Here is a list of glossary terms relevant to the Cybersecurity Maturity Model Certification (CMMC) and compliance. It may be long and seem excessive but we ensure you this is just the main terms you will run across frequently.

  1. CMMC – Cybersecurity Maturity Model Certification: A DoD initiative to enhance cybersecurity across the Defense Industrial Base (DIB). It has five levels, each with increasing requirements based on the sensitivity of the information handled.
  2. Organization Seeking Assessment (OSA) – Refers to any organization that is preparing to undergo a CMMC assessment, intending to achieve certification for compliance with the required cybersecurity standards.
  3. External Service Providers (ESPs) – Companies or organizations that provide outsourced services (such as IT or cloud services) that support CMMC compliance but do not process or handle Controlled Unclassified Information (CUI) directly.
  4. Controlled Unclassified Information (CUI) – Sensitive but unclassified information that requires protection per federal standards. For CMMC, it’s essential to secure CUI to meet specific cybersecurity controls in NIST SP 800-171.
  5. Federal Contract Information (FCI) – Information provided by or generated for the government under a contract that is not intended for public release. CMMC Level 1 requirements cover basic safeguards for FCI.
  6. Classified National Security Information – Information that requires protection due to its potential impact on national security. This information is generally outside CMMC’s scope but remains governed by separate classification standards.
  7. Supplier Performance Risk System (SPRS) – A DoD database used to track contractor risk scores related to cybersecurity and performance. Contractors input their NIST SP 800-171 scores here, affecting their ability to secure contracts.
  8. 48 CFR 52.204–21 (FAR Clause 52.204–21) – The Federal Acquisition Regulation (FAR) clause that outlines basic safeguarding requirements for protecting FCI on federal contracts.
  9. DFARS Clause 252.204-7020 – A DoD supplement to FAR that requires contractors to report their compliance with NIST SP 800-171 requirements via self-assessment and submission to SPRS.
  10. Federal Risk and Authorization Management Program (FedRAMP) – A government-wide program that standardizes security requirements for cloud services. CMMC requires FedRAMP Moderate baseline for any cloud services handling CUI.
  11. NIST SP 800-171 – A National Institute of Standards and Technology (NIST) publication that provides security controls specifically designed to protect CUI within non-federal information systems.
  12. (AC) Access Control – A security domain in NIST SP 800-171, defining measures to limit access to authorized users.
  13. Accreditation Body (AB) – The entity authorized by DoD to oversee CMMC’s assessment and certification process, including training assessors and providing oversight.
  14. (APT) Advanced Persistent Threat – A sophisticated, prolonged cyberattack often associated with state-sponsored groups. CMMC Level 3 is designed to counter such threats.
  15. (AT) Awareness and Training – Another security domain in NIST SP 800-171, focusing on providing cybersecurity training to users within the organization.
  16. (C3PAO) CMMC Third-Party Assessment Organization – Certified organizations authorized to conduct CMMC assessments, ensuring organizations meet necessary security requirements.
  17. (CA) Security Assessment – This domain within NIST SP 800-171 involves policies and procedures to periodically assess and ensure effectiveness of security controls.
  18. CAICO – CMMC Assessors and Instructors Certification Organization, responsible for training and certifying assessors and instructors within the CMMC ecosystem.
  19. CAGE (Commercial and Government Entity) – A unique identifier for federal contractors, often used in conjunction with the System for Award Management (SAM).
  20. CNC (Computerized Numerical Control) – A technology used in manufacturing that is relevant to cybersecurity in protecting critical operational technology.
  21. CoPC (Code of Professional Conduct) – A set of guidelines governing the behavior and responsibilities of CMMC assessors and other professionals in the accreditation body.
  22. CSP (Cloud Service Provider) – Companies offering cloud-based services, which, under CMMC requirements, need FedRAMP authorization when managing CUI.
  23. DCMA (Defense Contract Management Agency) – DoD agency that oversees DIB cybersecurity assessments, providing certifications through DIBCAC.
  24. DFARS (Defense Federal Acquisition Regulation Supplement) – Regulations added to FAR specific to defense contracting, including DFARS 252.204-7012 and DFARS 252.204-7020, which mandate cybersecurity standards.
  25. DIB (Defense Industrial Base) – Refers to companies and contractors that provide products and services to DoD.
  26. DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) – A DCMA group responsible for performing cybersecurity assessments of DIB contractors.
  27. DoD (Department of Defense) – The U.S. federal department responsible for coordinating and overseeing CMMC implementation across defense contracts.
  28. DoDI (Department of Defense Instruction) – A DoD directive providing guidance on implementing policies, including those related to cybersecurity.
  29. eMASS (Enterprise Mission Assurance Support Service) – A DoD tool for managing cybersecurity assessments and authorizations.
  30. ESP (External Service Provider) – Companies that support DoD contractors by providing security-related services or technology solutions without directly handling FCI or CUI.
  31. FAR (Federal Acquisition Regulation) – Regulations governing federal procurement, which apply broadly across U.S. government contracting.
  32. FedRAMP – Federal Risk and Authorization Management Program, which ensures cloud services meet baseline security standards for federal data handling.
  33. GFE (Government Furnished Equipment) – Equipment provided by the government to contractors, often subject to strict handling and security requirements.
  34. IA (Identification and Authentication) – Security controls that confirm the identity of users before granting access to systems.
  35. ICS (Industrial Control System) – Technology that manages and controls industrial processes, particularly relevant to CMMC for operational technology security.
  36. IIoT (Industrial Internet of Things) – Connected devices in industrial settings that may be impacted by cybersecurity risks.
  37. IoT (Internet of Things) – A network of connected devices that can be vulnerable if not properly secured, particularly relevant for CMMC when these handle sensitive data.
  38. IR (Incident Response) – Security protocols for detecting, responding to, and mitigating cybersecurity incidents.
  39. IS (Information System) – Systems used to manage data, which are subject to CMMC cybersecurity controls.
  40. IEC (International Electrotechnical Commission) – A standards organization that, along with ISO, develops global standards for cybersecurity.
  41. ISO/IEC (International Organization for Standardization / International Electrotechnical Commission) – Two organizations that jointly publish cybersecurity standards (e.g., ISO/IEC 27001), providing an alternative framework to NIST.
  42. IT (Information Technology) – Computer-based technology systems that are integral to managing FCI and CUI under CMMC.
  43. L# (CMMC Level Number) – Indicates the cybersecurity level required for a given contract, ranging from L1 (basic FCI protection) to L3 (protection against APTs).
  44. MA (Maintenance) – A NIST SP 800-171 security domain focusing on proper maintenance and upkeep of information systems.
  45. MP (Media Protection) – Security domain related to controlling access to media containing FCI or CUI.
  46. MSSP (Managed Security Service Provider) – Companies that provide outsourced monitoring and management of security systems.
  47. NARA (National Archives and Records Administration) – U.S. agency responsible for CUI program oversight, ensuring proper handling and marking of sensitive information.
  48. NAICS (North American Industry Classification System) – Classification system used to categorize business establishments for contracting and other purposes.
  49. NIST (National Institute of Standards and Technology) – U.S. agency that develops standards, including cybersecurity guidelines essential to CMMC.
  50. ODP (Organization-Defined Parameter) – Customizable elements within cybersecurity standards that organizations can adjust based on their risk profile.
  51. OSA (Organization Seeking Assessment) – Organizations actively preparing for or undergoing a CMMC assessment.
  52. OSC (Organization Seeking Certification) – Refers to any entity that must achieve CMMC certification to qualify for certain DoD contracts.
  53. OT (Operational Technology) – Hardware and software that detects or causes changes through direct monitoring of physical devices.
  54. PI (Provisional Instructor) – A designation for CMMC instructors authorized to teach training courses under provisional status.
  55. PIEE (Procurement Integrated Enterprise Environment) – A DoD platform for acquisition and procurement, supporting contractor compliance.
  56. PII (Personally Identifiable Information) – Any data that could identify an individual, subject to cybersecurity and privacy protections.
  57. PLC (Programmable Logic Controller) – An industrial digital computer used in manufacturing automation, relevant to CMMC for OT security.
  58. POA&M (Plan of Action and Milestones) – A documented plan to address and remediate cybersecurity gaps over time.
  59. PRA (Paperwork Reduction Act) – U.S. law requiring agencies to minimize the paperwork burden on businesses and individuals.
  60. RM (Risk Management) – A process of identifying, assessing, and mitigating risks, integral to cybersecurity and CMMC.
  61. SAM (System for Award Management) – A government system that maintains contractor data for eligibility and compliance with federal contracts.
  62. SC (System and Communications Protection) – Security controls ensuring system integrity, especially communications security.
  63. SCADA (Supervisory Control and Data Acquisition) – Industrial control system for large-scale monitoring, relevant for CMMC if sensitive data is managed.
  64. SI (System and Information Integrity) – A set of controls within NIST SP 800-171 to protect the integrity of systems and data, ensuring timely identification of security threats.
  65. SIEM (Security Information and Event Management) – A technology that provides real-time analysis of security alerts generated by hardware and applications, helping to detect and respond to threats.
  66. SSP (System Security Plan) – A detailed document outlining how an organization plans to meet cybersecurity requirements, including descriptions of security controls and implementation.
  67. SP (Special Publication) – Refers to publications by NIST, such as NIST SP 800-171, which provide guidelines and standards for cybersecurity.
  68. SPD (Security Protection Data) – Data focused on protecting sensitive information, particularly in environments like the defense industrial base (DIB).
Tags: