CMMC CCP key terms

The non-profit accreditation body recognized by the Department of Defense that authorizes C3PAOs, certifies individual assessors and professionals, and oversees the integrity and quality of the CMMC ecosystem.

An assessment firm authorized by the Cyber AB to conduct CMMC Level 2 certification assessments of organizations seeking certification, and to submit the resulting results to the Department of Defense.

An individual credentialed by the Cyber AB to lead or participate in CMMC assessments as part of a C3PAO team, having met training, examination, experience, and continuing-education requirements.

A contractor or subcontractor pursuing a CMMC certification that is the subject of an assessment; it defines the scope, implements practices, and supplies evidence to the assessment team.

An individual listed in the Cyber AB registry who has completed foundational CMMC training but is not a certified assessor; may help organizations prepare for an assessment.

The Department of Defense component that performs government-led cybersecurity assessments of contractors, including Level 3 assessments and participation in voluntary joint assessments with a C3PAO.

The contract clause requiring DoD contractors to achieve and maintain the CMMC level stated in the contract, to affirm continued compliance annually, and to flow the requirement to applicable subcontractors.

The foundational level, aimed at protecting Federal Contract Information, built from 17 practices derived from FAR 52.204-21 and verified through an annual self-assessment with senior official affirmation.

The level protecting Controlled Unclassified Information by requiring all 110 security requirements of NIST SP 800-171, verified by self-assessment or, when a contract requires it, by a C3PAO certification assessment.

The highest CMMC level, adding selected enhanced requirements from NIST SP 800-172 on top of all Level 2 practices to defend CUI against advanced persistent threats; assessed by DIBCAC.

A NIST publication of enhanced security requirements for protecting Controlled Unclassified Information in critical programs, supplying the additional practices that distinguish CMMC Level 3 from Level 2.

A specific, testable statement describing what must be true for a practice to be judged met; assessors verify each objective by examining, interviewing, and testing the organization's evidence.

A document listing requirements not yet satisfied, the remediation actions planned, responsible parties, and target dates; its use during certification is limited and closure deadlines apply.

A Level 2 status granted when a limited number of requirements remain unmet but are covered by an approved plan of action; it becomes full certification once those items are closed within the allowed period.

A yearly statement by a senior official confirming the organization still meets the requirements of its CMMC level and that its submitted assessment score remains accurate and current.

A numeric score computed from a contractor's NIST SP 800-171 assessment results using DoD's scoring methodology, submitted by the contractor and used by DoD in source selection decisions.

Unclassified information that law, regulation, or government-wide policy requires to be protected or controlled, and that must be marked, handled, and safeguarded according to federal requirements.

Information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service, excluding information supplied by the government to the public.

Any component of an organization's environment that can store, process, or transmit data, or that supports such operations; assets are categorized to decide whether they belong inside the assessment scope.

An asset that stores, processes, or transmits Controlled Unclassified Information, or that can access it; such assets are always in scope and must satisfy the applicable set of CMMC practices.

An asset that does not itself handle CUI but enforces or delivers a security capability protecting in-scope assets, such as a firewall, logging platform, or authentication server; it is included in scope.

An asset that could introduce risk to in-scope assets if compromised but does not itself handle CUI, and that may be excluded from assessment scope when documented risk mitigation exists.

A defined, logically or physically separated portion of an environment where CUI is handled and protected, allowing systems outside the enclave to remain outside the assessment scope.

An outside entity that provides services to an organization and may store, process, or transmit its CUI, such as a cloud provider; the relationship and its protections must be documented in scoping.

The documented set of assets, people, facilities, and processes that the assessment team will examine because they handle CUI or provide security protection for assets that do.

A document describing the system boundary, architecture, and how each security requirement is implemented for the CUI environment; assessors rely on it to understand scope and plan testing.

The Cyber AB's published methodology describing how assessment organizations plan, conduct, and report CMMC assessments, including team roles, phases, evidence requirements, and required documentation.

The opening phase of a CMMC assessment in which the assessment team reviews the organization's scope, system security plan, and supporting documentation to plan testing and flag potential issues.

Verifiable information such as documents, records, configurations, logs, or observed conditions that shows whether an assessment objective is satisfied; it must be recorded and retained by the team.

A documented determination by the assessment team about whether a given practice or objective is met or not met, supported by recorded evidence and carried into the assessment report.

A follow-up assessment performed to confirm that requirements previously found unmet have been remediated, commonly used when a conditional certification is later upgraded to full certification.

A voluntary assessment in which DIBCAC and a C3PAO evaluate an organization at Level 2 together, giving contractors early exposure to assessment expectations before requirements appear in contracts.

A situation where an assessor, team member, or their firm holds a personal, financial, or business interest that could bias assessment results; it must be disclosed and avoided or managed.

The principle that assessment judgments rest solely on objective evidence rather than on commercial pressure, personal relationships, or financial gain, and that assessors remain free of bias throughout.

The duty not to disclose or misuse an organization's sensitive information, including CUI, security documentation, and assessment results, encountered during assessment work; formal agreements typically reinforce this obligation.

The Cyber AB's enforceable ethical standards for certified professionals and assessors, addressing integrity, objectivity, competence, confidentiality, and the avoidance or management of conflicts of interest.

The formal record produced by the assessment team describing scope, methods, evidence reviewed, findings, and results, which supports the certification decision and later quality reviews.