CMMC Acronyms
AC
Access Control - Controls that limit access to systems and data based on user roles and
permissions.
APT
Advanced Persistent Threat - Sophisticated, often state-sponsored cyber attackers.
AT
Awareness & Training - Training and awareness programs to ensure personnel understand
cybersecurity responsibilities.
AU
Audit & Accountability - Processes for logging and monitoring system activities to ensure
accountability.
C3PAO
Certified Third Party Assessor Organization - Authorized to conduct CMMC assessments.
CA
Security Assessment - Security assessment activities to evaluate the effectiveness of controls.
CAICO
Cybersecurity Assessor and Instructor Certification Organization - The body responsible for
certifying CMMC assessors, instructors, and professionals in accordance with ISO/IEC 17024
standards.
, CCPs/CCAs/CCIs
CMMC Certified Professionals/Assessors/Instructors - Individuals certified to support, conduct,
or teach CMMC assessments under the Cyber AB and CAICO framework.
CMMC
Cybersecurity Maturity Model Certification - A DoD framework to assess cybersecurity
practices.
CMMC-AB
Cybersecurity Maturity Model Certification Assessment Body - The official body overseeing
CMMC assessments and certifications.
CUI
Classified Uncontrolled Information - Controlled Unclassified Information (CUI) is defined as
information that is not classified but still requires safeguarding or dissemination controls
according to and consistent with applicable laws, regulations, and government policies.
DFARS
Defense Federal Acquisition Regulation Supplement - Governs DoD contractor cybersecurity
requirements including safeguarding CUI.
DIB
Defense Industrial Base - The network of contractors and suppliers that support DoD operations
and missions.
DIBCAC
AC
Access Control - Controls that limit access to systems and data based on user roles and
permissions.
APT
Advanced Persistent Threat - Sophisticated, often state-sponsored cyber attackers.
AT
Awareness & Training - Training and awareness programs to ensure personnel understand
cybersecurity responsibilities.
AU
Audit & Accountability - Processes for logging and monitoring system activities to ensure
accountability.
C3PAO
Certified Third Party Assessor Organization - Authorized to conduct CMMC assessments.
CA
Security Assessment - Security assessment activities to evaluate the effectiveness of controls.
CAICO
Cybersecurity Assessor and Instructor Certification Organization - The body responsible for
certifying CMMC assessors, instructors, and professionals in accordance with ISO/IEC 17024
standards.
, CCPs/CCAs/CCIs
CMMC Certified Professionals/Assessors/Instructors - Individuals certified to support, conduct,
or teach CMMC assessments under the Cyber AB and CAICO framework.
CMMC
Cybersecurity Maturity Model Certification - A DoD framework to assess cybersecurity
practices.
CMMC-AB
Cybersecurity Maturity Model Certification Assessment Body - The official body overseeing
CMMC assessments and certifications.
CUI
Classified Uncontrolled Information - Controlled Unclassified Information (CUI) is defined as
information that is not classified but still requires safeguarding or dissemination controls
according to and consistent with applicable laws, regulations, and government policies.
DFARS
Defense Federal Acquisition Regulation Supplement - Governs DoD contractor cybersecurity
requirements including safeguarding CUI.
DIB
Defense Industrial Base - The network of contractors and suppliers that support DoD operations
and missions.
DIBCAC
