Open source ERP for defense contractors under CMMC

The assessor expects a documented, current system security plan plus artifacts that show each in-scope control is implemented and operating. For an ERP inside the boundary, that means the system security plan, role and access exports, MFA settings, audit log samples, change tickets, encryption configuration, backup and media records, and the SPRS score support file. A requirement is MET only when all applicable assessment objectives in NIST SP 800-171A are satisfied with evidence in final form, not drafts. Under 32 CFR 170.16 and 170.17, the assessor tests the evidence against those objectives, so every artifact should show the control in operation with a date and an owner.

The system security plan describes the ERP's boundary, the data types it holds, every component inside and connected to it, the people and roles who administer it, and how each Level 2 requirement is implemented. For a self-hosted Odoo Community or ERPNext deployment, list the application servers, database, reverse proxy, backup target, identity provider, email relay and any integration endpoints that carry controlled unclassified information. The plan should name the owner of each control and point to the artifact that proves it. Keep it under version control with an approval record, because an assessor will check that it matches the running system.

Role exports show who can see and change CUI such as drawings, orders and contract records, and they show whether duties are separated. Export the user list, the groups or roles assigned to each user, and the record-level and field-level rules that restrict CUI. Pair each export with an access review record showing a named approver, the review date and any removals. In Odoo, access rights and record rules are configured in the system; in ERPNext, roles and user permissions do the same job. Confirm the exact export method for your version with the vendor documentation and your implementation partner, since the report format differs between releases.

The assessor reviews evidence that multi-factor authentication is enforced for every user who can reach the ERP, including administrators and remote users. Useful artifacts are the identity provider policy for the ERP application, a list of enrolled factors per account, the configuration showing whether single sign-on is required, and a sample login record showing the second factor being used. If the ERP has a local login path, show how that path is restricted or disabled. Document any service or API accounts separately, with the reason they cannot use interactive MFA and the compensating control you have chosen.

Audit log samples show that the ERP records who accessed, changed or exported controlled records, when it happened, and from where. Provide a sample of log entries for logins, failed logins, role changes, record views of CUI, exports and administrative configuration changes, with a description of the fields captured. Show where logs are forwarded and how they are protected from alteration, including the retention period you have set. Log configuration is only convincing when you can also show that someone reviews the logs, so keep a record of periodic reviews and what was done with the findings. Confirm the list of loggable events for your ERP version with the vendor documentation before you finalize the sample.

Change tickets show that every custom module, configuration change and code deployment was requested, reviewed, tested and approved before it reached production. Keep one ticket per change with the requester, the reviewer, the test evidence, the approval, the deployment date and a rollback note. Custom Odoo modules and ERPNext apps should be traced from the repository commit to the deployed version, so the assessor can match what runs in production to what was approved. Good ticket records also show who could deploy, which supports the separation between developers and production administrators.

The assessor looks for evidence that CUI is protected in transit and at rest, and that backups and media holding CUI are handled under controlled procedures. Gather the TLS configuration for the web and API endpoints, the database and file storage encryption settings, the key management records, and the backup schedule with encryption status. Add media handling records covering how backup media is labeled, stored, transported and sanitized or destroyed, and a restore test record showing the backups work. Where the hosting provider manages a layer, document the shared responsibility split and request the provider's own evidence for that layer.

SPRS score support is the documentation that backs the score an organization posts to the Supplier Performance Risk System, showing how each requirement was assessed and why it was scored as met or not met. For the ERP, it is the assessment worksheet with each requirement ID, its status, the artifact that supports it and the owner who attests to it. Under the current rule, Phase I self-assessments and SPRS postings remain in place, and the Department of War has said it will enforce NIST SP 800-171 Rev. 2 in the interim. Confirm with your contracting officer and counsel which posting and affirmation steps apply to your contracts, because the assessment obligations have changed in 2026.

The boundary is the main cost driver: how many users, integrations, endpoints and data stores touch controlled unclassified information (CUI). Each of these must be inside the assessed scope or separated from it. Cost components include the time of your security and IT staff, any hardware or cloud resources for an isolated environment, licensing for security tooling such as logging and multi-factor authentication, and external help for design and evidence preparation. Costs that recur include log storage, access reviews, patching and annual affirmations. Ask any partner for a written scope listing systems, data flows and assumptions, because that scope determines the quote.

A supplier with strong in-house security and ERP engineers can do much of the work itself, but the requirements are demanding. NIST SP 800-171 Rev. 2 contains 110 requirements, and each one needs evidence in final form, not drafts. The work covers access control, audit logging, configuration management, incident response and media protection, along with documented policies and system security plans. Teams without experience in both ERP administration and federal assessment methods often underestimate the effort on evidence. A partner can share the workload, but accountability for the controls and the assessment remains with your organization.

No duration can be stated from the sources used here, so treat any timeline you receive with caution. Preparation length depends on how many systems hold CUI, how mature your existing controls are, whether the ERP is self-hosted or cloud-based, and how much history must be re-documented. Ask a partner to break the schedule into boundary definition, control implementation, evidence collection and a internal readiness review, and to state which steps depend on your staff's availability. Confirm the timeline against the assessment rules your contracts reference, since those rules are also changing.

The work needs both teams to own specific parts of the boundary. Security staff define the CUI data flows, own access control, multi-factor authentication, audit log review and incident response. Finance and operations staff identify which orders, drawings and contract records contain CUI, approve role design for segregation of duties and validate that reports and records still reflect the business. Expect regular working sessions to review role matrices and configuration changes. Ask your partner to name a single accountable owner on each side, because unclear ownership is a common reason evidence arrives late.

Yes, the hosting model changes who is responsible for which controls, although it does not remove any requirement. With self-hosting in your own cloud account or data center, your organization controls the operating system, network, logs and backups, so it must implement and evidence those controls directly. A cloud ERP service may cover some infrastructure controls, but the provider's responsibilities must be documented, and the service must meet the requirements that apply to external service providers handling CUI. Confirm with the provider and your assessor how responsibilities are split before you choose a hosting model.

Not safely for systems that already hold CUI. The Department of War suspended CMMC Phase II on 13 July 2026, and a 60-day review by a CMMC Reform Task Force followed. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The Department of War also said it will enforce NIST SP 800-171 Rev. 2 in the interim, and a DoW class deviation signed 3 September 2026 directs contracting officers to name Rev. 2 explicitly. Confirm your current obligations with your contracting officer, because the rules are still changing.

Assessors review evidence against the assessment objectives in NIST SP 800-171A, so the ERP must produce records that show each objective is met. Typical items include a current system security plan, a network and data flow diagram that shows where CUI enters and leaves the ERP, role and permission exports, access review records, audit log samples with retention settings, change records for configuration and customization, backup and restore tests, and incident response records. Evidence must be final and dated. Ask your partner to map each item to the requirement it supports before work starts.

The highest-risk areas are the ones where CUI can be exported, copied or viewed by people without a need to know. Check document attachments for drawings, the reporting and export functions, API access and integrations with CAD, PLM or shipping tools, and any add-on modules or custom code. Also review administrator accounts, backup copies and development or test environments, which often contain production data. Confirm which Odoo edition or ERPNext release supports the logging, authentication and hosting options you need, since features differ by edition.