Glossary

The compliance world is full of acronyms. Here's what the ones you'll see in DIBFI actually mean.

CMMC & compliance terms

CMMC — Cybersecurity Maturity Model Certification. The U.S. Department of Defense program that requires defense contractors to demonstrate specific cybersecurity practices before handling sensitive government information. Level 1 protects FCI; Level 2 protects CUI.

CUI — Controlled Unclassified Information. Government information that isn't classified but still must be protected. Protecting CUI is the goal of CMMC Level 2.

FCI — Federal Contract Information. Information provided by or generated for the government under a contract that isn't intended for public release. Protecting FCI is the goal of CMMC Level 1.

NIST SP 800-171 — The National Institute of Standards and Technology publication that defines the security requirements for protecting CUI. CMMC Level 2 is built on it. Revision 2 is the current baseline; Revision 3 is the update DIBFI also supports.

Practice (or control) — One of the security requirements you must meet. CMMC Level 2 has 110 practices, drawn from NIST SP 800-171.

Objective — A specific, testable part of a practice. Practices break down into objectives, and a practice only counts as met when all of its objectives are met. Level 2 has roughly 320 objectives across the 110 practices.

Family (or domain) — A group of related practices, such as Access Control or Incident Response. NIST SP 800-171 organizes practices into 14 families.

SPRS — Supplier Performance Risk System. The DoD system that records your self-assessment score. Your SPRS score runs from a perfect 110 down to −203.

POA&M — Plan of Action & Milestones. A tracked plan to fix a requirement you don't yet meet, with milestones and target dates. See POA&M.

SSP — System Security Plan. The document that describes your environment and how you meet each control. Assessors read it first. See the SSP Builder.

C3PAO — CMMC Third-Party Assessment Organization. The accredited outside organization that performs your official CMMC Level 2 assessment.

Assessment — Your evaluation of how well you meet each objective. In DIBFI you record a status and narrative for every objective; the results drive your score and your SSP.

Evidence — The documents, screenshots, configurations, or records that prove an objective is actually met. Stored in the Evidence Locker.

Attestation / Affirmation — A formal statement, typically by a senior official, affirming that your organization meets its requirements. DIBFI keeps a retained archive of these records.

ODP — Organization-Defined Parameter. A value your organization sets for certain NIST SP 800-171 Revision 3 requirements (for example, a specific time period). See Revision 3 Transition.

DoD Assessment Methodology — The DoD's official scoring method: start at 110 and subtract each unmet control's weighted point value (1, 3, or 5). DIBFI's SPRS score follows it exactly.

Roles & organizations

OSC — Organization Seeking Certification. A direct customer organization pursuing CMMC for itself.

MSP — Managed Service Provider. A partner that manages CMMC compliance on behalf of multiple client organizations, with its own portal and white-label branding.

Organization Admin / Member / Assessor — The roles inside a direct organization. See Roles & Permissions.

Platform Admin — DIBFI staff who administer the platform itself — not a customer role.

Risk terms

Likelihood / Impact — The two 1–5 axes used to score a risk. Multiplied together they give a risk score of 1–25.

Band — A risk's severity category — Low, Moderate, High, or Critical — derived from its score.

Treatment — How you plan to handle a risk: Mitigate, Accept, Transfer, or Avoid. See Risk Management.

Platform terms

Compliance Operations — Recurring, scheduled tasks that keep you compliant between assessments. See Compliance Operations.

Document Library — The in-app tool for generating, editing, approving, and publishing the policies CMMC requires. See Document Library.

AI Connector — A read-only, permission-scoped connection that lets an approved AI assistant read your compliance data to answer questions and guide you. See AI Connector.

Readiness Review — An assurance checkpoint where a reviewer evaluates whether you're ready for a formal assessment. See Reviews & Readiness.