Is this your company? Buyers are checking Unanet Technologies here. Claim unanet.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Unanet Technologies
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Unanet Technologies is SOC 2 Type II compliant. Unanet Technologies also holds FedRAMP, and GDPR.
About
Unanet is a leading provider of ERP and CRM solutions purpose-built for Government Contractors, AEC, and Professional Services. Project-driven organizations depend on Unanet to turn their information into actionable insights, drive better decision-making, and accelerate business growth. All backed by a people-centered team invested in the success of your projects, people, and financials.
Compliance & infrastructure
Subprocessors
1- UUnanet Subprocessors · Unanet uses Sub-Processors to provide certain infrastructure services, and for o
Compliance leadership
The person who leads Unanet Technologies's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Unanet Technologies's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
Unanet Secures FedRAMP Moderate Equivalency, Elevating Security and Compliance for Government ContractorsJan 2026
Dulles, VA, January 14, 2026 – Unanet, a leading provider in AI-first ERP and growth software for project-based businesses, today announced it has attained FedRAMP Moderate Equivalency for its ERP GovCon solution. This milestone enables government contractors (GovCons) to use Unanet’s FedRAMP Moderate Equivalent ERP solution with confidence under the stringent cybersecurity requirements set by the Federal Risk and Authorization Management Program (FedRAMP) for protecting and managing sensitive information. FedRAMP Moderate Equivalency delivers the same rigorous security controls as FedRAMP Authorization through an independent assessment against the NIST 800-53 controls. This means equivalent protection for sensitive data validated by a Third-Party Assessment Organization (3PAO). Unanet’s FedRAMP Moderate Equivalency is validated through an independent assessment by ControlCase, Unanet’s 3PAO. This process produces a complete FedRAMP documentation package and body of evidence, which supports government contractors seeking CMMC certification and DFARS 252.204-7012 compliance. “ControlCase recognizes Unanet’s achievement of FedRAMP Moderate Equivalency as a testament to their strong commitment to security and compliance. This milestone underscores Unanet’s dedication to providing secure, reliable cloud solutions for the government contracting community,” said Mike Jenner, CEO…
This listing is partial
5/11 details · 45%SOC2C shows the verified essentials. 6 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Unanet Technologies SOC 2 compliant?
Unanet Technologies is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Unanet Technologies FedRAMP compliant?
According to Unanet Technologies's public trust center, Unanet Technologies is FedRAMP compliant. On SOC2C this listing is Listed.
Is Unanet Technologies GDPR compliant?
According to Unanet Technologies's public trust center, Unanet Technologies is GDPR compliant. On SOC2C this listing is Listed.
Is Unanet Technologies SOC 2 Type I or Type II?
Unanet Technologies is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Unanet Technologies's SOC 2 for a vendor risk assessment?
Yes. Unanet Technologies's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Unanet Technologies penetration tested?
Unanet Technologies hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Unanet Technologies secure?
Security isn't a single yes/no, but Unanet Technologies is SOC 2 Type II compliant and holds FedRAMP, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Unanet Technologies have a bug bounty or vulnerability disclosure program?
Unanet Technologies hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@unanet.com or via a /security page (Unanet Technologies lists a security contact).
Who are Unanet Technologies's subprocessors?
Unanet Technologies lists 1 subprocessor on its trust center, including Unanet Subprocessors. Buyers use this for fourth-party risk review.
Where does Unanet Technologies host or store data?
Unanet Technologies's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Where is Unanet Technologies's trust center or security page?
Unanet Technologies's trust center is at https://trust.unanet.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
What is the Cybersecurity Maturity Model Certification (CMMC) 2.0 Program?
The CMMC 2.0 Program is designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that is shared with contractors and subcontractors of the Department of Defense (DoD) through acquisition programs. CMMC requires implementation of a set of security controls and third-party certification to protect FCI and CUI shared with defense contractors and subcontractors during contract performance. DoD published the CMMC final rule on October 15, 2024 and it took effect on December 16, 2024. It is anticipated that DoD contracts will be required to include CMMC compliance clauses by mid-2025. The DoD will use CMMC 2.0 to impose major cybersecurity requirements, assessment requirements, and affirmation requirements on both prime and subcontractors. CMMC 2.0 will require many defense contractors to obtain a third-party certification that they have successfully implemented the cybersecurity controls set forth in the NIST SP 800-171. Going forward, CMMC 2.0 will bar a defense contractor from performing an awarded contract if it has not certified that it is CMMC 2.0 compliant. The requirements at the different levels of compliance may be viewed here.
What is FedRAMP?
The Federal Risk and Authorization Management Program (FedRAMP®) was established in 2011 to provide a cost-effective, risk-based approach for the adoption and use of cloud services by the federal government. FedRAMP empowers agencies to use modern cloud technologies with an emphasis on security and protection of federal information. In December 2022, the FedRAMP Authorization Act was signed as part of the FY23 National Defense Authorization Act (NDAA). The Act codifies the FedRAMP program as the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified federal information. FedRAMP is a government-wide program that promotes the adoption of secure cloud services across the federal government. It outlines a standardized approach to security and risk assessment for cloud technologies and federal agencies. FedRAMP is mandatory for all executive agency cloud deployments and service models at three risk impact levels: Low, Moderate, and High. What this means is that a cloud service provider (CSP) must go through the FedRAMP assessment and authorization process once. After the provider receives authorization for their cloud service offering (CSO), the security package can be reused by any federal agency.
How do FedRAMP and CMMC 2.0 program overlap?
The CMMC 2.0 Program is a DoD program that requires DoD contractors to satisfy a set of security controls and third-party certification to protect FCI and CUI shared with defense contractors and subcontractors during contract performance. The applicability of the CMMC level is determined at the government contractor level based on its relevant contracts and information handled. Defense contractors may be able to streamline their compliance with CMMC by using CSOs that are either FedRAMP equivalent or moderate authorized with agency approval. FedRAMP is a government program that requires a set of security controls for cloud service offerings (CSOs) that process, store, or generate CUI. If your CSO processes, stores, or generates CUI, then the CMMC will likely require the CSO provide a FedRAMP Moderate or Equivalent offering.
What is a FedRAMP Moderate Authorized designation?
This designation signifies that the cloud service offering (CSO) has undergone an assessment conducted by a certified Third-Party Assessment Organization (3PAO) and has been authorized by either the Joint Authorization Board (JAB) or a federal agency. This assessment evaluates security posture and alignment with FedRAMP Moderate security control baseline (NIST SP 800-53).
What is a FedRAMP Moderate Equivalent designation?
This designation signifies that the cloud service offering (CSO) has undergone an assessment conducted by a certified Third-Party Assessment Organization (3PAO) that meets the same security control baseline as FedRAMP Moderate, but through a different process. To achieve this designation, a CSO must achieve 100% compliance with the latest FedRAMP Moderate security control baseline (NIST SP 800-53).
What is CUI?
Controlled Unclassified Information (CUI) is sensitive government data that isn’t classified but still requires strong safeguards. CUI requires safeguarding and dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies. Federal agencies are responsible for marking or identifying any CUI shared with or generated by contractors. Questions regarding the status of information (marked or unmarked) should be directed back to the government contracting agency.
What is FCI?
Federal Contract Information (FCI) is information not intended for public release. FCI is provided by or generated for the federal government under a contract to develop or deliver a product or service.
What is Unanet’s strategy and roadmap to address customer’s CMMC and/or FedRAMP Moderate Authorization requirements?
Unanet has achieved FedRAMP Moderate Equivalency for our GovCon ERP, including AIM, solution identified as FedRAMP Moderate Equivalent Cloud. This means the products in our FedRAMP Moderate Equivalent Cloud meet NIST 800-53 Moderate controls and support customers with CMMC Level 2 and 3 requirements for handling CUI. For specific roadmap discussion please reach out to your CSM.
Do I have CUI in your system?
Controlled Unclassified Information (CUI) is sensitive government data that isn’t classified but still requires strong safeguards. CUI requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies. Federal agencies are responsible for marking or identifying any CUI shared with or expected to be created by government contractors. Questions regarding the status of information (marked or unmarked) should be directed back to the government contracting entity. The contractor should ensure that it understands what levels of CUI it processes and whether it processes that information in a Cloud Service Offering (CSO), such as Unanet, or other third-party system. Customers that want to handle CUI in Unanet’s offerings should use the FedRAMP Moderate Equivalent product.
Do I need to put CUI in your system?
Federal agencies are responsible for marking or identifying any CUI shared with or expected to be created by government contractors. The government contractors are responsible for determining whether they need to put CUI into a Cloud Service Offering (CSO), such as Unanet, or other third-party system, as well as confirming that the CSO or system satisfies all applicable regulatory requirements.
Why will the Unanet FedRAMP Moderate Equivalent Applications have limited integrations compared to the GovCloud or Commercial Applications?
FedRAMP requirements restrict customer data from leaving the FedRAMP Equivalent boundary unless it is going to another Moderate Equivalent or Authorized vendor. Due to these compliance restrictions, all third-party integrations need to be evaluated and audited to be included in our FedRAMP boundary. For more information on our roadmap with respect to specific integrations, please contact your CSM. Unanet is actively bringing more capabilities into the FedRAMP boundary.
How do I continue using the non-FedRAMP Moderate Equivalent Products with my FedRAMP Moderate Equivalent GovCon ERP?
Each customer can choose what products they want to purchase based on their categories of CUI and whether the CUI must be provided to or processed by Unanet. However, FedRAMP Moderate Equivalent cloud products will not initially integrate and connect with the non-FedRAMP products as indicated above. Because each customer’s scenario is unique, we encourage you to contact your customer success manager for additional assistance.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public