Hi, We need to replace our accounting program - but we're also on our CMMC Level 2 journey and don't want to go down the wrong road.

We're considering Sage's Intacct cloud-based system, but we're not comfortable with the answers we're getting about the applicability to our needs. We are not expecting to process/transmit/store CUI within the program, but obviously it will contain FCI.

Sage offers numerous citations on their website about their security certifications; they mention NIST framework. No hits are found searching FedRAMP Marketplace. When asked about FedRAMP authorization, a Sage salesperson said, "No." Security professionals I've pinged thought it odd if they weren't FedRAMP authorized.

Thoughts?

Thank you!