CMMC Foundation key terms

A U.S. Department of Defense program that verifies a defense contractor's cybersecurity practices through third-party assessment and contractual requirement, rather than relying on contractor self-attestation alone.

The office within the Office of the Under Secretary of Defense for Acquisition and Sustainment that owns CMMC policy, model content, and program rollout, including publishing the model and scoping guidance.

The independent, non-governmental organization authorized by DoD to accredit and oversee the assessors and training providers that operate within the CMMC ecosystem.

The structured set of cybersecurity requirements organized into domains, practices, and processes, published by DoD as the technical standard against which contractors are assessed.

A grouping of related cybersecurity requirements within the CMMC model, such as access control or incident response, used to organize practices into logical subject areas.

A single required cybersecurity activity or control statement in the CMMC model that a contractor must implement and that an assessor evaluates for evidence of implementation.

A maturity element describing how institutionalized and repeatable a contractor's cybersecurity activities are, assessed at higher levels in the legacy maturity model structure.

A tier in the CMMC model indicating the rigor and sophistication of a contractor's cybersecurity program, with each successive level adding requirements and assessment scrutiny.

The entry CMMC level requiring basic safeguarding of federal contract information, aligned to the fifteen basic safeguarding requirements of FAR 52.204-21, verified by annual self-assessment.

The CMMC level requiring protection of controlled unclassified information using the security requirements of NIST SP 800-171, verified through third-party assessment for most contractors.

The highest CMMC level, building on Level 2 with a subset of enhanced requirements drawn from NIST SP 800-172, assessed by government assessors for programs with critical national security needs.

Information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service.

Unclassified information that the government creates or possesses, or that an entity creates for the government, requiring safeguarding or dissemination controls under law, regulation, or policy.

A National Institute of Standards and Technology publication specifying security requirements for protecting controlled unclassified information in nonfederal systems and organizations; it forms the technical basis of CMMC Level 2.

A companion NIST publication providing enhanced security requirements for protecting controlled unclassified information in critical programs, forming the technical basis for CMMC Level 3.

A structured evaluation of a contractor's implementation of CMMC practices, conducted by an authorized assessor or through self-assessment, resulting in a determination of certification status.

An evaluation a contractor performs internally against CMMC requirements, permitted at Level 1 and some Level 2 situations, with results affirmed by a senior company official.

A formal, independent assessment conducted by an accredited third party or government assessor that can result in a CMMC certificate valid for a defined period.

An assessment performed by DoD personnel rather than a commercial assessor, used for the highest CMMC level and certain sensitive programs.

A specific, verifiable statement an assessor uses to determine whether a practice is implemented, forming the evidentiary checklist applied during an assessment.

A written statement by a senior company official, such as a CEO or CISO, attesting that the contractor's self-assessment results are accurate and that practices are implemented as reported.

A document identifying remediation tasks, responsible parties, and completion dates for requirements not yet fully implemented, with limited use permitted during assessment.

A commercial organization accredited by the CMMC Accreditation Body to conduct certification assessments of contractors at Level 2 and issue findings to DoD.

An individual certified and authorized to lead a CMMC assessment team, responsible for assessment planning, evidence evaluation, and the final assessment report.

An individual who has completed required training and examination and is authorized to participate on an assessment team conducting CMMC certification assessments.

An individual credential for practitioners who support CMMC readiness, such as consultants and internal staff, demonstrating knowledge of the model and assessment process.

An entry-level individual designation for personnel who have completed foundational CMMC training and can support a contractor's preparation activities.

A certified individual authorized to deliver accredited CMMC training courses to candidates seeking assessor or practitioner credentials.

A situation in which an assessor's objectivity is compromised, such as prior consulting work for the contractor being assessed; such situations must be disclosed and avoided.

The requirement that an assessing organization have no consulting or other relationship with the contractor that could impair objective evaluation of the contractor's practices.

A company that holds or seeks contracts with the Department of Defense and therefore may be subject to CMMC requirements depending on the information it handles.

A contractor that contracts directly with DoD and is responsible for flowing down applicable cybersecurity requirements to its subcontractors.

A company that supplies goods or services to a prime contractor and may inherit CMMC obligations through contract flow-down when it handles covered information.

A contractual provision requiring a prime contractor to pass specified requirements, including CMMC obligations, to subcontractors in their agreements.

A Defense Federal Acquisition Regulation Supplement clause requiring contractors to safeguard covered defense information, report cyber incidents, and meet specified security standards.

The DFARS clause that makes CMMC certification a contract requirement, specifying the required level and timing of certification for the contractor.

The defined boundary of assets, systems, and information covered by a CMMC assessment, determined by scoping guidance and documented before assessment begins.

A separated portion of a contractor's network that handles controlled unclassified information and can be scoped for assessment independently of the broader corporate environment.

An executive designated by a contractor to sign affirmations and attest to the accuracy of assessment results on behalf of the organization.

The length of time a CMMC certificate remains in effect before reassessment is required, after which the contractor must be reassessed to maintain eligibility.