C3PAO — Certified Third-Party Assessment Organization
An organization authorized within the CMMC ecosystem to conduct independent assessments of eligible contractors seeking certification.
Defense Industrial BaseCAGE Code — Commercial and Government Entity Code
A unique identifier assigned to organizations that supply or may supply products and services to the federal government.
Defense Industrial BaseCDI — Covered Defense Information
Unclassified controlled technical information or other Controlled Unclassified Information that requires safeguarding and is provided to a defense contractor or handled in support of a Department of Defense contract.
Defense Industrial BaseCMMC — Cybersecurity Maturity Model Certification
A Department of Defense program for assessing whether defense contractors and subcontractors have implemented required safeguards for Federal Contract Information and Controlled Unclassified Information.
Defense Industrial BaseCovered Contractor Information System
A contractor-owned or contractor-operated information system that processes, stores, or transmits covered information associated with a federal or defense contract.
Defense Industrial BaseCTI — Controlled Technical Information
Technical information with military or space applications that is subject to controls governing access, use, disclosure, and dissemination.
Defense Industrial BaseCTI — Cyber Threat Intelligence
Information collected and analyzed about cyber threats, threat actors, capabilities, infrastructure, indicators, and likely intentions to support defensive decisions.
IntelligenceCUI — Controlled Unclassified Information
Information created or possessed by or for the U.S. government that is not classified but must be safeguarded or subject to dissemination controls under applicable law, regulation, or government-wide policy.
Defense Industrial BaseCyber Incident
An event that jeopardizes, or could jeopardize, the confidentiality, integrity, or availability of information or an information system.
CybersecurityDFARS — Defense Federal Acquisition Regulation Supplement
A supplement to the Federal Acquisition Regulation containing acquisition requirements specifically applicable to the U.S. Department of Defense.
Defense Industrial BaseDIB — Defense Industrial Base
The network of organizations, facilities, suppliers, and resources that provides products and services supporting national defense.
Defense Industrial BaseEAR — Export Administration Regulations
U.S. regulations administered by the Commerce Department governing exports, reexports, and transfers of commercial, dual-use, and certain military items, software, and technology.
Export ControlsFAR — Federal Acquisition Regulation
The principal set of rules governing how executive agencies of the United States federal government acquire goods and services.
Defense Industrial BaseFCI — Federal Contract Information
Nonpublic information provided by or generated for the federal government under a contract to develop or deliver a product or service. Publicly available information and basic payment-processing information are excluded.
Defense Industrial BaseFIPS — Federal Information Processing Standards
Standards and guidelines adopted for use by federal computer systems, including requirements involving security, interoperability, and data processing.
ComputingFlow-Down Requirement
A contractual obligation requiring a prime contractor to include specified clauses or requirements in applicable subcontracts.
Defense Industrial BaseITAR — International Traffic in Arms Regulations
U.S. regulations administered by the State Department governing exports of defense articles, defense services, and related technical data on the U.S. Munitions List (USML).
Export ControlsNIST — National Institute of Standards and Technology
A federal agency that develops standards, guidelines, measurements, and technical resources supporting innovation, cybersecurity, and technology.
ComputingNIST SP 800-171
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations: A NIST publication specifying security requirements for protecting Controlled Unclassified Information in nonfederal systems and organizations.
CybersecurityOFAC — Office of Foreign Assets Control
An office within the U.S. Department of the Treasury that administers and enforces economic and trade sanctions supporting U.S. foreign policy and national security goals. Sanctions may include asset freezes and restrictions on transactions involving…
Export ControlsPOA&M — Plan of Action and Milestones
A document identifying security deficiencies, required corrective actions, responsible resources, planned milestones, and anticipated completion dates.
CybersecurityRMF — Risk Management Framework
A structured process for identifying, assessing, managing, and monitoring security and privacy risks throughout the life cycle of an information system.
CybersecuritySPRS — Supplier Performance Risk System
A Department of War system used to collect and retrieve supplier performance and risk information, including certain NIST SP 800-171 assessment results.
Defense Industrial BaseSSP — System Security Plan
A formal document describing an information system, its operating environment and boundaries, its security requirements, and the safeguards implemented or planned to satisfy those requirements.
Cybersecurity