CMMC-RP key terms

The Department of Defense framework that verifies a defense contractor's cybersecurity practices through phased assessments, requiring increasingly rigorous third-party validation as contracts demand higher levels of protection.

One of three progressive tiers (Level 1 Foundational, Level 2 Advanced, Level 3 Expert) that sets the required cybersecurity practices and assessment type a contractor must satisfy for a given contract.

The DoD office that owns and governs the CMMC program, issuing the controlling policy and overseeing how requirements flow into contracts and assessments.

The independent organization authorized by DoD to accredit and oversee assessment organizations and individual assessors within the CMMC ecosystem, including managing the assessor credentialing process.

An accredited firm authorized to conduct Level 2 certification assessments of defense contractors and issue findings that support a certification decision by the accreditation body.

An individual who has met the accreditation body's qualification requirements and is authorized to perform assessments on behalf of a CMMC Third-Party Assessment Organization.

An entry-level credentialed individual who supports assessment activities under supervision, typically performing evidence gathering and documentation review rather than leading assessment conclusions.

The structured set of cybersecurity practices organized by domains and capabilities, mapped to widely recognized security standards, that defines what a contractor must implement at each level.

A grouping of related cybersecurity practices within the CMMC Model, such as access control or incident response, used to organize requirements and assessment activities.

A cluster of related practices within a model domain that together achieve a specific security outcome, used to show progression between levels.

A single required cybersecurity activity stated in the model, expressed as an outcome the contractor must achieve and against which assessors evaluate implementation.

A specific, testable statement derived from a practice that defines what an assessor must confirm through evidence before determining the practice is met.

An annual affirmation by the contractor's senior official that the required foundational practices are implemented, with results recorded in the DoD supplier performance system.

An annual self-conducted evaluation against the advanced practices, permitted only for certain contract types, with results affirmed by a senior official and reported to DoD.

A structured evaluation of a contractor's implementation of required practices, conducted by the contractor or an accredited assessor depending on the level and contract requirements.

The defined boundary of assets, networks, facilities, and personnel that handle or protect controlled unclassified information and are therefore subject to evaluation.

Government-created or owned information that requires safeguarding under law, regulation, or policy, and which the CMMC requirements are designed to protect.

A segregated portion of a contractor's environment that isolates controlled unclassified information from other systems, often used to limit the scope of an assessment.

Documentation, records, configurations, or observed conditions that an assessor uses to determine whether an assessment objective is satisfied, such as screenshots, policies, or logs.

An assessor's conclusion about whether a practice or objective is met, not met, or not applicable, supported by the evidence gathered during the assessment.

A document identifying remediation tasks, responsible parties, resources, and completion dates for practices not yet implemented, used to manage gaps before or after assessment.

A formal attestation by a contractor's senior leader that self-assessment results are accurate and that required practices are implemented, carrying legal and contractual weight.

The formal status granted after a successful third-party assessment confirming that a contractor meets the practices required for the applicable level, valid for a defined period.

The DoD repository where contractors record self-assessment scores and affirmations, which contracting officers use to evaluate supplier risk before award.

A preliminary review comparing a contractor's current security posture against required practices to identify missing controls and prioritize remediation before a formal assessment.

The work of implementing or correcting security controls to close identified gaps, tracked through milestones and verified before an assessment or certification decision.

A document describing a contractor's system boundary, environment, and how each required security requirement is implemented, serving as a primary evidence source for assessors.

The unintended expansion of an assessment boundary or project beyond what is required, which increases cost and effort and should be controlled through clear scoping decisions.

An external vendor that operates or secures part of a contractor's information environment, whose responsibilities must be defined and evidenced within the assessment scope.

A contractual requirement passed from a prime contractor to its subcontractors obligating them to meet specified cybersecurity practices when handling covered information.

A situation where an assessor's or consultant's personal, financial, or business interests could bias assessment conclusions, requiring disclosure and often disqualification from the engagement.

The principle that assessors must reach conclusions free from influence by the contractor, including prohibitions on assessing organizations they have recently advised or been employed by.

The separation that prevents a firm or individual from both advising a contractor on remediation and later assessing that same contractor's compliance, protecting assessment objectivity.

The ethical standards binding credentialed professionals in the ecosystem, covering integrity, objectivity, confidentiality, competence, and compliance with accreditation body requirements.

The duty to protect sensitive contractor information, including security configurations and assessment evidence, from unauthorized disclosure during and after an engagement.

The standard requiring assessors and consultants to apply the skill, diligence, and judgment that a competent professional would exercise under similar circumstances.

The obligation to accept only work for which one has the necessary knowledge, training, and experience, and to maintain skills through continuing professional education.

The requirement to preserve assessment records, working papers, and supporting documentation for a defined period so conclusions can be substantiated or reviewed later.