CMMC REFERENCE
CMMC comes with a specific set of terms, acronyms, and regulatory definitions that appear throughout every policy document, assessment, and contract requirement. This glossary breaks down the most important ones so you can communicate clearly, avoid the costly misunderstandings that come from imprecise language, and work through the compliance process accurately. Whether you’re writing policies or preparing for an assessment, this is your quick-reference guide.
Access Control (AC)
the process of granting or denying specific requests to obtain and use information and related information processing services; and/or entry to specific physical facilities (e.g., Federal buildings, military establishments, or border crossing entrances), as defined in FIPS PUB 201-3 Jan2002 (incorporated by reference, see § 170.2).
(SOURCE 32 CFR 170.4)
Accreditation
a status pursuant to which a CMMC Assessment and Certification Ecosystem member (person or organization), having met all criteria for the specific role they perform including required ISO/IEC accreditations, may act in that role as set forth in § 170.8 for the Accreditation Body and § 170.9 for C3PAOs. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Accreditation Body
is defined in § 170.8 and means the one organization DoW contracts with to be responsible for authorizing and accrediting members of the CMMC Assessment and Certification Ecosystem, as required. The Accreditation Body must be approved by DoW. At any given point in time, there will be only one Accreditation Body for the DoW CMMC Program. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Adequate Security
protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.
(SOURCE DFARS 252.204-7012)
Advanced Persistent Threat (APT)
an adversary that possesses sophisticated levels of expertise and significant resources that allow it to create opportunities to achieve its objectives by using multiple attack vectors (e.g., cyber, physical, and deception). These objectives typically include establishing and extending footholds within the information technology infrastructure of the targeted organizations for purposes of exfiltrating information, undermining or impeding critical aspects of a mission, program, or organization; or positioning itself to carry out these objectives in the future. The advanced persistent threat pursues its objectives repeatedly over an extended period-of-time, adapts to defenders’ efforts to resist it, and is determined to maintain the level of interaction needed to execute its objectives, as is defined in NIST SP 800-39 Mar2011 (incorporated by reference, see § 170.2).
(SOURCE 32 CFR 170.4)
Affirming Official
the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Agency
(also Federal agency, executive agency, executive branch agency) is any “executive agency,” as defined in 5 U.S.C. 105; the United States Postal Service; and any other independent entity within the executive branch that designates or handles CUI.
(SOURCE 32 CFR 2002.4)
Agency CUI Policies
are the policies the agency enacts to implement the CUI Program within the agency. They must be in accordance with the Order, this part, and the CUI Registry and approved by the CUI EA.
(SOURCE 32 CFR 2002.4)
Agreements and Arrangements
are any vehicle that sets out specific CUI handling requirements for contractors and other information-sharing partners when the arrangement with the other party involves CUI. Agreements and arrangements include, but are not limited to, contracts, grants, licenses, certificates, memoranda of agreement/arrangement or understanding, and information-sharing agreements or arrangements.
(SOURCE 32 CFR 2002.4)
Assessment
the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization, as defined in §§ 170.15 through 170.18. (CMMC-custom term) Level 1 Self-Assessment — the term for the activity performed by an OSA to evaluate its own information system when seeking a CMMC Status of Level 1 (Self). Level 2 Self-Assessment — the term for the activity performed by an OSA to evaluate its own information system when seeking a CMMC Status of Level 2 (Self). Level 2 Certification Assessment — the term for the activity performed by a C3PAO to evaluate the information system of an OSC when seeking a CMMC Status of Level 2 (C3PAO). Level 3 Certification Assessment — the term for the activity performed by the DCMA DIBCAC to evaluate the information system of an OSC when seeking a CMMC Status of Level 3 (DIBCAC). POA&M Closeout Self-Assessment — the term for the activity performed by an OSA to evaluate only the NOT MET requirements that were identified with POA&M during the initial assessment, when seeking a CMMC Status of Final Level 2 (Self). POA&M Closeout Certification Assessment — the term for the activity performed by a C3PAO or DCMA DIBCAC to evaluate only the NOT MET requirements that were identified with POA&M during the initial assessment, when seeking a CMMC Status of Final Level 2 (C3PAO) or Final Level 3 (DIBCAC) respectively.
(SOURCE 32 CFR 170.4)
Assessment Findings Report
the final written assessment results by the third-party or government assessment team. The Assessment Findings Report is submitted to the OSC and to the DoW via CMMC eMASS. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Assessment Objective (AO)
a set of determination statements that, taken together, expresses the desired outcome for the assessment of a security requirement. Successful implementation of the corresponding CMMC security requirement requires meeting all applicable assessment objectives defined in NIST SP 800-171A Jun2018 (incorporated by reference, see § 170.2) or NIST SP 800-172A Mar2022 (incorporated by reference, see § 170.2). (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Assessment Team
participants in the Level 2 certification assessment (CMMC Certified Assessors and CMMC Certified Professionals) or the Level 3 certification assessment (DCMA DIBCAC assessors). This does not include the OSC participants preparing for or participating in the assessment. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Asset
an item of value to stakeholders. An asset may be tangible (e.g., a physical item such as hardware, firmware, computing platform, network device, or other technology component) or intangible (e.g., humans, data, information, software, capability, function, service, trademark, copyright, patent, intellectual property, image, or reputation).
(SOURCE 32 CFR 170.4)
Asset Categories
A grouping of assets that process, store or transmit information of similar designation, or provide security protection to those assets. (CMMC-custom term)
(SOURCE32 CFR 170.4)
Authentication
Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.
(SOURCE FIPS PUB 200 Mar2006)
Authorization
The right or a permission that is granted to a system entity to access a system resource.
(SOURCE NIST Glossary)
Authorized
an interim status during which a CMMC Ecosystem member (person or organization), having met all criteria for the specific role they perform other than the required ISO/IEC accreditations, may act in that role for a specified time as set forth in § 170.8 for the Accreditation Body and § 170.9 for C3PAOs. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Authorized Holder
1. an individual, agency, organization, or group of users that is permitted to designate or handle CUI, in accordance with 32 Code of Federal Regulations (CFR) Part 2002. 2. is an individual, agency, organization, or group of users that is permitted to designate or handle CUI, in accordance with this part.
(SOURCE DoD Mandatory CUI Training – Glossary, CDSE; 32 CFR 2002.4)
ACRONYMS
AU
Audit and Accountability
(source: Appendix A – Acronyms and Abbreviations)
API
Application Programming Interface
(source: Appendix A – Acronyms and Abbreviations)
AC
Access Control
(source: 32 CFR 170.4)
AES
Advanced Encryption Standard
(source: Appendix A – Acronyms and Abbreviations)
APT
Advanced Persistent Threat
(source: 32 CFR 170.4)
AT
Awareness and Training
(source: 32 CFR 170.4)
Basic Assessment
a contractor’s self-assessment of the contractor’s implementation of NIST SP 800-171 that: (1) Is based on the Contractor’s review of their system security plan(s) associated with covered contractor information system(s); (2) Is conducted in accordance with the NIST SP 800-171 DoW Assessment Methodology; and (3) Results in a confidence level of “Low” in the resulting score, because it is a self-generated score.
We can help. We have Certified CMMC Practitioners (CCPs) and Assessors (CCAs) on staff ready to support you on this journey.
(SOURCE DFARS 252.204-7020)
Capability
a combination of mutually reinforcing controls implemented by technical means, physical means, and procedural means. Such controls are typically selected to achieve a common information security or privacy purpose, as defined in NIST SP 800-37 R2 (incorporated by reference, see § 170.2).
(SOURCE 32 CFR 170.4)
Classified Information
is information that Executive Order 13526, “Classified National Security Information,” December 29, 2009 (3 CFR, 2010 Comp., p. 298), or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended, requires agencies to mark with classified markings and protect against unauthorized disclosure.
(SOURCE 32 CFR 2002.4)
Cloud Service Provider (CSP)
an external company that provides cloud services based on cloud computing. Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
CMMC Assessment and Certification Ecosystem
means the people and organizations described in subpart C of this part. This term is sometimes shortened to CMMC Ecosystem. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
CMMC Assessment Scope
the set of all assets in the OSA’s environment that will be assessed against CMMC security requirements. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
CMMC Assessor and Instructor Certification Organization (CAICO)
the organization responsible for training, testing, authorizing, certifying, and recertifying CMMC certified assessors, certified instructors, and certified professionals. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
CMMC Security Requirements
the 15 Level 1 requirements listed in the 48 CFR 52.204-21(b)(1), the 110 Level 2 requirements from NIST SP 800-171 R2 (incorporated by reference, see § 170.2), and the 24 Level 3 requirements selected from NIST SP 800-172 Feb2021 (incorporated by reference, see § 170.2).
(SOURCE 32 CFR 2002.4)
CMMC Status
the result of meeting or exceeding the minimum required score for the corresponding assessment. The CMMC Status of an OSA information system is officially stored in SPRS and additionally presented on a Certificate of CMMC Status, if the assessment was conducted by a C3PAO or DCMA DIBCAC. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
CMMC Third-Party Assessment Organization (C3PAO)
an organization that has been authorized or accredited by the Accreditation Body to conduct Level 2 certification assessments and has the roles and responsibilities identified in § 170.9. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Compromise
disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.
(SOURCE DFARS 252.204-7012)
Contractor
any individual or other legal entity that is awarded a Federal Government contract or subcontract under a Federal Government contract.
(SOURCE 29 CFR 10.2)
Contractor Risk Managed Asset (CRMA)
Assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and practices in place. Assets are not required to be physically or logically separated from CUI assets.
(SOURCE 32 CFR 170.4)
Controlled Environment
is any area or space an authorized holder deems to have adequate physical or procedural controls (e.g., barriers or managed access controls) to protect CUI from unauthorized access or disclosure.
(SOURCE 32 CFR 2002.4)
Controlled Unclassified Information (CUI)
1. is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. 2. Unclassified information requiring safeguarding and dissemination controls, consistent with applicable law, regulation, or government-wide policy.
(SOURCE 32 CFR 2002.4; DoD Mandatory CUI Training – Glossary, CDSE)
Controlled Unclassified Information Asset (CUIA)
assets that can process, store, or transmit CUI. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
Covered Contractor Information System
an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information.
(SOURCE DFARS 252.204-7012)
Covered Defense Information (CDI)
unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies.
(SOURCE DFARS 252.204-7012)
CUI Basic
Subset of CUI for which the authorizing law, regulation, or government-wide policy does not set out specific handling or dissemination controls. Agencies handle CUI Basic according to the uniform set of controls set forth in DoDI 5200.48 and the DoW CUI Registry.
(SOURCE DoD Mandatory CUI Training – Glossary, CDSE; 32 CFR 2002.4)
CUI Specified
Subset of CUI in which the authorizing law, regulation, or government wide policy contains specific handling controls that it requires or permits agencies to use that differ from those for CUI Basic.
(SOURCE DoD Mandatory CUI Training – Glossary, CDSE; 32 CFR 2002.4)
Cyber Incident
actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.
(SOURCE DFARS 252.204-7012)
ACRONYMS
C3PAO
CMMC Third-Party Assessment Organization
(source: 32 CFR 170.4)
CA
Security Assessment
(source: 32 CFR 170.4)
CAICO
CMMC Assessors and Instructors Certification Organization
(source: 32 CFR 170.4)
CAGE
Commercial and Government Entity
(source: 32 CFR 170.4)
CCP
CMMC-Certified Professional
(source: 32 CFR 170.4)
CIO
Chief Information Office
(source: 32 CFR 170.4)
CM
Configuration Management
(source: 32 CFR 170.4)
CMMC
Cybersecurity Maturity Model Certification
(source: 32 CFR 170.4)
CCA
CMMC-Certified Assessor
(source: 32 CFR 170.4)
CCI
CMMC-Certified Instructor
(source: 32 CFR 170.4)
CSP
Cloud Service Provider
(source: 32 CFR 170.4)
CUI
Controlled Unclassified Information
(source: 32 CFR 170.4)
DCMA DIBCAC High Assessment
an assessment that is conducted by Government personnel in accordance with NIST SP 800-171A Jun2018 and leveraging specific guidance in the DoD Assessment Methodology.
(SOURCE 32 CFR 170.4)
Defense Industrial Base (DIB)
the Department of Defense, Government, and private sector worldwide industrial complex with capabilities to perform research and development, design, produce, and maintain military weapon systems, subsystems, components, or parts to satisfy military requirements.
(SOURCE 32 CFR 236.2)
DoW Assessment Methodology (DoDAM)
documents a standard methodology that enables a strategic assessment of a contractor’s implementation of NIST SP 800-171 R2, a requirement for compliance with 48 CFR 252.204-7012.
(SOURCE 32 CFR 170.4)
ACRONYMS
DCMA
Defense Contract Management Agency
(source: 32 CFR 170.4)
DFARS
Defense Federal Acquisition Regulation Supplement
(source: 32 CFR 170.4)
DIB
Defense Industrial Base
(source: 32 CFR 170.4)
DIBCAC
DCMA’s Defense Industrial Base Cybersecurity Assessment Center
(source: 32 CFR 170.4)
DoD
Department of Defense
(source: 32 CFR 170.4)
Now That You Know the Terms, Let’s Talk About What They Mean for
Your Organization.
CMMC compliance looks different depending on your contracts, your
environment, and where you are in the process. The strategy session is where that
conversation starts.
Enduring Exception
a special circumstance or system where remediation and full compliance with CMMC security requirements is not feasible. Examples include systems required to replicate the configuration of fielded systems, medical devices, test equipment, OT, and IoT. No operational plan of action is required but the circumstance must be documented within a system security plan. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
External Service Provider (ESP)
external people, technology, or facilities that an organization utilizes for provision and management of IT and/or cybersecurity services on behalf of the organization. In the CMMC Program, CUI or Security Protection Data must be processed, stored, or transmitted on the ESP assets to be considered an ESP. (CMMC-custom term)
(SOURCE 32 CFR 170.4)
ACRONYMS
eMASS
Enterprise Mission Assurance Support Service
(source: 32 CFR 170.4)
ESP
External Service Provider
(source: 32 CFR 170.4)
Defense Contractors
If you’re handling Controlled Unclassified Information (CUI), pursuing CMMC, or preparing for assessment, the margin for interpretation is small. GCC High decisions, logging structure, identity and access management protocols,they matter.
We can help. We have Certified CMMC Practitioners (CCPs) and Assessors (CCAs) on staff ready to support you on this journey.
(SOURCE)
ACRONYMS
AU
If you’re handling Controlled
If you’re handling Controlled
AU
If you’re handling Controlled
If you’re handling Controlled
AU
If you’re handling Controlled
If you’re handling Controlled
AU
If you’re handling Controlled
If you’re handling Controlled
AU
If you’re handling Controlled
If you’re handling Controlled
AU
If you’re handling Controlled
If you’re handling Controlled
