Understand the language of readiness.

CMMC

Cybersecurity Maturity Model Certification: the DoD program for assessing specified safeguards in contractor information systems.

FCI

Federal Contract Information: nonpublic information provided by or generated for the government under a contract, with the exclusions in FAR 52.204-21.

CUI

Controlled Unclassified Information: information subject to safeguarding or dissemination controls under applicable law, regulation, or governmentwide policy.

C3PAO

CMMC Third-Party Assessment Organization: the organization performing a Level 2 certification assessment under the program.

DIBCAC

Defense Industrial Base Cybersecurity Assessment Center at DCMA; conducts Level 3 certification assessments on behalf of the government.

SPRS

Supplier Performance Risk System: the official system where CMMC status is stored and relevant affirmations are maintained.

SSP

System Security Plan: describes the system environment and the implementation of applicable security requirements.

POA&M

Plan of Action and Milestones: in the conditional CMMC pathway, a restricted plan requiring remediation and appropriate closeout within 180 days.

Assessment scope

The defined systems and assets evaluated under the relevant CMMC pathway and scoping requirements.

Affirming official

The authorized senior representative responsible for affirming the organization’s continuing compliance.

ESP

External Service Provider: a provider whose services and information handling can affect CMMC scope and responsibilities.

CSP

Cloud Service Provider: assess the specific offering, configuration, and applicable cloud requirements when CUI is involved.

CRM

Customer Responsibility Matrix: identifies the allocation of security responsibilities between the customer and provider.

Readiness

Preparation and ongoing work toward implementing, documenting, and demonstrating requirements. It is distinct from an official assessment outcome.

Full definitions and authorities →