CMiC

Construction ERP software

Enterprise evidence

Insufficient enterprise evidence

Public information covers sso & provisioning, access controls. Still unresolved: security assurance, auditability, data handling.

8 official sources · Fresh page review · Not independently tested

Sources reviewed 2026-10-16

2 / 7 areas with published evidence · 0 independently verified

Evidence & checks

Security assuranceNeeds clarification

## SOC 2 AuditReviewed 2026-10-16View source

CMiC’s SOC 2 compliance demonstrates our commitment to maintaining effective controls related to security, availability, and confidentiality.Reviewed 2026-10-16View source

Before relying on it
Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.

SSO & provisioningCompany-published

Once the user has accepted the invitation, end users will enjoy a single sign on experience (using their corporate identity).Reviewed 2026-10-16View source

We can accommodate any identity provider that supports SAML 2.0.Reviewed 2026-10-16View source

Before relying on it
Test SSO enforcement, user removal and privileged-account recovery.

Access controlsCompany-published

CMiC API Security enforces endpoint-level authorization using role-based access control (RBAC).Reviewed 2026-10-16View source

Before relying on it
Test least-privilege roles and cross-tenant access with separate test accounts.

AuditabilityNot found

Before relying on it
Verify administrative and data-access events, retention and export.

Data handlingNot found

Before relying on it
Review DPA, subprocessors, retention, deletion, residency and AI training use.

Reliability & supportNot found

Before relying on it
Request SLA, incident history, recovery targets and support escalation terms.

Product effectivenessNot found

Before relying on it
Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.

Published claims are not verified controls. No hands-on performance or security testing has been performed.

What we know

Used by GGC National Contractors for financial and project management including change management; handles over $100B in revenue annually.

Worth asking

How does the platform balance its broad ERP scope with the specialized needs of field-level change management?

Sources

Evidence details

Enterprise controls

Enterprise claims found; security controls are unconfirmed.

Developer access

To learn more on setting up API Security, go to [CMiC API Access Setup](https://docs.cmicglobal.com/portal/Content/E_Reference_Material/CMiC_API_Access_Setup/Reference/API_Access_Setup/Overview.htm) CMiC API Security enforces endpoint-level authorization using role-based access control (RBAC) After an identity is authenticated, this layer determines which API endpoints and methods (Create, Update, Retrieve, Delete) the user or application is allowed to execute

Last checked Oct 16, 2026

Company-published evidence, not an independent audit. Unknown means unverified.