Enterprise Resource Planning (ERP) systems act as the central nervous system for many defense contractor operations. They integrate and manage crucial business functions and simplify managing complex projects. From tracking materials and production schedules to managing finances and ensuring regulatory compliance, ERP systems play a vital role in the success of defense contractors.

As CMMC becomes a mandatory requirement for defense contractors in 2025, there’s a growing need for ERP systems to actively support these efforts. This is because ERP systems typically house a wealth of sensitive data, from production plans to intellectual property, often overlapping with Controlled Unclassified Information (CUI) that falls under the scope of CMMC.

While some data segregation might be possible, completely taking the ERP system out of scope for CMMC compliance is often not possible for most organizations. This means organizations need to leverage the security features and functionalities within the ERP system itself to meet the compliance requirements. Additionally, if organizations have or want a cloud-based ERP system, there are additional requirements.

ERP Systems and CMMC Compliance: On-Premise vs. Cloud

Whether you are looking for a new ERP system that will support you in your CMMC compliance efforts, or you are trying to make your current ERP compliant, the first consideration that organizations need to take into account is on-premise vs cloud deployment.

On-Premise

In today’s cloud-centric world, on-premise ERP systems might seem like a relic of the past. However, for organizations seeking CMMC compliance, staying on-premise can offer a potential advantage. You bypass the complexity of ensuring both your ERP system and its underlying cloud platform meet FedRAMP requirements.

The benefit of on-premise ERP systems is they can be treated like any other internal system and avoid additional requirements. Organizations with robust policies backed by technical controls within the ERP (like MFA and access control) are well on their way to CMMC compliance. Additionally, user permissions and nationality restrictions can be applied for export-controlled information. This streamlined approach can simplify the CMMC compliance process for some organizations.

Cloud

Cloud-based ERP systems offer some undeniable benefits but come with a different set of considerations for CMMC compliance.

Any cloud-based application that stores, processes, or transmits CUI data must be at least FedRAMP Moderate authorized. This means organizations must choose a cloud-based ERP solution that is either FedRAMP certified itself or can be independently verified by a third-party assessment organization (3PAO).

Some of the applications that currently meet this requirement can be found on the FedRAMP marketplace here.

Furthermore, the cloud service provider (CSP) hosting the ERP system needs to operate on a FedRAMP-approved cloud environment like AWS GovCloud or Azure Gov. This ensures the underlying infrastructure meets the DFARS requirements.  While this adds an extra layer of complexity to the CMMC compliance process, cloud-based ERP systems can potentially benefit from the robust security features and ongoing compliance efforts of the chosen cloud platform.

Hybrid

In the world of CMMC compliance, some organizations might find a hybrid ERP approach offers the best of both worlds. This strategy segregates data based on sensitivity. CUI can be kept secure within an on-premise ERP system, avoiding the FedRAMP requirements entirely.

Meanwhile, commercial data can be migrated to a cloud-based ERP solution. This allows organizations to leverage the scalability, cost-efficiency, and automatic updates often associated with cloud platforms for non-critical data.

However, implementing a hybrid approach adds complexity to your IT environment and requires careful data segregation strategies to ensure clear lines between CUI and non-sensitive data. Ultimately, the success of a hybrid approach hinges on a thorough understanding of your CMMC requirements and the ability to segregate data and manage a multi-platform environment.

Focusing on SAP and Microsoft Dynamics

Let’s explore how two popular ERP solutions – SAP and Microsoft Dynamics – can be leveraged to achieve CMMC compliance, examining the unique considerations for each platform.

SAP offers a comprehensive suite of modules that can be instrumental in achieving CMMC compliance for defense contractors. Here’s how some key functionalities can be utilized:

• Governance, Risk, and Compliance (GRC): The SAP GRC module allows you to centralize your compliance efforts. It streamlines risk assessments, tracks controls, and automates reporting, providing valuable insights into your CMMC readiness. You can utilize features like access control reviews, incident management, and audit trails to demonstrate a proactive approach to cybersecurity.
• User Access Controls: SAP’s security features enable you to implement granular access permissions based on the principle of least privilege. This ensures users only have access to the data and functionalities they require for their specific roles, minimizing the risk of unauthorized access to sensitive information.
• Firefighter Role: Consider establishing a dedicated “Firefighter” role within your SAP system. This role would have limited access but the ability to override certain controls in emergency situations. This can be crucial for minimizing disruption to critical operations while maintaining an auditable log of such actions for compliance purposes.
• Flagging Military Contract Materials: Utilize SAP’s data classification functionalities to identify and flag materials related to military contracts. This allows you to implement stricter access controls and audit trails for this sensitive data, ensuring it receives the necessary level of protection to comply with CMMC requirements.

With SAP set to stop supporting ECC by the end of 2027, many organizations that haven’t already made the move to S4 will need to keep their compliance requirements in mind during the decision-making process. Like any other ERP system, organizations are going to have to make the decision of on-prem vs cloud.

For organizations that choose to deploy S4 in the cloud, they should consider deploying in a FedRAMP certified cloud environment like:

• NS2: NS2’s FedRAMP-authorized cloud environment and in-country infrastructure address key CMMC requirements like data residency and stringent security controls, simplifying the compliance journey for organizations leveraging SAP’s powerful ERP functionalities.
• AWS GovCloud: AWS GovCloud boasts FedRAMP High certification and infrastructure specifically designed for government agencies, meeting the data residency and security control demands of DFARS.
• Azure Gov: Azure Gov’s FedRAMP High certification and dedicated government infrastructure align with CMMC requirements, while offering a smooth transition for existing Microsoft GCC High users accustomed to the Azure environment and its robust security features.

Microsoft Dynamics (e.g., Dynamics 365):

For organizations already utilizing Microsoft 365 GCC or GCC High, Dynamics 365 emerges as a compelling choice for a CMMC-compliant ERP system. This cloud-based solution seamlessly integrates with your existing M365 GCC High environment, leveraging the same secure backend infrastructure and user access controls.

This not only simplifies deployment and ongoing management, but also fosters a familiar user experience for employees accustomed to the M365 interface. This continuity streamlines the transition to a CMMC-compliant ERP system while maintaining the robust security posture demanded by defense contractors.

Dynamics 365 comes in three versions: Commercial, GCC, and GCC High. Choosing the right version depends on your existing Microsoft 365 environment – if you use M365 GCC, Dynamics 365 GCC is the right choice, while M365 GCC High users should opt for Dynamics 365 GCC High for seamless integration and security alignment.

• Dynamics 365 Commercial: Offers the most comprehensive suite of features and functionalities across various business applications, ideal for organizations prioritizing a wide range of capabilities.
• Dynamics 365 GCC: Provides a secure environment with core functionalities for government agencies and their partners, meeting compliance requirements like FedRAMP High but with a slightly reduced feature set compared to the commercial version.
• Dynamics 365 GCC High: Emphasizes the highest level of security for highly sensitive data. It offers core functionalities for government needs but has a more limited feature set compared to the commercial version, ensuring stricter data residency and control.

For a full list of what Dynamics products are available in the GCC and GCC High clouds download this guide from Microsoft here.

If you are in the market for a new ERP solution and want to ensure CMMC compliance, here are a few things to consider:

• Existing IT Infrastructure: Consider how the new ERP system integrates with your current technology stack.  Look for solutions that offer smooth integration with existing databases, communication tools, and security systems to minimize disruption and ensure data flows seamlessly.
• Scalability Needs: Think about your future growth plans.  Will the ERP system be able to accommodate increased data volume, user base, and business complexity as your organization scales?  Choose a system that’s flexible and adaptable to changing needs.
• Budgetary Constraints: ERP systems can vary significantly in cost.  Factor in upfront licensing fees, implementation costs, ongoing maintenance, and potential training expenses.  Be clear on your budget limitations and choose a solution that offers the best value within your financial constraints.
• Vendor Expertise in CMMC: Select a vendor with a proven track record of supporting CMMC compliance.  Look for vendors who actively stay updated on CMMC requirements and offer implementation services specifically tailored for achieving compliance.
• FedRAMP Certification: For cloud-based ERP systems that will store, process, or transmit Controlled Unclassified Information (CUI) data, prioritize solutions with at least FedRAMP Moderate certification.  This ensures the system operates in a secure, government-approved cloud environment.
• Select a CMMC-Proven Implementation Partner: Beyond the ERP system’s inherent CMMC compliance, choose an implementation partner with deep expertise in CMMC requirements. This ensures the system is configured and deployed to meet your specific security needs for achieving compliance.

By carefully considering these factors, you can select an ERP system that not only meets your business needs but also effectively supports your journey towards achieving CMMC compliance.

If you have any specific questions about your current ERP system or one you are considering, please reach out and we can set up some time to discuss further.