CMMC // GLOSSARY

CMMC & NIST 800-171 terms, defined.

The acronyms that run the Defense Industrial Base, in plain English. Each term links to a fuller explanation and the guides where it matters most for your CMMC Level 2 readiness.

CUIControlled Unclassified Information
CUI is government-created or -owned information that requires safeguarding under law, regulation, or government-wide policy, but is not classified.
FCIFederal Contract Information
FCI is information provided by or generated for the government under a contract that is not intended for public release — the trigger for CMMC Level 1.
SPRSSupplier Performance Risk System
SPRS is the DoD system where contractors post their NIST 800-171 self-assessment score and, under CMMC, their certification status and affirmations.
C3PAOCMMC Third-Party Assessment Organization
A C3PAO is an organization authorized by the Cyber AB to conduct official CMMC Level 2 certification assessments.
NIST SP 800-171
NIST SP 800-171 is the federal standard of 110 security controls for protecting CUI in non-federal systems — the technical basis of CMMC Level 2.
SSPSystem Security Plan
An SSP is the document describing how an organization implements each required security control across its in-scope environment.
POA&MPlan of Action and Milestones
A POA&M is a tracked plan for remediating security controls that are not yet fully implemented, with owners and target dates.
DIBCACDefense Industrial Base Cybersecurity Assessment Center
DIBCAC is the DoD organization that conducts government-led high assessments and CMMC Level 3 assessments.
DFARS 252.204-7012
DFARS 7012 is the long-standing clause requiring contractors to safeguard covered defense information per NIST 800-171 and report cyber incidents within 72 hours.
CUI Enclave
A CUI enclave is a segmented, hardened environment that isolates CUI so only that boundary — not the whole company — falls in CMMC scope.
STOP GUESSING YOUR SCORE

Know exactly where you stand.

Take the free CMMC readiness assessment, or run your dates through the planning calculator to work backward from your next contract, prime, or internal readiness date.

Free readiness assessment Readiness planner