CMMC // GLOSSARY

CMMC & NIST 800-171 terms, defined.

● 10 TERMS

The acronyms that run the Defense Industrial Base, in plain English. Each term links to a fuller explanation and the guides where it matters most for your CMMC Level 2 readiness.

CUIControlled Unclassified Information: CUI is government-created or -owned information that requires safeguarding under law, regulation, or government-wide policy, but is not classified.
FCIFederal Contract Information: FCI is information provided by or generated for the government under a contract that is not intended for public release — the trigger for CMMC Level 1.
SPRSSupplier Performance Risk System: SPRS is the DoD system where contractors post their NIST 800-171 self-assessment score and, under CMMC, their certification status and affirmations.
C3PAOCMMC Third-Party Assessment Organization: A C3PAO is an organization authorized by the Cyber AB to conduct official CMMC Level 2 certification assessments.
NIST SP 800-171: NIST SP 800-171 is the federal standard of 110 security controls for protecting CUI in non-federal systems — the technical basis of CMMC Level 2.
SSPSystem Security Plan: An SSP is the document describing how an organization implements each required security control across its in-scope environment.
POA&MPlan of Action and Milestones: A POA&M is a tracked plan for remediating security controls that are not yet fully implemented, with owners and target dates.
DIBCACDefense Industrial Base Cybersecurity Assessment Center: DIBCAC is the DoD organization that conducts government-led high assessments and CMMC Level 3 assessments.
DFARS 252.204-7012: DFARS 7012 is the long-standing clause requiring contractors to safeguard covered defense information per NIST 800-171 and report cyber incidents within 72 hours.
CUI Enclave: A CUI enclave is a segmented, hardened environment that isolates CUI so only that boundary — not the whole company — falls in CMMC scope.

STOP GUESSING YOUR SCORE

Know exactly where you stand.

Take the free CMMC readiness assessment, or run your dates through the deadline calculator to see whether your timeline still closes before November 10, 2026.

Free readiness assessment Deadline calculator