As part of our journey to align with NIST SP 800-171, particularly the Access Control (3.1) family, we’ve built a detailed and flexible permission system within our SaaS platform that powers BreakEven PLUS™, FALIB™ reporting, and estimation workflows.
Each super user in our platform—typically an admin at the subscriber company—has access to a full Access Control Interface. This system allows them to grant or restrict permissions for their team, down to individual actions like:
Employee Management: List, Create, Edit, Delete, Import/Export employees
Customer/Vendor Management: Full CRUD and file access
File Storage: Segmented access to FALIB™, Attendance, and Sales Reports (No external files supported)
Estimates & Reports: Access creation, editing, and export of estimates and critical business reports
Settings & Configuration: Fine-grained control over invoice formats, work orders, job costing, etc.
These actions are bound to user role, logged, and auditable.
Beyond access control, BreakEven PLUS™ provides detailed, field-level audit logging across financial and operational modules.
Each logged event includes:
Timestamp (date and time)
User identity
Module or model affected
Action performed (INSERT, UPDATE, etc.)
IP address
Device ID
Request ID
User agent (browser/device fingerprint)
System-generated message summary
When financial configurations or reporting values are modified, the system captures:
| Field | Old Value | New Value |
|---|---|---|
| Hourly sell rate | 56.89 | 62.59 |
| Total profits | 9607.53 | 106739.60 |
| Profit fee markup | 1.00 | 11.11 |
While we do not position BreakEven PLUS™ as a CUI processing environment, our security model reflects best practices aligned with federal standards such as NIST SP 800-171 — particularly in access restriction, least privilege, and audit accountability.
This approach gives subscribers:
Reduced regulatory exposure
Clear separation from CUI environments
Strong internal governance
Audit-ready operational discipline
For modules handling sensitive information—like FALIB™, Sales Reports, or Estimates tied to federal bids—granular access is not just a convenience. It’s a compliance mandate.
By embedding practices NIST-aligned access control into your estimation stack, you’re:
Protecting Controlled Unclassified Information (CUI)
Reducing internal risk via least privilege
Ensuring auditability for future assessments or DFARS/CMMC obligations
Admins should periodically review user permissions, especially before enabling export features in reports or FALIB™. Our system logs all permission changes for full traceability.
Posted 05-30-2025 by SERVVIAN®