Keep the language
within reach.

The rules and mechanisms used to determine who or what can access a resource and what actions are permitted. Effective access control also requires ownership and review.

An authorized statement tied to the relevant program or requirement. Who must affirm, what is affirmed, and when must be checked against the applicable rules and contract.

A record or item that may be used as evidence, such as a procedure, configuration record, log, or review note. Its meaning depends on context.

A structured evaluation of the extent to which specified requirements are met within a defined scope. A learning self-check is not a CMMC assessment.

A resource such as a system, device, application, service, or component. Its role and relationship to information help determine how it should be considered in scope.

A defined separation used to describe what is included in an environment and how it connects to other systems, services, people, and locations.

A CMMC Third-Party Assessment Organization. Verify a provider’s current authorization, role, and suitability through the appropriate official program resources.

A process for evaluating, authorizing, documenting, and reviewing changes so their effects are understood before and after implementation.

A provider of cloud computing services. Using a cloud service does not transfer every customer responsibility to the provider.

Cybersecurity Maturity Model Certification: the DoD program that uses defined cybersecurity requirements and assessment processes. The applicable requirement depends on the work and current contract terms.

The practice of establishing, understanding, controlling, and reviewing system configurations and changes over time.

The person or role accountable for a defined part of an implementation. Ownership should distinguish doing the work, approving it, and reviewing it.

Controlled Unclassified Information: unclassified information created or held by the government, or by an entity for it, where law, regulation, or governmentwide policy requires or permits safeguarding or dissemination controls. It is not every item a company considers sensitive.

Defense Federal Acquisition Regulation Supplement: DoD acquisition regulations that supplement the FAR. Read the exact applicable text and version, including relevant deviations.

Information used to support a conclusion about a claim or implementation. Its relevance, accuracy, scope, and time period matter; a document’s existence is not proof that a practice operates.

Assessment methods that look at materials, gather explanations, and exercise or observe activities. Together they can help establish whether an implementation does what is claimed.

External people, technology, or facilities providing and managing IT or cybersecurity services for the organization. The CMMC definition requires CUI or security-protection data to be processed, stored, or transmitted on those assets. Confirm the exact service and applicable definition.

Federal Acquisition Regulation: the primary set of regulations governing acquisition by federal executive agencies, with agency supplements and applicable deviations also relevant.

Federal Contract Information: certain information provided by or generated for the government under a contract that is not intended for public release, with exclusions defined in the applicable rule.

A contractual requirement passed to another party, such as a subcontractor, when the applicable clause or agreement requires it. Its application depends on the specific work and terms.

The decisions, responsibilities, policies, review routines, and escalation paths that give a program direction and accountability.

The people, procedures, technology, and operating activities used to address a requirement in a particular environment.

The coordinated activities used to prepare for, identify, respond to, and recover from security incidents. Contract-specific reporting and coordination requirements must also be understood.

The path information follows as it is received, created, used, stored, shared, archived, or disposed of. Mapping the flow helps make people, assets, and boundaries visible.

A question used to help a learner identify whether an idea is understood. A correct answer does not demonstrate implementation, compliance, or professional qualification.

The principle of limiting access to what is needed for an authorized task or role. It requires decisions about what is necessary and review as the work changes.

Authentication using more than one type of factor. Multiple passwords alone are not different factor types. The required approach depends on the applicable requirement and context.

The National Institute of Standards and Technology, which publishes cybersecurity guidance and standards. A NIST publication is not itself a certification of a particular organization.

Plan of Action and Milestones: a record of work needed to address specified weaknesses or gaps. Whether and how one is permitted depends on the applicable program and requirement.

The contractor with the direct contract relationship with the government for the work at issue. A prime may use subcontractors while retaining its own responsibilities.

A stated obligation or criterion. Understanding what a requirement says is different from selecting and operating an implementation that meets it.

The defined set of people, information, assets, locations, and services relevant to a particular evaluation or activity. A scope statement needs to match the work it describes.

An explicit division of responsibilities between parties. It should identify who implements, maintains, reviews, and supports each relevant part of the work.

Supplier Performance Risk System: a DoD system that includes supplier information and relevant assessment records. A learning worksheet is not an official SPRS record.

System Security Plan: a document describing the system and how relevant security requirements are addressed, including context needed to understand the environment.

A party performing work under a subcontract rather than the prime contract. Its responsibilities depend on the subcontract, relevant flowdowns, information, and actual role.