# CMiC

Construction ERP software

Research: https://www.safecli.org/company/cmicglobal.com
Company: https://cmicglobal.com

## Evidence status

Insufficient enterprise evidence
Source review: 2026-10-16T03:30:09.380Z
API: Public API

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Needs clarification

> ## SOC 2 Audit

Source: https://cmicglobal.com/trust-center
Reviewed: 2026-10-16T03:30:09.380Z

> CMiC’s SOC 2 compliance demonstrates our commitment to maintaining effective controls related to security, availability, and confidentiality.

Source: https://cmicglobal.com/trust-center
Reviewed: 2026-10-16T03:30:09.380Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Company-published

> Once the user has accepted the invitation, end users will enjoy a single sign on experience (using their corporate identity).

Source: https://docs.cmicglobal.com/portal/Content/E_Reference_Material/System_Administration/Reference/CMiC_SSO/CMiC_SSO_Authentication.htm
Reviewed: 2026-10-16T03:30:09.380Z

> We can accommodate any identity provider that supports SAML 2.0.

Source: https://docs.cmicglobal.com/portal/Content/E_Reference_Material/System_Administration/Reference/CMiC_SSO/CMiC_SSO_Authentication.htm
Reviewed: 2026-10-16T03:30:09.380Z

- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Company-published

> CMiC API Security enforces endpoint-level authorization using role-based access control (RBAC).

Source: https://developers.cmicglobal.com/docs/authentication
Reviewed: 2026-10-16T03:30:09.380Z

- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Not found


- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Not found


- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Not found


- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: