Deltek Costpoint Compliance Archive — DCAA, DFARS, CAS, CMMC, SOX Defensible

A deltek costpoint compliance archive is a purpose-built repository that holds Costpoint history under retention obligations specific to US federal contracting — DCAA incurred-cost-submission audit lookback (7+ years), DFARS 252.242 business-system audit (life of contract), CAS Disclosure Statement (life of contract plus 7 years), CMMC Level 2 evidence retention, SOX (7 years), IRS Pub 583 (4-7 years), federal records retention schedule (where contract terms require), state lien-rights for construction work (varies), and ERISA/payroll obligations (4-7 years post-termination). The archive applies immutable object-lock retention per data class to make each obligation legally enforceable, signs and timestamps every record for evidence chain integrity, and exposes the data through a clean read-only UI scoped for DCAA auditors, contracting officers, external auditors and the controller.

A regular cloud archive optimizes for query performance and storage cost. A deltek costpoint compliance archive layers retention enforcement, evidence-chain integrity and consumer-class governance specifically tuned for federal-contractor regulatory obligations on top of those base capabilities. Object-lock retention is configured per data class to match DCAA, DFARS, CAS, CMMC, SOX, IRS and federal records retention schedule periods — and the lock is legally enforceable so even an administrator can't delete records before the period expires. Every record is hash-signed and timestamped on ingest for tamper-evidence chain of custody. Consumer classes are segmented: DCAA auditors, contracting officers, external auditors, controller, HR, BD team each see only the data their role permits. Every access is logged for SOX + DCAA business-system audit trail.

Configurable per data class to match each federal-contractor regulatory obligation. Indirect-rate pool calculation workpapers and ICE submission packages: 7+ years for DCAA incurred-cost-submission audit lookback (typically extended to 10+ years for primes with long-PoP IDIQ contracts). Contract records: life of contract plus 7 years for DFARS 252.242 business-system audit. CAS Disclosure Statement cross-references: life of contract. T&E and floor check records: 7+ years for DCAA timekeeping audit defense. CMMC Level 2 evidence: 3 years per CMMC retention requirement (longer where contract terms require). SOX 404 supporting evidence: 7 years. IRS Pub 583 financial records: 4-7 years. Federal records retention schedule: as contract terms specify. HR and payroll: 4-7 years post-termination for ADEA/Title VII/ERISA. State tax workpapers: per individual state periods.

Yes — this is the primary design point. The archive captures every indirect-rate pool calculation workpaper from Costpoint at every point-in-time, along with the supporting allocation base detail, the cost objects accumulating into each pool, the approved provisional rate at time of calculation, the certified forward-pricing rate, and the executive comp cap test results. All preserved under immutable object-lock retention with hash signature for tamper evidence. When the DCAA contracting officer requests rate reconciliation for FY2019 incurred-cost submission, the controller pulls the original pool calculation, the supporting cost data, the approved provisional rate cert PDF and the forward-pricing rate cert PDF in seconds. The audit is defended from the archive — no reconstruction, no fishing through backup tapes, no restoring decommissioned Cognos report servers.

DFARS 252.242-7006 requires contractor business systems (accounting, EVMS, MMAS, purchasing, estimating, T&E timekeeping) to maintain adequate internal controls with auditable evidence. The compliance archive preserves the full business-system evidence inventory: indirect-rate calculation reproducibility, T&E floor check records and timekeeping audit trail, MMAS evidence for material management, purchasing system records for approved vendor controls, estimating system records for cost-estimating method consistency. Every record is hash-signed and timestamped on ingest. When DCAA conducts a business-system review years post-decommissioning, the controller demonstrates control adequacy directly from the archive — read-access log, immutable object-lock retention, signed reconciliation manifests all satisfy DCAA business-system audit scope without compromise.

Yes. CAS-covered contractors face periodic CAS Disclosure Statement reviews ensuring cost accounting practices remain consistent with the disclosed methods. The compliance archive preserves CAS-relevant cost allocation history: pool basis consistency across multiple contracts, Disclosure Statement cross-references per pool per fiscal year, accounting practice changes with documented rationale and contracting-officer approval. CAS Disclosure Statement cross-references are retained life-of-contract under immutable object-lock. When DCAA conducts a CAS Disclosure Statement audit, the controller demonstrates accounting-practice consistency directly from the archive with full evidence chain. CAS noncompliance findings are defended with point-in-time pool design reconstruction.

Yes. The archive can be deployed in a CMMC Level 2-aligned tenancy with full asset inventory, configuration management, audit and accountability controls. Encryption at rest (KMS, customer-managed keys), TLS 1.2+ in transit, MFA-enforced access with CAC/PIV smart card support, role-based access control, immutable object-lock retention, comprehensive audit logging shipping to your SIEM, IP-allowlisted ingress where required for CUI handling. CMMC Level 2 retention requirements (3 years for evidence) are met with object-lock; longer retention where contract terms specify is supported. For DFARS 252.204-7012 CUI handling, encryption-in-transit and encryption-at-rest obligations are met out of the box. CMMC assessor review routinely accepts the archive on first attempt.

Three layers. First, every record is hash-signed on ingest — SHA-256 signatures stored alongside the data with verifiable timestamp from a trusted time source (RFC 3161). Second, every record is stored under immutable object-lock retention — even an administrator can't modify or delete records before the retention period expires. Third, every access (search, document open, export) is logged with user identity, timestamp, query and result count, with audit logs shipping to your SIEM in real time. The combination delivers a verifiable chain of custody from original Costpoint extract through long-term archival through final auditor or contracting-officer review. DCAA and external auditors routinely accept the deltek costpoint compliance archive as a primary evidence source for SOX 404, DCAA incurred-cost-submission, DFARS 252.242 business-system and CAS Disclosure Statement audits.