CMMC, SPRS and DFARS terms, defined in plain English

The words in a defense contract's cybersecurity clauses are defined somewhere official: 32 CFR part 170 for CMMC, DFARS 252.204-7012 for covered defense information and cyber incidents, FAR 4.1901 for federal contract information, 32 CFR 2002.4 for CUI, and FAR 2.101 for identifiers. Each entry below quotes or closely follows that source and names it, so you can check the wording yourself. Where a Tiermark guide covers the term, it is linked.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

CMMC

CMMC

Cybersecurity Maturity Model Certification, the DoD program in 32 CFR part 170. 32 CFR 170.1(a) says the part "establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)" and "for conducting an assessment of compliance" with them. Where the rollout stands is in CMMC Phase II is suspended: what still applies.

CMMC Level 1

The level for FCI. Under 32 CFR 170.14(c)(2), "The security requirements in CMMC Level 1 are those set forth in 48 CFR 52.204-21(b)(1)(i) through (xv)", the 15 basic safeguards. Under 170.15, a Level 1 self-assessment is annual and no POA&M is permitted.

CMMC Level 2

The level for CUI. Under 32 CFR 170.14(c)(3), "The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2", the 110 requirements. It comes in two forms: Level 2 (Self), a self-assessment every three years under 170.16, and Level 2 (C3PAO), a certification assessment under 170.17. Which edition of SP 800-171 applies is in NIST SP 800-171 Rev 2 vs Rev 3.

CMMC Level 3

The level for the CUI DoD singles out for more protection. Under 32 CFR 170.14(c)(4), its requirements "are selected from NIST SP 800-172 Feb2021", 24 of them by the count in 170.4, assessed by DCMA DIBCAC under 170.18. A Final Level 2 (C3PAO) status is a prerequisite.

CMMC Status

The result of an assessment. 32 CFR 170.4 says it "is the result of meeting or exceeding the minimum required score for the corresponding assessment" and "is officially stored in SPRS". The seven statuses are Final Level 1 (Self), Conditional and Final Level 2 (Self), Conditional and Final Level 2 (C3PAO), and Conditional and Final Level 3 (DIBCAC).

CMMC Status Date

Under 32 CFR 170.4, "the date that the CMMC Status results are submitted to SPRS or the CMMC instantiation of eMASS, as appropriate. The date of the Conditional CMMC Status will remain as the CMMC Status Date after a successful POA&M closeout." The three-year and 180-day clocks run from it.

Conditional status

A status held while a POA&M is open. Under 32 CFR 170.16(a)(1)(ii), an organization "has achieved the CMMC Status of Conditional Level 2 (Self) if the Level 2 self-assessment results in a POA&M and the POA&M meets all the CMMC Level 2 POA&M requirements listed in 170.21(a)(2)". It expires if the POA&M is not closed out within 180 days. See POA&M rules.

Final status

A status with nothing left open. Under 32 CFR 170.16(a)(1)(iii), an organization "has achieved the CMMC Status of Final Level 2 (Self) if the Level 2 self-assessment results in a passing score as defined in 170.24", whether on the first assessment or after a POA&M closeout.

Affirming Official

Under 32 CFR 170.4, "the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA's compliance with the CMMC Program requirements and has the authority to affirm the OSA's continuing compliance with the specified security requirements for their respective organizations."

Affirmation

The Affirming Official's statement in SPRS that the organization has implemented and will maintain the CMMC security requirements, required by 32 CFR 170.22 after every assessment, including a POA&M closeout, and annually after that. DFARS 252.204-7021(d)(3) carries the annual affirmation into the contract.

OSA

Organization Seeking Assessment. Under 32 CFR 170.4, "the entity seeking to undergo a self-assessment or certification assessment for a given information system for the purposes of achieving and maintaining any CMMC Status. The term OSA includes all Organizations Seeking Certification (OSCs)."

OSC

Organization Seeking Certification. Under 32 CFR 170.4, "the entity seeking to undergo a certification assessment for a given information system for the purposes of achieving and maintaining the CMMC Status of Level 2 (C3PAO) or Level 3 (DIBCAC). An OSC is also an OSA."

C3PAO

CMMC Third-Party Assessment Organization. Under 32 CFR 170.4, "an organization that has been authorized or accredited by the Accreditation Body to conduct Level 2 certification assessments and has the roles and responsibilities identified in 170.9." Since July 13, 2026 DoD requiring activities may not designate Level 2 (C3PAO) in new requirements while the Phase II suspension lasts.

DCMA DIBCAC

The Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center, the Government assessor. 32 CFR 170.4 expands the acronym as "DCMA's Defense Industrial Base Cybersecurity Assessment Center", and defines a "DCMA DIBCAC High Assessment" as one "conducted by Government personnel in accordance with NIST SP 800-171A Jun2018 and leveraging specific guidance in the DoD Assessment Methodology" that "Results in a confidence level of 'High' in the resulting score." DIBCAC conducts Level 3 certification assessments under 170.18.

ESP

External Service Provider. Under 32 CFR 170.4, "external people, technology, or facilities that an organization utilizes for provision and management of IT and/or cybersecurity services on behalf of the organization. In the CMMC Program, CUI or Security Protection Data (e.g., log data, configuration data), must be processed, stored, or transmitted on the ESP assets to be considered an ESP."

CMMC UID

Under DFARS 252.204-7021 (NOV 2025), "10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system." The clause requires a current status and an annual affirmation for each one used in performance.

Assessments and scores

Self-assessment

The organization's own assessment. 32 CFR 170.4 defines "Level 1 self-assessment" as "the activity performed by an OSA to evaluate its own information system when seeking a CMMC Status of Level 1 (Self)", and "Level 2 self-assessment" the same way for Level 2 (Self). Both are scored by the method in 170.24 and entered in SPRS. See NIST SP 800-171 self-assessment.

Assessment objective

Under 32 CFR 170.4, "a set of determination statements that, taken together, expresses the desired outcome for the assessment of a security requirement. Successful implementation of the corresponding CMMC security requirement requires meeting all applicable assessment objectives defined in NIST SP 800-171A Jun2018". A requirement is Met only when every applicable objective is.

Basic, Medium and High Assessment

DFARS terms for the three confidence levels of a NIST SP 800-171 DoD Assessment. The codified DFARS 252.204-7020 (NOV 2023) defines all three: a "Basic Assessment" is "a contractor's self-assessment" that "Results in a confidence level of 'Low' in the resulting score, because it is a self-generated score"; a "Medium Assessment" is "conducted by the Government" and "Results in a confidence level of 'Medium'"; a "High Assessment" adds "Verification, examination, and demonstration of a Contractor's system security plan" and "Results in a confidence level of 'High'". Since February 1, 2026, DoD contracting officers use 252.240-7997 (Class Deviation 2026-O0025) in place of 7020, and it defines only "Medium Assessment" and "High Assessment", each "conducted by Government personnel, trained in accordance with DoD policy and procedures, using NIST SP 800-171A". The contractor's own assessment is now described in 32 CFR 170.16 as the Level 2 self-assessment. See DFARS and FAR cybersecurity clauses, as of 2026.

SPRS score

The summary level score of a NIST SP 800-171 assessment, posted in SPRS: in the words of 252.240-7997(d)(2)(v), the "overall numerical score, not the individual value assigned for each requirement". Under 32 CFR 170.24 it starts at 110 and loses 5, 3 or 1 points for each requirement not met, so it can go to -203. See The SPRS score explained.

POA&M

Plan of Action and Milestones. Under 32 CFR 170.4, "a document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones". 32 CFR 170.21 limits which requirements may be on one. See POA&M rules.

POA&M closeout

The assessment that confirms a POA&M is done. 32 CFR 170.4 defines a "POA&M closeout self-assessment" as "the activity performed by an OSA to evaluate only the NOT MET requirements that were identified with POA&M during the initial assessment, when seeking a CMMC Status of Final Level 2 (Self)". Under 170.21(b) it must happen "within 180-days of the Conditional CMMC Status Date" or the Conditional status expires.

SSP

System Security Plan. Under 32 CFR 170.4, "the formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements." Under 170.24(c)(2)(i)(B)(5) there is no score without one. See The system security plan.

NIST SP 800-171

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, the NIST publication whose requirements DFARS 252.204-7012 and CMMC Level 2 impose. 32 CFR 170.2(a)(9) incorporates "Revision 2, February 2020 (includes updates as of January 28, 2021)"; NIST withdrew that edition on May 14, 2024 in favour of Revision 3, which DoD has not adopted. See NIST SP 800-171 Rev 2 vs Rev 3. All 110 requirements, by family, with their points and objectives: Requirements.

NIST SP 800-171A

Assessing Security Requirements for Controlled Unclassified Information, the companion that lists each requirement's assessment objectives. 32 CFR 170.2(a)(10) incorporates the June 2018 edition for CMMC assessments at 170.15 through 170.18.

Clauses and rules

DFARS 252.204-7012

Safeguarding Covered Defense Information and Cyber Incident Reporting. The clause that requires NIST SP 800-171 on covered contractor information systems, FedRAMP Moderate equivalent cloud, and cyber incident reporting within 72 hours. The codified text is dated MAY 2024; the Class Deviation 2026-O0025 version is "(JUN 2026) (DEVIATION 2026-O0025)". See DFARS 7012 cyber incident reporting: the 72-hour rule.

DFARS 252.204-7021

Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (NOV 2025). Requires the contractor to "Have and maintain for the duration of the contract a current CMMC status" at the level the contract names, to flow the right level down, and to keep an annual affirmation in SPRS for each CMMC UID.

DFARS 252.240-7997

NIST SP 800-171 DoD Assessment Requirements (FEB 2026) (DEVIATION 2026-O0025), the clause that replaced 252.204-7020 under Class Deviation 2026-O0025. It requires access for a Medium or High Assessment, says summary level scores "will be posted in the Supplier Performance Risk System (SPRS)", and flows its substance down to all subcontracts other than COTS. It exists only in the deviation attachment on the DPCAP page, not in the codified DFARS.

DFARS 252.204-7019 and 252.204-7020

The provision and clause (both NOV 2023) that carried the NIST SP 800-171 DoD Assessment requirement before 2026: a current assessment, not more than three years old, with its score in SPRS. Under Class Deviation 2026-O0025, 7019 is removed and 7020 is replaced by 252.240-7997. Both still print on acquisition.gov and ecfr.gov.

FAR 52.204-21

Basic Safeguarding of Covered Contractor Information Systems (NOV 2021). Lists in (b)(1) the 15 safeguards a contractor must apply to any system holding federal contract information, and in (c) flows them down. They are the CMMC Level 1 requirements.

FAR 52.240-93

The same clause under the FAR overhaul deviations, prescribed at FAR 40.303-2 with the same 15 requirements. Both numbers appear in current official text, so read "FAR 52.204-21 (52.240-93 under the FAR overhaul deviations)".

Class deviation

A written instruction that lets contracting officers depart from the FAR or DFARS. DPCAP's class deviations page says its Principal Director "issues class deviations when necessary to allow organizations to deviate from the FAR and DFARS". Class Deviation 2026-O0025, for example, "remains in effect until rescinded or incorporated into the FAR, DFARS, and DFARS PGI", so the codified text and the text in use can differ.

Flowdown

A clause's own instruction to put it in subcontracts. DFARS 252.204-7012(m)(1) requires the clause in subcontracts "for operationally critical support, or for which subcontract performance will involve covered defense information ... without alteration, except to identify the parties"; 32 CFR 170.23 says primes "shall require subcontractors to comply with and to flow down CMMC requirements". See How primes check their suppliers' cybersecurity.

EO 14415

Executive Order 14415, Securing America's Defense Supply Chains and Ensuring Domestic Acquisition of Critical Materials, signed July 20, 2026 and published at 91 FR 46693. It directs the Department of War to write regulations requiring contractors at every tier to map and vet their critical supply chains. See Executive Order 14415 explained.

IBOM

Indentured Bill of Materials, as EO 14415 uses it. Section 7(b) defines the term as "all the components, parts, equipment, software, and materials back to the origin of raw materials collected during the design, development, and initial fielding process of a system or end item", and says it "will require a standard format, content, and data pursuant to contract data requirement list data item descriptions (DIDs)".

Data types

CUI

Controlled Unclassified Information. Under 32 CFR 2002.4(h), "information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls." It "does not include classified information" or information a company holds "in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency". 32 CFR 170.4 adopts this definition for CMMC. See CUI vs FCI.

CUI Registry

Under 32 CFR 2002.4(p), "the online repository for all information, guidance, policy, and requirements on handling CUI", which "identifies all approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, establishes markings, and includes guidance on handling procedures." The National Archives keeps it at archives.gov/cui; DFARS 252.204-7012 points to it to define covered defense information.

FCI

Federal Contract Information. Under FAR 4.1901, "information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple transactional information, such as that necessary to process payments." FAR 52.204-21(a) says the same in slightly different words ("such as on public websites" and "such as necessary to process payments"). 32 CFR 170.4 refers to FAR 4.1901. FCI is the CMMC Level 1 trigger.

CDI

Covered defense information. Under DFARS 252.204-7012(a), "unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry ... that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies", and that is either marked and provided by or for DoD under the contract or "Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract." Controlled technical information is "technical information with military or space application that is subject to controls".

Covered contractor information system

Two clauses define it differently. In DFARS 252.204-7012(a), "an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information." In FAR 52.204-21(a), "an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information." Which one you are reading decides whether the 15 safeguards or NIST SP 800-171 applies.

Cyber incident and rapidly report

Under DFARS 252.204-7012(a), a cyber incident "means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein", and "Rapidly report" "means within 72 hours of discovery of any cyber incident." See DFARS 7012 cyber incident reporting.

FedRAMP Moderate equivalent

Not a FedRAMP term but a 7012 one. Under DFARS 252.204-7012(b)(2)(ii)(D), a contractor using an external cloud service provider for covered defense information "shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline" and complies with the clause's incident reporting, malware, media preservation, access and damage assessment paragraphs.

Systems and identifiers

SPRS

Supplier Performance Risk System. Its home page quotes DoD Instruction 5000.79: SPRS "is the authoritative source to retrieve supplier and product PI [performance information] assessments for the DoD [Department of Defense] acquisition community to use in identifying, assessing, and monitoring unclassified performance." It holds NIST SP 800-171 assessment scores, CMMC statuses and affirmations. A company sees its own data; a prime cannot look up a supplier's score.

PIEE

Procurement Integrated Enterprise Environment, the DoD portal through which SPRS is reached. The SPRS NIST SP 800-171 page says "users must be registered in the Procurement Integrated Enterprise Environment (PIEE)" and that "A 'SPRS Cyber Vendor User' role is required for companies to enter/edit basic self-assessment information."

DIBNet

The address DFARS 252.204-7012(c)(1)(ii) gives for cyber incident reports: "Rapidly report cyber incidents to DoD at https://dibnet.dod.mil." As of October 21, 2026, dibnet.dod.mil redirects to DC3's DCISE page, which carries the reporting link.

DC3 and DCISE

The Department of Defense Cyber Crime Center and its DoD-Defense Industrial Base Collaborative Information Sharing Environment. DC3's DCISE page calls DCISE "the single focal point and data repository for DIB cyber incident reporting required by 10 U.S. Code Sections 391 and 393 and DFARS 252.204-7012". 7012(d) sends malicious software to DC3.

Medium assurance certificate

The credential needed to file a 7012 report. Under 252.204-7012(c)(3), "the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents." DC3 says approved External Certification Authority (ECA) vendors "include IdenTrust and WidePoint".

SAM.gov

The System for Award Management. Under FAR 2.101, "the primary Government repository for prospective Federal awardee and Federal awardee information and the centralized Government system for certain contracting, grants, and other assistance-related processes." Registration there assigns a UEI and, for U.S. entities, leads to a CAGE code.

UEI

Unique entity identifier. Under FAR 2.101, "a number or other identifier used to identify a specific commercial, nonprofit, or Government entity. See www.sam.gov for the designated entity for establishing unique entity identifiers." SAM.gov's entity registration page says "As part of registration, we will assign you a Unique Entity ID." DC3's incident report elements ask for it.

CAGE code

Commercial and Government Entity code. Under FAR 2.101, "An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location"; the NATO equivalent is an NCAGE code. SPRS records CMMC statuses and assessment scores against CAGE codes, and 32 CFR 170.15 and 170.16 require "All industry CAGE code(s)" covered by an assessment scope to be entered.

Sources

• 32 CFR 170.1, 170.2, 170.4, 170.14, 170.16, 170.21, 170.22, 170.23, 170.24
• 32 CFR 2002.4 and the CUI Registry
• DFARS 252.204-7012 (MAY 2024), 252.204-7021 (NOV 2025), 252.204-7019 and 252.204-7020 (NOV 2023)
• DPCAP class deviations and DFARS Revolutionary FAR Overhaul class deviations (2026-O0025, with 252.204-7012 and 252.240-7997)
• FAR 2.101, FAR 4.1901, FAR 52.204-21 and FAR overhaul Part 40
• NIST SP 800-171 Rev. 2 and Rev. 3; SP 800-171A (June 2018)
• SPRS home page and SPRS NIST SP 800-171 page
• DC3 DIB Cybersecurity DCISE page and dibnet.dod.mil
• SAM.gov entity registration
• Executive Order 14415, 91 FR 46693