---
title: Glossary
description: Plain-language definitions of the CMMC, NIST, and DIBFI terms you'll meet throughout the platform.
navigation:
  icon: i-lucide-book-a
---

# Glossary

The compliance world is full of acronyms. Here's what the ones you'll see in DIBFI actually mean.

## CMMC & compliance terms

**CMMC** — *Cybersecurity Maturity Model Certification.* The U.S. Department of Defense program that requires defense contractors to demonstrate specific cybersecurity practices before handling sensitive government information. **Level 1** protects FCI; **Level 2** protects CUI.

**CUI** — *Controlled Unclassified Information.* Government information that isn't classified but still must be protected. Protecting CUI is the goal of CMMC Level 2.

**FCI** — *Federal Contract Information.* Information provided by or generated for the government under a contract that isn't intended for public release. Protecting FCI is the goal of CMMC Level 1.

**NIST SP 800-171** — The National Institute of Standards and Technology publication that defines the security requirements for protecting CUI. CMMC Level 2 is built on it. **Revision 2** is the current baseline; **Revision 3** is the update DIBFI also supports.

**Practice** (or **control**) — One of the security requirements you must meet. CMMC Level 2 has **110** practices, drawn from NIST SP 800-171.

**Objective** — A specific, testable part of a practice. Practices break down into objectives, and a practice only counts as met when **all** of its objectives are met. Level 2 has roughly 320 objectives across the 110 practices.

**Family** (or **domain**) — A group of related practices, such as Access Control or Incident Response. NIST SP 800-171 organizes practices into 14 families.

**SPRS** — *Supplier Performance Risk System.* The DoD system that records your self-assessment score. Your **[SPRS score](/01-assessment-and-scoring/sprs-score)** runs from a perfect 110 down to −203.

**POA&M** — *Plan of Action & Milestones.* A tracked plan to fix a requirement you don't yet meet, with milestones and target dates. See **[POA&M](/03-operations-and-risk/poam)**.

**SSP** — *System Security Plan.* The document that describes your environment and how you meet each control. Assessors read it first. See the **[SSP Builder](/02-evidence-and-documents/ssp-builder)**.

**C3PAO** — *CMMC Third-Party Assessment Organization.* The accredited outside organization that performs your official CMMC Level 2 assessment.

**Assessment** — Your evaluation of how well you meet each objective. In DIBFI you record a status and narrative for every objective; the results drive your score and your SSP.

**Evidence** — The documents, screenshots, configurations, or records that prove an objective is actually met. Stored in the **[Evidence Locker](/02-evidence-and-documents/evidence-locker)**.

**Attestation / Affirmation** — A formal statement, typically by a senior official, affirming that your organization meets its requirements. DIBFI keeps a retained **[archive](/02-evidence-and-documents/attestations)** of these records.

**ODP** — *Organization-Defined Parameter.* A value your organization sets for certain NIST SP 800-171 **Revision 3** requirements (for example, a specific time period). See **[Revision 3 Transition](/06-platform-and-admin/rev3-transition)**.

**DoD Assessment Methodology** — The DoD's official scoring method: start at 110 and subtract each unmet control's weighted point value (1, 3, or 5). DIBFI's SPRS score follows it exactly.

## Roles & organizations

**OSC** — *Organization Seeking Certification.* A direct customer organization pursuing CMMC for itself.

**MSP** — *Managed Service Provider.* A partner that manages CMMC compliance on behalf of multiple client organizations, with its own **[portal](/04-billing-and-msp/msp-portal)** and white-label branding.

**Organization Admin / Member / Assessor** — The roles inside a direct organization. See **[Roles & Permissions](/00-getting-started/roles-and-permissions)**.

**Platform Admin** — DIBFI staff who administer the platform itself — not a customer role.

## Risk terms

**Likelihood / Impact** — The two 1–5 axes used to score a risk. Multiplied together they give a risk score of 1–25.

**Band** — A risk's severity category — Low, Moderate, High, or Critical — derived from its score.

**Treatment** — How you plan to handle a risk: Mitigate, Accept, Transfer, or Avoid. See **[Risk Management](/03-operations-and-risk/risk-management)**.

## Platform terms

**Compliance Operations** — Recurring, scheduled tasks that keep you compliant between assessments. See **[Compliance Operations](/03-operations-and-risk/compliance-operations)**.

**Document Library** — The in-app tool for generating, editing, approving, and publishing the policies CMMC requires. See **[Document Library](/02-evidence-and-documents/document-library)**.

**AI Connector** — A read-only, permission-scoped connection that lets an approved AI assistant read your compliance data to answer questions and guide you. See **[AI Connector](/05-integrations-and-ai/ai-connector)**.

**Readiness Review** — An assurance checkpoint where a reviewer evaluates whether you're ready for a formal assessment. See **[Reviews & Readiness](/03-operations-and-risk/reviews-and-readiness)**.