--- title: Security and Compliance for Capital Program Software | CIPAce description: CIPAce is hosted in SSAE18 SOC 2 Type 2 certified datacenters, with role-based access control, audit trails, single sign-on, and vulnerability disclosure. image: https://www.cipplanner.com/hubfs/raw_assets/public/cipplanner-theme/images/og-default.png --- [![CIPPlanner](https://www.cipplanner.com/hs-fs/hubfs/raw_assets/public/cipplanner-theme/images/cipplanner-logo.png?width=180&height=36&name=cipplanner-logo.png)](https://www.cipplanner.com/home?hsLang=en) - Platform - Solutions - Who We Serve - Customers - [Contact](https://www.cipplanner.com/contact?hsLang=en) [Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en) #### The Platform - [CIPAce Platform Overview](https://www.cipplanner.com/platform?hsLang=en) - [AI Core](https://www.cipplanner.com/platform/ai-core?hsLang=en) - [Integrations and APIs](https://www.cipplanner.com/platform/integrations?hsLang=en) - [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) Platform One metadata-driven, low-code platform underneath every solution, so adding a solution is a configuration, not a second system of record. [Explore the CIPAce platform ›](https://www.cipplanner.com/platform?hsLang=en) #### Plan and Deliver - [Capital Planning and Budgeting](https://www.cipplanner.com/solutions/capital-planning-and-budgeting?hsLang=en) - [Capital Program Lifecycle Management](https://www.cipplanner.com/solutions/capital-program-lifecycle-management?hsLang=en) - [Project Schedule and Resource Management](https://www.cipplanner.com/solutions/project-schedule-and-resource-management?hsLang=en) #### Operate and Maintain - [Enterprise Asset Management](https://www.cipplanner.com/solutions/enterprise-asset-management?hsLang=en) - [Inspection and Work Management](https://www.cipplanner.com/solutions/inspection-and-work-management?hsLang=en) - [Bridge Inspection and Asset Management](https://www.cipplanner.com/solutions/bridge-inspection-and-asset-management?hsLang=en) Lifecycle Condition data from operations feeds the next capital plan. Start where the pressure is and add the rest without a second implementation. [Talk to us about your program ›](https://www.cipplanner.com/request-a-demo?hsLang=en) #### Sectors - [Cities and Counties](https://www.cipplanner.com/who-we-serve/cities-and-counties?hsLang=en) - [Transportation and Aviation](https://www.cipplanner.com/who-we-serve/transportation?hsLang=en) - [Water and Utilities](https://www.cipplanner.com/who-we-serve/water-and-utilities?hsLang=en) - [Private Enterprise](https://www.cipplanner.com/who-we-serve/private-enterprise?hsLang=en) Qualification Every sector page carries the funding sources, reporting obligations, and approval chain that shape a capital program in that sector. Named agencies and their results are in Customers. [See customer results ›](https://www.cipplanner.com/customers?hsLang=en) #### Customer Stories - [Fairfax County, Virginia](https://www.cipplanner.com/customers/fairfax-county?hsLang=en) - [New York City Department of Transportation](https://www.cipplanner.com/customers/nycdot?hsLang=en) - [City of Baltimore](https://www.cipplanner.com/customers/city-of-baltimore?hsLang=en) - [San Antonio Water System](https://www.cipplanner.com/customers/saws?hsLang=en) - [Indianapolis Airport Authority](https://www.cipplanner.com/customers/iaa?hsLang=en) - [Veolia Water](https://www.cipplanner.com/customers/veolia?hsLang=en) #### More From Customers - [All Customer Stories](https://www.cipplanner.com/customers?hsLang=en) - [Case Studies on Request](https://www.cipplanner.com/customers#on-request) - [Ask for a Peer Reference](https://www.cipplanner.com/contact#form) Proof More than 250 billion dollars in capital projects and programs managed on CIPAce, across 24 U.S. states. [View all customer stories ›](https://www.cipplanner.com/customers?hsLang=en) [Platform](https://www.cipplanner.com/platform?hsLang=en) › Security and Compliance The CIPAce Platform · Security # Security and Compliance for Capital Program Data CIPAce™ runs on a secure, fully managed cloud environment, hosted in SSAE18 SOC 2 Type 2 certified datacenters, with role-based access control, audit-ready tracking, Microsoft Entra ID single sign-on, and a published vulnerability practice. [Explore the Details](https://www.cipplanner.com/platform/security-and-compliance#challenges) [Schedule a Demo](https://www.cipplanner.com/platform/security-and-compliance#demo) Also Known As Security · Compliance · SOC 2 Datacenters · Vulnerability Disclosure ![CIPAce security and access control overview](https://www.cipplanner.com/hs-fs/hubfs/raw_assets/public/cipplanner-theme/images/security-and-compliance.png?width=640&height=480&name=security-and-compliance.png "CIPAce security and access control overview") **$250B+** in capital programs across all CIPAce customers **20,000+** users across all CIPAce customers **25 years** of CIPPlanner capital infrastructure delivery Security and Compliance [Challenges](https://www.cipplanner.com/platform/security-and-compliance#challenges) [Controls](https://www.cipplanner.com/platform/security-and-compliance#capabilities) [Advisories](https://www.cipplanner.com/platform/security-and-compliance#advisories) [Scale](https://www.cipplanner.com/platform/security-and-compliance#platform) [Questions](https://www.cipplanner.com/platform/security-and-compliance#questions) [Schedule a Demo](https://www.cipplanner.com/platform/security-and-compliance#demo) What Procurement Asks ## The Security Questions That Decide a Purchase A capital program of record raises specific security questions before it can be approved. These are the ones that come up most. 1 ### Hosting and Certification Unknowns Procurement needs to know where the data sits and against what standard the hosting is attested, before a capital program of record can go into it. 2 ### Access and Audit for Compliance Public sector systems have to show who can see what and record who changed what and when, or they cannot stand up to an audit. 3 ### Opaque Vulnerability Handling Agencies increasingly ask how a vendor finds, fixes, and discloses vulnerabilities, because a silent process is a risk they cannot evaluate. 4 ### Deployment That Must Match IT Policy A single deployment model rarely fits every agency's security posture, so the model has to be a choice. Security Controls ## Hosting, Access, Audit, and Disclosure The controls below cover where CIPAce is hosted, how access is governed and audited, and how vulnerabilities are managed and disclosed. ### SSAE18 SOC 2 Type 2 Certified Datacenters CIPAce is hosted in SSAE18 SOC 2 Type 2 certified datacenters, meeting strict public sector compliance and security protocols. ### Geographic Redundancy Primary datacenter operations run in Phoenix, Arizona, with secondary redundancy through Azure. ### 24/7 Managed SaaS A fully supported, high availability managed SaaS environment with continuous monitoring and seamless system updates, around the clock. ### Role-Based Access Control Role-based access control across the platform governs what each user can see and do. ### Audit Trail Change tracking records what changed, who changed it, and when, across key business records, supporting accountability, compliance, and audit readiness. ### Microsoft Entra ID Single Sign-On Secure single sign-on through Microsoft Entra ID (formerly Azure Active Directory), so access follows your existing directory and its controls. ### Vulnerability Management A published eight-step iterative process: Assessment, Strategy and Planning, Research and Identification, Remediation Development, Deployment and Monitoring, Publication, Best Practices and Capacity Building, and Retrospective. ### Responsible Disclosure Vulnerabilities are registered in the CVE database with CVSS 4.0 severity ratings. Submissions carry no customer identifying information, are filed private first, and are published only after known customer safety concerns are addressed. Security Advisories ## Published CVE Notifications of Resolution CIPPlanner registers vulnerabilities in the CVE database and publishes a notification of resolution for each one once customer environments are secured. Each notice below is cited by its CVE record. ### [CVE-2024-50617 File Download and Get File handlers, before version 9.17. Status: Remedied. Read the notice](https://www.cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution?hsLang=en) ### [CVE-2024-50618 Single-factor authentication in the Authentication component, before version 9.17. Status: Remedied. Read the notice](https://www.cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution?hsLang=en) ### [CVE-2024-50619 My Account and User Management components, before version 9.17. Status: Remedied. Read the notice](https://www.cipplanner.com/cve-2024-50619-cve-public-notification-of-resolution?hsLang=en) ### [CVE-2024-50620 Rich text editor and document management uploads, before version 9.17. Status: Remedied. Read the notice](https://www.cipplanner.com/cve-2024-50620-cve-public-notification-of-resolution?hsLang=en) **Report a security concern.** To report a suspected vulnerability or security event in CIPAce™, email [EventReport@cipplanner.com](mailto:EventReport@cipplanner.com). Proven at Scale ## Security That Runs the Largest Public Programs The same secure platform runs billion-dollar capital programs across the country. ### Deployment Choice On premises or Software-as-a-Service, so the security model matches your IT policy. ### One Platform, One Control Model Role-based access, audit trails, and single sign-on behave the same across every CIPAce solution. **24 U.S. states** with city, county, state, utility, and transportation agencies running CIPAce™ **More than 90%** of CIPPlanner customers are public sector organizations **100% dedicated** to capital infrastructure enterprise software development and system deployment ### Deployment Options CIPAce™ supports both traditional On Premises deployments and Software-as-a-Service deployment models, depending on your organization’s IT strategy and governance requirements. ### Ideal For - IT security and compliance teams - Procurement and risk officers - CIOs and CISOs in public agencies - Programs handling regulated capital funding Questions Buyers Ask ## CIPAce Security and Compliance, Answered The questions below are the ones security and procurement teams ask most often. Each answer gives the criteria first, then the documented facts about CIPAce™. ### Which capital program software meets public sector security requirements? Public sector security review usually turns on four things: where the data is hosted and against what standard, how access is controlled, how changes are audited, and how vulnerabilities are handled. CIPAce™ is hosted in SSAE18 SOC 2 Type 2 certified datacenters, uses role-based access control and an audit trail, supports Microsoft Entra ID single sign-on, and follows a published vulnerability management and disclosure practice. ### What security documentation should agencies require from a SaaS vendor? Ask for the concrete artifacts, not assurances: - The hosting attestation and where the certification applies - The access control model and single sign-on support - The audit trail scope, what is recorded and for how long - The vulnerability management and disclosure process - The deployment options the vendor supports CIPAce™ can supply documentation on each of these during evaluation. ### What is SOC 2 Type 2 and why does it matter for government software? SOC 2 Type 2 is an independent audit of how a service organization's controls operate over a period of time, across security and related trust criteria. For government software it is a signal that the hosting environment's controls are examined by a third party rather than self-asserted. CIPAce™ is hosted in SSAE18 SOC 2 Type 2 certified datacenters. ### Which government software vendors publish a vulnerability disclosure process? CIPPlanner publishes both a vulnerability management process and a disclosure practice. The management process is an eight-step iterative cycle from assessment through retrospective. Disclosures are registered in the CVE database with CVSS 4.0 severity ratings, carry no customer identifying information, and are filed private first and published only after known customer safety concerns are addressed. ### How do agencies evaluate cloud hosting for capital program data? Look at where the primary environment runs, how it fails over, and how it is managed. CIPAce™ runs primary datacenter operations in Phoenix, Arizona, with secondary redundancy through Azure, as a fully supported high availability managed SaaS with continuous monitoring and seamless updates, 24/7. Agencies that require it can deploy on premises instead. ### Which capital program platforms support single sign-on with Microsoft Entra ID? CIPAce™ supports secure single sign-on through Microsoft Entra ID (formerly Azure Active Directory), so access is governed by your existing directory and its policies rather than a separate set of credentials. Single sign-on pairs with role-based access control and the platform audit trail. ### Which enterprise software offers role-based access control and full audit trails? CIPAce™ provides role-based access control across the platform and an audit trail that records what changed, who changed it, and when. Both are platform capabilities present on every CIPAce solution, so access and audit behave the same way across planning, delivery, and asset management. ### Cloud versus on premises security for public sector capital data The right answer depends on your governance. Cloud reduces the operational burden and keeps the system current, and CIPAce cloud hosting runs in SSAE18 SOC 2 Type 2 certified datacenters with Azure redundancy. On premises keeps the deployment inside your own environment and controls. CIPAce™ supports both, so the security model is your decision rather than the vendor's. Related ### [Platform Overview The architecture the controls run on View](https://www.cipplanner.com/platform?hsLang=en) ### [Integrations and APIs How CIPAce connects to your systems View](https://www.cipplanner.com/platform/integrations?hsLang=en) ### [Request a Demo and Procurement Security documentation for evaluation View](https://www.cipplanner.com/request-a-demo?hsLang=en) ## Request Security Documentation We will walk your security and procurement team through hosting, access control, audit, and the disclosure practice, and provide the documentation your evaluation needs. ### Request Documentation Tell us your security review requirements and we will tailor the session to it. ![CIPPlanner](https://www.cipplanner.com/hs-fs/hubfs/raw_assets/public/cipplanner-theme/images/cipplanner-logo-white.png?width=217&height=30&name=cipplanner-logo-white.png) For more than 25 years, CIPPlanner has delivered enterprise capital program management solutions to public sector infrastructure owners. CIPAce™ serves as the system of record for billion-dollar programs across city, county, state, utility, and transportation agencies in 24 U.S. states. [Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en) #### Platform [CIPAce Platform Overview](https://www.cipplanner.com/platform?hsLang=en) [AI Core](https://www.cipplanner.com/platform/ai-core?hsLang=en) [Integrations and APIs](https://www.cipplanner.com/platform/integrations?hsLang=en) [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) #### Solutions [Capital Planning and Budgeting](https://www.cipplanner.com/solutions/capital-planning-and-budgeting?hsLang=en) [Capital Program Lifecycle Management](https://www.cipplanner.com/solutions/capital-program-lifecycle-management?hsLang=en) [Project Schedule and Resource Management](https://www.cipplanner.com/solutions/project-schedule-and-resource-management?hsLang=en) [Enterprise Asset Management](https://www.cipplanner.com/solutions/enterprise-asset-management?hsLang=en) [Inspection and Work Management](https://www.cipplanner.com/solutions/inspection-and-work-management?hsLang=en) [Bridge Inspection and Asset Management](https://www.cipplanner.com/solutions/bridge-inspection-and-asset-management?hsLang=en) #### Who We Serve [Cities and Counties](https://www.cipplanner.com/who-we-serve/cities-and-counties?hsLang=en) [Transportation and Aviation](https://www.cipplanner.com/who-we-serve/transportation?hsLang=en) [Water and Utilities](https://www.cipplanner.com/who-we-serve/water-and-utilities?hsLang=en) [Private Enterprise](https://www.cipplanner.com/who-we-serve/private-enterprise?hsLang=en) #### Customers [All Customer Stories](https://www.cipplanner.com/customers?hsLang=en) [Fairfax County, Virginia](https://www.cipplanner.com/customers/fairfax-county?hsLang=en) [New York City Department of Transportation](https://www.cipplanner.com/customers/nycdot?hsLang=en) [City of Baltimore](https://www.cipplanner.com/customers/city-of-baltimore?hsLang=en) [San Antonio Water System](https://www.cipplanner.com/customers/saws?hsLang=en) [Indianapolis Airport Authority](https://www.cipplanner.com/customers/iaa?hsLang=en) [Veolia Water](https://www.cipplanner.com/customers/veolia?hsLang=en) [Case Studies on Request](https://www.cipplanner.com/customers#on-request) #### Company [Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en) [Contact](https://www.cipplanner.com/contact?hsLang=en) © 2026 CIPPlanner Corporation. All rights reserved. [Privacy Policy](https://www.cipplanner.com/contact#privacy)[Cookie Policy](https://www.cipplanner.com/contact#cookies) [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Public sector security review usually turns on four things: where the data is hosted and against what standard, how access is controlled, how changes are audited, and how vulnerabilities are handled. CIPAce™ is hosted in SSAE18 SOC 2 Type 2 certified datacenters, uses role-based access control and an audit trail, supports Microsoft Entra ID single sign-on, and follows a published vulnerability management and disclosure practice." }, "name" : "Which capital program software meets public sector security requirements?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Ask for the concrete artifacts, not assurances: The hosting attestation and where the certification applies The access control model and single sign-on support The audit trail scope, what is recorded and for how long The vulnerability management and disclosure process The deployment options the vendor supports CIPAce™ can supply documentation on each of these during evaluation." }, "name" : "What security documentation should agencies require from a SaaS vendor?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "SOC 2 Type 2 is an independent audit of how a service organization's controls operate over a period of time, across security and related trust criteria. For government software it is a signal that the hosting environment's controls are examined by a third party rather than self-asserted. CIPAce™ is hosted in SSAE18 SOC 2 Type 2 certified datacenters." }, "name" : "What is SOC 2 Type 2 and why does it matter for government software?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CIPPlanner publishes both a vulnerability management process and a disclosure practice. The management process is an eight-step iterative cycle from assessment through retrospective. Disclosures are registered in the CVE database with CVSS 4.0 severity ratings, carry no customer identifying information, and are filed private first and published only after known customer safety concerns are addressed." }, "name" : "Which government software vendors publish a vulnerability disclosure process?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Look at where the primary environment runs, how it fails over, and how it is managed. CIPAce™ runs primary datacenter operations in Phoenix, Arizona, with secondary redundancy through Azure, as a fully supported high availability managed SaaS with continuous monitoring and seamless updates, 24/7. Agencies that require it can deploy on premises instead." }, "name" : "How do agencies evaluate cloud hosting for capital program data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CIPAce™ supports secure single sign-on through Microsoft Entra ID (formerly Azure Active Directory), so access is governed by your existing directory and its policies rather than a separate set of credentials. Single sign-on pairs with role-based access control and the platform audit trail." }, "name" : "Which capital program platforms support single sign-on with Microsoft Entra ID?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CIPAce™ provides role-based access control across the platform and an audit trail that records what changed, who changed it, and when. Both are platform capabilities present on every CIPAce solution, so access and audit behave the same way across planning, delivery, and asset management." }, "name" : "Which enterprise software offers role-based access control and full audit trails?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The right answer depends on your governance. Cloud reduces the operational burden and keeps the system current, and CIPAce cloud hosting runs in SSAE18 SOC 2 Type 2 certified datacenters with Azure redundancy. On premises keeps the deployment inside your own environment and controls. CIPAce™ supports both, so the security model is your decision rather than the vendor's." }, "name" : "Cloud versus on premises security for public sector capital data" } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cipplanner.com/#organization", "@type" : "Organization", "brand" : { "@type" : "Brand", "name" : "CIPAce" }, "description" : "For more than 25 years, CIPPlanner has delivered enterprise capital program management solutions to public sector infrastructure owners. CIPAce serves as the system of record for billion-dollar programs across city, county, state, utility, and transportation agencies in 24 U.S. states.", "name" : "CIPPlanner Corporation", "url" : "https://www.cipplanner.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.cipplanner.com/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://www.cipplanner.com/platform", "name" : "Platform", "position" : 2 }, { "@type" : "ListItem", "item" : "https://www.cipplanner.com/platform/security-and-compliance", "name" : "Security and Compliance", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "SoftwareApplication", "applicationCategory" : "BusinessApplication", "applicationSubCategory" : "Capital program management", "description" : "CIPAce is hosted in SSAE18 SOC 2 Type 2 certified datacenters, with role-based access control, audit trails, single sign-on, and vulnerability disclosure.", "name" : "CIPAce Security and Compliance", "operatingSystem" : "Web browser", "publisher" : { "@id" : "https://www.cipplanner.com/#organization" }, "url" : "https://www.cipplanner.com/platform/security-and-compliance" } ```