--- title: Comprehensive CMMC Glossary of Terms description: Access a comprehensive CMMC glossary that clarifies essential compliance terms and concepts, helping you navigate compliance with confidence. image: https://info.systemsengineering.com/hubfs/CMMC%20Glossary.png --- [![header-logo](https://info.systemsengineering.com/hs-fs/hubfs/header-logo.png?width=138&name=header-logo.png)](https://www.systemsengineering.com) 888.624.6737 ![Spyglass](https://www.systemsengineering.com/wp-content/uploads/search-google-e1751908066340.png) - [Careers](https://www.systemsengineering.com/about/careers/) - [Blog](https://blog.systemsengineering.com/blog) - [Events](https://www.systemsengineering.com/news-resources/events/) - [Case Studies](https://www.systemsengineering.com/case-studies/) - [Client Center](https://www.systemsengineering.com/client-center/) - [CONTACT](https://www.systemsengineering.com/about/contact/) - IT Services - [Managed IT](https://www.systemsengineering.com/managed-it/) - [IT Essentials](https://www.systemsengineering.com/managed-it/it-essentials/) - [Microsoft Services](https://www.systemsengineering.com/managed-it/microsoft-services/) - [Modern Workplace](https://www.systemsengineering.com/managed-it/modern-desktop/) - [Help Desk](https://www.systemsengineering.com/managed-it/help-desk/) - [Network Assessment](https://www.systemsengineering.com/managed-it/network-assessment/) - [IT Consulting Services](https://www.systemsengineering.com/it-consulting-services/) - [Compliance](https://www.systemsengineering.com/compliance) - [IT Policies-as-a-Service](https://www.systemsengineering.com/it-consulting-services/it-policies-as-a-service/) - [Virtual CIO](https://www.systemsengineering.com/it-consulting-services/virtual-cio/) - [Engineering Services](https://www.systemsengineering.com/it-consulting-services/engineering-services/) - [Project Management](https://www.systemsengineering.com/it-consulting-services/project-management/) - [Business Continuity](https://www.systemsengineering.com/it-consulting-services/business-continuity/) - [Assessments & Gap Analyses](https://www.systemsengineering.com/it-consulting-services/get-it-assessed/) - [Software Services](https://www.systemsengineering.com/software-services/) - [Application Development](https://www.systemsengineering.com/software-services/application-development/) - [SharePoint](https://www.systemsengineering.com/software-services/sharepoint/) - [Database Services](https://www.systemsengineering.com/software-services/database-services/) - [IT Security](https://www.systemsengineering.com/security/) - [Adaptive Cybersecurity Framework (aCSF)](https://www.systemsengineering.com/se-adaptive-cybersecurity-framework-acsf/) - [Cloud Security](https://www.systemsengineering.com/security/cloud-security/) - [Cloud Security Resources](https://www.systemsengineering.com/security/cloud-security/cloud-security-resources/) - [Security Awareness Training](https://www.systemsengineering.com/security/security-awareness-training/) - [Cybersecurity Risk Assessment](https://www.systemsengineering.com/security/cybersecurity-risk-assessment/) - [Compliance](https://www.systemsengineering.com/compliance/) - [Cybersecurity Maturity Model Certification (CMMC)](https://www.systemsengineering.com/compliance/cmmc-compliance/) - [CMMC Compliance Service](https://www.systemsengineering.com/compliance/cmmc-compliance/cmmc-compliance-service/) - [CMMC Resources](https://www.systemsengineering.com/compliance/cmmc-compliance/cmmc-resources/) - [National Credit Union Administration (NCUA)](https://www.systemsengineering.com/compliance/ncua/) - [Cloud Services](https://www.systemsengineering.com/cloud-services/) - [Cloud Management](https://www.systemsengineering.com/cloud-services/cloud-management/) - [Cloud Security](https://www.systemsengineering.com/security/cloud-security/) - [Office 365 Migration & Support](https://www.systemsengineering.com/cloud-services/office-365-migration-support/) - [Office 365 Backup](https://www.systemsengineering.com/cloud-services/office-365-migration-support/office-365-backup/) - [Cloud Assessment](https://www.systemsengineering.com/cloud-services/cloud-assessment/) - [Industries](https://www.systemsengineering.com/industries/) - [Construction](https://www.systemsengineering.com/industries/construction/) - [Education](https://www.systemsengineering.com/industries/education/) - [Financial Services](https://www.systemsengineering.com/industries/financial-services/) - [Accountants & Wealth Managers](https://www.systemsengineering.com/industries/financial-services/accountants-wealth-managers/) - [Banks](https://www.systemsengineering.com/industries/financial-services/banks/) - [Credit Unions](https://www.systemsengineering.com/industries/financial-services/credit-unions/) - [Government](https://www.systemsengineering.com/industries/government/) - [Healthcare](https://www.systemsengineering.com/industries/healthcare/) - [Law Firms](https://www.systemsengineering.com/industries/legal/) - [Manufacturers](https://www.systemsengineering.com/industries/manufacturer/) - [Nonprofit](https://www.systemsengineering.com/industries/nonprofits/) - [About](https://www.systemsengineering.com/about/) - [Leadership](https://www.systemsengineering.com/about/leadership/) - [Our Difference](https://www.systemsengineering.com/about/our-difference/) - [Our Partners](https://www.systemsengineering.com/about/our-partners/) - [Culture](https://www.systemsengineering.com/culture/) - [Contact](https://www.systemsengineering.com/about/contact/) - Managed IT - [Overview](https://www.systemsengineering.com/managed-it/) - [IT Essentials](https://www.systemsengineering.com/managed-it/it-essentials/) - [Microsoft Services](https://www.systemsengineering.com/managed-it/microsoft-services/) - [Modern Workplace](https://www.systemsengineering.com/managed-it/modern-workplace/) - [Help Desk](https://www.systemsengineering.com/managed-it/help-desk/) - [Network Assesment](https://www.systemsengineering.com/managed-it/network-assessment/) - IT Consulting Services - [Overview](https://www.systemsengineering.com/it-consulting-services/) - [Virtual CIO](https://www.systemsengineering.com/it-consulting-services/virtual-cio/) - [CMMC Compliance](https://www.systemsengineering.com/compliance/cmmc-compliance/) - [IT Policies-as-a-Service](https://www.systemsengineering.com/it-consulting-services/it-policies-as-a-service/) - [Engineering Services](https://www.systemsengineering.com/it-consulting-services/engineering-services/) - [Project Management](https://www.systemsengineering.com/it-consulting-services/project-management/) - [Business Continuity](https://www.systemsengineering.com/it-consulting-services/business-continuity/) - [Assessments & Gap Analyses](https://www.systemsengineering.com/it-consulting-services/get-it-assessed/) - Software Services - [Overview](https://www.systemsengineering.com/software-services/) - [Application Development](https://www.systemsengineering.com/software-services/application-development/) - [SharePoint](https://www.systemsengineering.com/software-services/sharepoint/) - [Database Services](https://www.systemsengineering.com/software-services/database-services/) - IT Security - [Overview](https://www.systemsengineering.com/security/) - [Adaptive Cybersecurity Framework (aCSF)](https://www.systemsengineering.com/se-adaptive-cybersecurity-framework-acsf/) - Cloud Security - [Service Overview](https://www.systemsengineering.com/security/cloud-security/) - [Cloud Security Resources](https://www.systemsengineering.com/security/cloud-security/cloud-security-resources/) - [Security Awareness Training](https://www.systemsengineering.com/security/security-awareness-training/) - [Cybersecurity Risk Assesment](https://www.systemsengineering.com/security/cybersecurity-risk-assessment/) - Compliance - [Overview](https://www.systemsengineering.com/compliance/) - [Cybersecurity Maturity Model Certification (CMMC)](https://www.systemsengineering.com/compliance/cmmc-compliance/) - [CMMC Compliance Service](https://www.systemsengineering.com/compliance/cmmc-compliance/cmmc-compliance-service/) - [CMMC Gap Analysis](https://www.systemsengineering.com/compliance/cmmc-compliance/cmmc-gap-analysis/) - [CMMC Resources Hub](https://www.systemsengineering.com/compliance/cmmc-compliance/cmmc-resources/) - [National Credit Union Administration (NCUA)](https://www.systemsengineering.com/compliance/ncua/) - Cloud Services - [Overview](https://www.systemsengineering.com/cloud-services/) - [Cloud Management](https://www.systemsengineering.com/cloud-services/cloud-management/) - [Cloud Security](https://www.systemsengineering.com/cloud-services/cloud-migration/) - Office 365 - [Office 365 Migration & Support](https://www.systemsengineering.com/cloud-services/office-365-migration-support/) - [Office 365 Backup](https://www.systemsengineering.com/cloud-services/office-365-migration-support/office-365-backup/) - [Cloud Assessment](https://www.systemsengineering.com/cloud-services/cloud-assessment/) - Industries - [Overview](https://www.systemsengineering.com/industries/) - [Construction](https://www.systemsengineering.com/industries/construction/) - [Education](https://www.systemsengineering.com/industries/education/) - [Financial Services](https://www.systemsengineering.com/industries/financial-services/) - [Banks](https://www.systemsengineering.com/industries/financial-services/banks/) - [Credit Unions](https://www.systemsengineering.com/industries/financial-services/credit-unions/) - [Accountants & Wealth Managers](https://www.systemsengineering.com/industries/financial-services/accountants-wealth-managers/) - [Government](https://www.systemsengineering.com/industries/government/) - [Healthcare](https://www.systemsengineering.com/industries/healthcare/) - [Legal](https://www.systemsengineering.com/industries/legal/) - [Manufacturers](https://www.systemsengineering.com/industries/manufacturers/) - [Nonprofits](https://www.systemsengineering.com/industries/nonprofits/) - About - [Overview](https://www.systemsengineering.com/about/) - [Leadership](https://www.systemsengineering.com/about/leadership/) - [Our Difference](https://www.systemsengineering.com/about/our-difference/) - [Employee-Owned](https://www.systemsengineering.com/about/esop/) - [Our Partners](https://www.systemsengineering.com/about/our-partners/) - Careers & Internships - [Openings](https://www.systemsengineering.com/about/careers/) - [Benefits](https://www.systemsengineering.com/about/careers/benefits/) - [Internships](https://www.systemsengineering.com/about/careers/internships/) - [Culture](https://www.systemsengineering.com/culture/) - [Case Studies](https://www.systemsengineering.com/case-studies/) - [Blog](https://blog.systemsengineering.com/blog) - [Events](https://www.systemsengineering.com/events/) - [Client Center](https://www.systemsengineering.com/client-center/) - [Contact](https://www.systemsengineering.com/about/contact/) 888.624.6737 [Email Us](mailto:info@systemsengineering.com) ![Cyan Website Header_2000x190px](https://info.systemsengineering.com/hs-fs/hubfs/blog-files/Cyan%20Website%20Header_2000x190px.png?width=2000&name=Cyan%20Website%20Header_2000x190px.png "Cyan Website Header_2000x190px") # **Comprehensive CMMC Glossary of Terms** As a business leader navigating CMMC, the terms and acronyms are abundant. This glossary is your go-to resource, providing clear and straightforward explanations for everything from Controlled Unclassified Information (CUI) to concepts like gap analysis and self-assessment.  Whether you're just getting started or already deep into your CMMC journey, this guide will help you confidently understand and communicate the essentials of cybersecurity compliance. ### + AC (Access Control) The process of granting or denying specific requests to obtain and use information, IT services, and physical access to facilities. ### + APT (Advanced Persistent Threat) A sophisticated adversary with significant resources employing multiple attack vectors over extended periods to gain unauthorized access. ### + Assessment The evaluation of security controls against CMMC practices to ensure they are effectively implemented and achieving intended outcomes. ### + Assessment Scope Defined boundaries of an assessment including systems, networks, processes, technologies, people, and facilities associated with CUI or FCI. ### + Asset Anything that holds value to an organization, such as data, equipment, systems, networks, or intellectual property. ### + Boundary Clearly-defined limits that determine the scope of a cybersecurity assessment, separating assessed systems from those not under assessment. ### + C3PAO (Certified Third-Party Assessment Organization) An accredited entity authorized to perform formal CMMC assessments. ### + Certificate Authority (CA) A trusted entity responsible for issuing digital certificates for secure communication and verification of identity. ### + Compliance Inheritance A OSC that uses an ESP who has compliant systems, they “inherit” the security controls from the provider. ### + CMMC (Cybersecurity Maturity Model Certification) A unified cybersecurity standard created by the DoD for the defense supply chain to safeguard sensitive data. ### + Certified CMMC Professional (CCP) A person who has successfully completed all certification program requirements as outlined by the CAICO for becoming a Level 1 CMMC Assessor. A Provisional Assessor (PA) will become a CCP by passing the associated certification exam. ### + CMMC Registered Practitioner Professionals who provide CMMC implementation consultative services. Any level of RP cannot participate on assessment teams. ### + CMMC Registered Practitioner Organization An organization authorized to represent itself as familiar with the basic constructs of the CMMC Standard, with a CMMC-AB provided logo, to deliver non-certified CMMC Consulting Services. Signifies that the organization has agreed to theCMMC-AB Code of Professional Conduct. ### + Controlled Unclassified Information (CUI) Sensitive information requiring safeguarding measures per federal regulations, not classified under executive orders or the Atomic Energy Act. ### + Customer Responsibility Matrix (CRM) Formerly Shared Responsibility Matrix (SRM), a critical piece of the certification process outlining who is responsible for each cybersecurity objective in a CMMC assessment between an OSCs and ESPs. - **Supports Certification Process:** CRM is critical for the certification process as it outlines the responsibilities of both the service provider and the client, ensuring clarity and compliance. - **Reduce Compliance Complexity:** CRM lowers the risk and complexity of assessments by clearly defining the responsibilities and ensuring that all necessary controls are in place. ### + Defense Federal Acquisition Regulation Supplement (DFARS) A DoD-specific supplement to federal acquisition regulations detailing cybersecurity compliance requirements. ### + Defense Industrial Base (DIB) The global network of entities supplying products and services critical to U.S. defense operations. ### + Enclave (Controlled Environment) A segmented and clearly-defined computing environment specifically implemented to protect sensitive information such as CUI, with distinct security boundaries. ### + External Service Provider (ESP) External people, technology, or facilities that the organization utilizes, including Cloud Service Providers, Managed Service Providers, Managed Security Service Providers, and Cybersecurity-as-a-Service Providers. ### + Federal Acquisition Regulation (FAR) The primary regulation guiding procurement for U.S. federal agencies, including cybersecurity standards for contractors. ### + Federal Contract Information Information provided by or generated for the government under contract, not publicly available. ### + Gap Analysis A structured evaluation identifying gaps between current cybersecurity practices and required compliance standards, resulting in actionable recommendations. ### + Incident An occurrence compromising or potentially compromising the confidentiality, integrity, or availability of information systems or data. ### + Incident Response (IR) Procedures established to identify, respond, mitigate, and recover from cybersecurity incidents. ### + Inheritance The use of existing security controls or practices implemented by external service providers or parent organizations within an assessment scope. ### + Maturity Level A defined stage within the CMMC framework indicating an organization’s capability and sophistication in cybersecurity practices. ### + Non-Federal Organization (NFO) Any external entity (contractors, subcontractors) subject to cybersecurity requirements through contractual obligations with federal entities. ### + Organization Seeking Assessment (OSA) The entity currently undergoing a formal cybersecurity evaluation by a C3PAO. ### + Organization Seeking Certification (OSC) An organization actively preparing for or seeking formal CMMC certification. ### + Penetration Testing Authorized simulated cyberattacks conducted to identify vulnerabilities and test the effectiveness of cybersecurity defenses. ### + Plan of Action and Milestones (POA&M) A structured document outlining required actions, timelines, and resources necessary to address and remediate identified cybersecurity deficiencies. ### + Practice Specific cybersecurity activities defined within the CMMC model that organizations must implement to achieve a desired maturity level. ### + Reciprocity Recognition and acceptance of cybersecurity assessments or certifications from other authoritative frameworks or entities. ### + Risk Assessment (RA) Systematic identification, analysis, evaluation, and documentation of cybersecurity risks and their potential impacts on an organization. ### + Risk Management Methodology (RMM) Structured approach and documented methods used for managing cybersecurity risks, including identifying, prioritizing, and addressing them. ### + Security Assessment Report (SAR) A detailed document produced by assessors summarizing findings, documenting tested security controls, and outcomes of the cybersecurity evaluation. ### + Self-Assessment An internal review conducted by an organization to evaluate its own cybersecurity posture against CMMC practices, typically used to identify readiness gaps prior to formal assessment. ### + Supplier Performance Risk System (SPRS) A DoD-managed system where suppliers record their cybersecurity self-assessment scores, enabling informed procurement decisions based on cybersecurity risk profiles. ### + System Integrity (SI) The protection of information systems and data against unauthorized alterations or corruption, ensuring accuracy, consistency, and reliability. ### + System Security Plan (SSP) A comprehensive document describing implemented and planned security measures, clearly detailing how an organization safeguards information systems and sensitive data. ### + Tactics, Techniques, and Procedures (TTP) Methods and strategies utilized by adversaries during cyberattacks, crucial for understanding threat landscapes and developing defensive strategies. ### + Threat Any circumstance or entity with the potential to negatively impact the confidentiality, integrity, or availability of information or systems. ### + Validation The process of verifying that implemented cybersecurity practices effectively meet the intended security requirements or controls. ### + Vulnerability Weaknesses or flaws within systems, procedures, or controls that adversaries could be potentially exploited. - [IT Services](https://www.systemsengineering.com/) - [IT Security](https://www.systemsengineering.com/security/) - [Compliance](https://www.systemsengineering.com/compliance/) - [Cloud Services](https://www.systemsengineering.com/cloud-services/) - [Industries](https://www.systemsengineering.com/industries/) - [About](https://www.systemsengineering.com/about/) - [Careers](https://www.systemsengineering.com/about/careers/) - [White Papers](https://www.systemsengineering.com/white-papers/) - [Case Studies](https://www.systemsengineering.com/case-studies/) - [Blog](https://blog.systemsengineering.com/blog) - [Events](https://www.systemsengineering.com/news-resources/events/) - [Client Center](https://www.systemsengineering.com/client-center/) ![Ft-logo](https://info.systemsengineering.com/hs-fs/hubfs/Ft-logo.png?width=105&name=Ft-logo.png)     888.624.6737 | [info@systemsengineering.com](mailto:info@systemsengineering.com) Copyright 2025 Systems Engineering. All Rights Reserved. [Privacy Policy](https://www.systemsengineering.com/privacy-policy) [Support](https://www.systemsengineering.com/support/) [Trust Center](https://systems.app.ctrlmap.com/tp/trust/portal/links?puid=8010ba57-5a2e-40b4-9c56-2c18873c9e5f&trustPortalId=MQ==&code=4642)