# Costpoint Cloud or On-Prem for a Contractor Handling CUI? > Source: https://netray.co/erp-help/costpoint-cloud-vs-on-prem-cui-hosting-decision > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer Neither choice makes you compliant by itself. The decision turns on whether Costpoint data in your environment is CUI, which authorization or assessment evidence the hosting provider can actually give you, how much of the control set you want to own, and what you plan to connect to the system, including AI. Decide based on scope and evidence, not on a general preference for cloud. ## Kind cio ## System small-erp ## Erp Deltek Costpoint ## Module Hosting / Security Architecture ## Query Costpoint cloud or on-premises for a defense contractor handling CUI ## Alternate Queries - should we move Deltek Costpoint to the cloud CMMC - Costpoint on-prem vs Deltek cloud CUI - Costpoint hosting options defense contractor - Costpoint AI on-prem private data ## Applies To Defense and aerospace contractors on Deltek Costpoint, whether self-hosted or vendor-hosted, with contracts containing DFARS 252.204-7012 and CMMC requirements. This is general guidance, not legal advice. ## Steps ### How to run the decision **Items:** - Determine whether Costpoint holds CUI. Labor, cost and contract data may be sensitive, but CUI status depends on the contract and marking. Ask your contracts and security leads. - Write down the data flows: who accesses Costpoint, from where, and which other systems receive exports or integrations. - Ask any hosting provider for written evidence of the controls and authorizations that apply to your data, and what your own responsibilities are. Do not rely on a marketing page. - Map each NIST SP 800-171 control family to who owns it in each model: you, the hosting provider, or shared. Gaps in ownership are where assessments fail. - Compare total cost over several years, including staffing for patching, backups, monitoring, disaster recovery, and licensing differences. - Evaluate integration needs, such as reporting databases, EDI and AI tools, and whether the hosting model allows them in the way you need. - Pick, document the rationale and the shared-responsibility matrix, and revisit it when contracts, versions or regulations change. ## Sections ### What the decision actually changes **Body:** Moving to a vendor-hosted environment shifts infrastructure operations, patching and much of physical and platform security to the provider. It does not remove your obligations for user access, account management, training, incident response coordination and how your people handle exports. Those stay with you in any model. Self-hosting gives you control over network boundaries, logging, data location and integrations, and it also gives you the full job of patching, backup, monitoring and assessment evidence for the environment. Be honest about whether your IT team has capacity to run that to assessment standard. ### Questions to put to a provider **Body:** Ask where the environment runs and who administers it, whether the provider can support your CUI and DFARS 7012 obligations in writing, how incidents are reported and on what timeline, and what assessment or authorization evidence they will share. Whether the provider is within your assessment boundary changes how much work your own assessor has to do. Also ask about the practical limits: direct database access for reporting, custom extensions, bring-your-own integrations, and release timing. A contractor that depends on ad hoc SQL reporting or local integrations may find a hosted model constraining, while one that mostly uses standard screens may find it freeing. ### Where AI fits into the choice **Body:** If you intend to add AI over Costpoint data, the hosting model affects how. Sending cost and contract data to a public AI service from either model is a boundary decision you must take on purpose and document. Many contractors prefer open-weight models served inside their own boundary so prompts and retrieved data never leave it. That architecture is easier when you control the network, but it is possible in other models if the provider and contract allow it. Settle the AI question before you sign a multi-year hosting commitment, because it may decide what you can connect. ## Pitfalls - Assuming a cloud environment is automatically inside your CMMC boundary without written evidence. - Treating hosting as the whole compliance problem and neglecting user access and training. - Comparing license price only and ignoring the staff time of self-hosting. - Signing a long-term commitment before deciding how reporting and AI will connect. - Not documenting a shared-responsibility matrix, so each side assumes the other owns a control. ## Ai Angle Whichever model you choose, an AI assistant over Costpoint should respect the same boundary as the data. Netray builds ERPray and custom agents so open-weight models run on your own GPUs or in your private or sovereign cloud, read-only by default, with the query shown and Costpoint roles respected. That lets you answer questions on project, funding and rate data without sending it to a public AI service. ## Faq ### Is Costpoint cloud compliant with CMMC? **Answer:** Compliance is assessed for your environment and boundary, not granted by a product name. Ask the provider for written evidence of the controls it covers and which remain yours, and confirm with your assessor how it fits your scope. ### Is on-premises always safer for CUI? **Answer:** Not automatically. On-premises gives you control, and also full responsibility for patching, logging, backups and evidence. A well-run hosted environment can be stronger than an under-staffed self-hosted one. The right answer depends on your team and evidence. ### Can I run AI on a vendor-hosted Costpoint? **Answer:** Often yes, through approved reporting access or APIs, but it depends on what the provider permits. Settle data location, access method and logging with them first, and keep the AI service inside the same boundary as the data where CUI is involved. ### Does the choice affect indirect rate and billing processes? **Answer:** The accounting processes are the same. What changes is who patches the system, how you reach the database for reporting, and how upgrades are scheduled around your year-end and submission deadlines. ## Search terms costpoint cloud vs on-premises, costpoint CUI hosting, costpoint CMMC cloud, deltek costpoint hosting options, DFARS 252.204-7012 ERP, NIST 800-171 costpoint, defense contractor ERP cloud decision, costpoint private AI --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json