CMMC is the Department of Defense program that checks whether contractors protect the information they handle. The level a contract requires depends on the information involved, and the contract states it. This glossary explains the terms using the regulation text in 32 CFR Part 170.
What are the three levels?
Level 1. Its security requirements are the 15 listed in the basic safeguarding clause, 48 CFR 52.204-21(b)(1)(i) through (xv). Level 1 is assessed by self assessment.
Level 2. Its requirements are identical to NIST SP 800-171 Revision 2. Depending on the contract, Level 2 status comes from a self assessment or a certification assessment by a third party.
Level 3. It uses selected requirements from NIST SP 800-172 (February 2021), with Department of Defense parameters filled in. The regulation lists 24. A DCMA DIBCAC assessment grants Level 3 status.
What do the key terms mean?
FCI (federal contract information). The regulation defines it by reference to 48 CFR 4.1901, so read that text for the exact wording.
CUI (controlled unclassified information). Defined by reference to 32 CFR 2002.4(h). A CUI asset is one that can process, store or transmit CUI.
OSA, OSC. The organization seeking assessment, and the organization seeking certification. The terms appear throughout the rule and refer to the contractor.
C3PAO. A CMMC Third Party Assessment Organization, authorized or accredited to conduct Level 2 certification assessments.
DIBCAC. The DCMA unit that performs Level 3 certification assessments.
SPRS. Where CMMC status is recorded. Results are also issued on a certificate for third party and DIBCAC assessments.
CMMC Status. The result of meeting or exceeding the minimum required score. It is Final or Conditional, at the level and by the assessment type that applies, such as Level 2 (C3PAO).
POA&M (plan of action and milestones). A document listing tasks, resources, milestones and scheduled completion dates. Under 32 CFR 170.21 a POA&M is allowed only to reach a Conditional status, never for Level 1 self assessment. For Level 2 and Level 3 the score divided by total requirements must be at least 0.8, and only some requirements may be listed. The POA&M closeout assessment must occur within 180 days of the Conditional status date, or the status expires.
Affirming official. A senior representative of the organization who ensures compliance and can affirm continuing compliance. For Level 2 (C3PAO), affirmation is required at the time of each assessment and annually after.
SPD (security protection data). Data held or processed by assets that protect the assessed environment, including configuration data, logs, vulnerability status for in scope assets, and passwords that grant access to it.
ESP (external service provider). External people, technology or facilities that provide IT or cybersecurity services for you. Under CMMC an ESP counts when CUI or SPD is processed, stored or transmitted on its assets.
CSP (cloud service provider). An external company providing cloud services, defined by reference to NIST SP 800-145.
What to do
- Read the contract to see which level it requires, and which information you handle.
- Identify your CUI assets and draw the boundary around them.
- List every external service provider and cloud service that touches that boundary.
- Score yourself against the Level 2 requirements, and see whether a POA&M could even apply to your gaps, given the 0.8 floor and the restricted items.
- Name your affirming official early.
- Collect dated evidence for each requirement as you go.
Where Safeguard fits
For software suppliers, a dependency inventory and vulnerability evidence support the risk and system integrity families. Safeguard's compliance automation can help organize evidence, but it does not grant any CMMC status. Only the assessments described above do, and nothing in this post is legal or assessment advice.
Quick check
Can you use a POA&M to pass Level 1?
No. Under 32 CFR 170.21 a POA&M is never permitted for a Level 1 self assessment.
How long do you have to close a POA&M?
The closeout assessment must happen within 180 days of the Conditional status date. If it does not, the Conditional status expires.
Sources
- 32 CFR 170.4, Definitions
- 32 CFR 170.14, Requirements by level
- 32 CFR 170.17, Level 2 certification assessment
- 32 CFR 170.21, Plan of action and milestones
Last reviewed: 18 October 2026.
