ResourcesGlossary
What is DIBCAC?
DIBCAC is the DoD organization that conducts government-led high assessments and CMMC Level 3 assessments.
DIBCAC stands for Defense Industrial Base Cybersecurity Assessment Center.
The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) performs the government-led assessments that sit above the C3PAO tier — including CMMC Level 3, which adds NIST SP 800-172 enhanced controls.
DIBCAC assessments also produce the authoritative scores that have exposed gaps between self-reported SPRS numbers and reality, as in the LOGZONE case.
The prior schedule placed the DIBCAC-assessed Phase 3 transition on November 10, 2027, but the Department suspended pending and future implementation milestones while it reviews the CMMC program.
Related records
Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.
- proof.state
- Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- proof.change
- Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
- proof.agency
- Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- architecture
- Architecture. How the chain is built and where the evidence is stored in each delivery mode.
- authorization
- Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
- baseline
- NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.
Related terms and reading
Know the term. Then see the record behind it.
- Published
- Last updated