublished" : "2021-02-17 14:30:00", "description" : "What is CMMC Compliance and how can a software vendor, like SYMPAQ, get you prepared for the hurdles that may lie ahead? ", "headline" : "CMMC: What can a software vendor do for you?", "image" : { "@type" : "ImageObject", "url" : "https://sql.sympaq.com/hubfs/CMMC%20blog.png" }, "mainEntityOfPage" : { "@id" : "https://sql.sympaq.com/blog/cmmc-compliance-what-can-a-software-vendor-do-for-you", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "http://sql.sympaq.com/hubfs/sympaqlogo.png" }, "name" : "SYMPAQ" } } ```