CMMC CCA key terms

A U.S. Department of Defense program that verifies a defense contractor has implemented required cybersecurity practices, using tiered levels and assessments performed either by authorized third parties or, at some levels, by the company itself.

The non-profit accreditation body that administers the CMMC ecosystem, including accrediting C3PAOs, authorizing individual assessors, maintaining the Code of Professional Conduct, and overseeing the quality of CMMC assessments.

A firm accredited by The Cyber AB to conduct CMMC Level 2 certification assessments of defense contractors; only an accredited C3PAO may produce certified Level 2 assessment results.

An individual credentialed by The Cyber AB to lead or perform CMMC assessments on behalf of a C3PAO, having met the exam, training, experience, and conduct requirements of that credential.

An entry-level CMMC credential for individuals who support assessments under the direction of a certified assessor; it is a prerequisite step toward becoming a CCA.

The ethical and professional standards that CMMC assessors and professionals agree to follow, covering integrity, objectivity, confidentiality, competence, and the avoidance or disclosure of conflicts of interest.

A situation in which an assessor or assessment organization holds a personal, financial, or business interest that could bias assessment judgments; it must be disclosed and mitigated, or the engagement declined.

A DoD contract clause requiring contractors to provide adequate security for covered defense information, typically by implementing NIST SP 800-171, and to report cyber incidents to DoD within stated timeframes.

The DoD contract clause that requires a contractor to achieve and maintain the CMMC status specified in the contract and to affirm continued compliance at the required intervals.

A DoD system where contractors post their NIST SP 800-171 self-assessment score and, where applicable, their CMMC status so contracting officers can verify eligibility before award.

The official CMMC document that defines the phases, activities, inputs, and outputs assessors follow when planning, scoping, conducting, and reporting a CMMC assessment.

The contractor organization that is the subject of a CMMC assessment and is responsible for defining scope, providing evidence, and hosting the assessment team during fieldwork.

The process of identifying which systems, assets, personnel, and locations handle or protect CUI, so the assessment covers everything relevant and excludes what is genuinely out of scope.

A system or component that processes, stores, or transmits Controlled Unclassified Information; such assets must be fully assessed against every applicable Level 2 practice.

An asset that provides security functions protecting CUI assets, such as a firewall, logging platform, or backup server; only its protective capabilities are assessed, not unrelated business functions.

An asset that can but is not intended to handle CUI, such as a general-purpose laptop with email; the contractor manages the risk through policy, and only a defined subset of practices is assessed on it.

An asset with narrow or unusual function, such as operational technology, IoT devices, or test equipment, that cannot be assessed against all practices; only a defined subset is evaluated and documented in the scope.

A logically or physically separated portion of a network that holds CUI assets and is bounded by security controls; the enclave and the assets protecting it form the assessed boundary.

A pre-assessment gap review, often performed by the OSA or a consultant before the official C3PAO assessment, to find missing practices and repair documentation or technical shortfalls.

The NIST publication that specifies security requirements across 14 families for protecting CUI in nonfederal systems; it is the technical baseline for CMMC Level 2.

The companion NIST publication that converts each 800-171 requirement into assessment objectives and assessment procedures using examination, interview, and testing methods.

A single numbered 800-171 statement, such as limiting system access to authorized users, that a contractor must satisfy; the publication contains a fixed set of these across its families.

A specific, testable statement in NIST SP 800-171A that defines what an assessor must determine about a requirement, using examination, interview, and testing methods.

A CMMC requirement derived from a NIST SP 800-171 requirement; a Level 2 assessment evaluates the full set of these practices, and each is judged met or not met.

A contractor document describing system boundaries, CUI flows, implemented controls, and how each 800-171 requirement is satisfied; it is a primary evidence source and the anchor for the assessment.

A value or choice left to the contractor within an 800-171 requirement, such as a time period, threshold, or role; the assessor verifies the contractor defined it and applies it consistently.

One of the 14 topical groupings of 800-171 requirements, such as Access Control, Incident Response, or Audit and Accountability, each identified by a two-letter abbreviation.

Verifiable information such as documents, screenshots, system settings, logs, or interview statements that shows whether a practice is implemented; it must be recorded and traceable to the practice assessed.

The three assessment methods from NIST SP 800-171A: examining documents and system artifacts, interviewing personnel, and testing system behavior to confirm a practice is implemented.

Selecting a representative subset of people, systems, or records to assess when the full population is too large, with sample size and rationale documented to support the conclusion.

Additional independent evidence that supports or contradicts an initial observation, used to raise confidence before concluding that a practice is met or not met.

The two tests evidence must pass before a conclusion: enough of it in quantity and coverage, and reliable and relevant in quality to the practice being assessed.

A structured conversation with contractor personnel, such as system administrators or executives, used to gather evidence about how practices are implemented and to clarify documentation.

The assessor's reasoned conclusion based on evidence and assessment standards; it must be objective, documented, and defensible, never driven by preference, convenience, or pressure from the client.

A contractor's documented list of practices not yet met, with planned remediation actions, owners, resources, and completion dates; it may support a conditional CMMC status under defined limits.

A Level 2 status granted when nearly all practices are met and a small permitted set of unmet practices is covered by an accepted POA&M, with a deadline to close those items.

The status issued when all applicable Level 2 practices are met at assessment, or when a conditional status is closed after the POA&M items are remediated and verified.

The assessor's written deliverable recording each practice's result, the evidence relied on, and any unmet practices; it is submitted for quality review and becomes part of the certification record.

The closing meeting at the end of fieldwork where the assessor summarizes preliminary results, confirms unmet practices, and explains next steps such as reporting and POA&M requirements.

A yearly statement by a contractor's senior official confirming that the organization continues to meet its CMMC requirements and that the information posted in SPRS remains accurate.