Cybersecurity Acronyms, Part One

C3PAO: CMMC Third Party Assessor Organization

A C3PAO is an organization that is accredited to assess organizations and award CMMC certifications (see acronym for CMMC below). C3PAO’s are accredited by CyberAB, which is the rulemaking body for CMMC.

CMMC: Cybersecurity Maturity Model Certification

CMMC has been a topic of much discussion since version 1 was released in 2020. On July 24, 2023, CMMC 2.0 was sent by the Department of Defense to the OMB and OIRA (see acronym definitions below). The CMMC rule is expected to go into effect in late 2024 or the first quarter of 2025.

CMMC is a certification of NIST 800-171 compliance.

CUI: Controlled Unclassified Information

CUI is a type of information in the defense and aerospace industry sectors. The information is not classified, as per the name, but it is important enough to warrant special protection. Contractors that work directly with government agencies (prime contractors) or contractors who work with prime contractors need to understand whether or not they handle and/or store CUI. If an organization is involved with CUI, they must be NIST 800-171 certified. This rule went into effect on January 1, 2018.

DFARS: Defense Federal Acquisition Regulation Supplement

This acronym is a case where decoding the abbreviation does not really explain the concept. DFARS is established in title 48 of the Code of Federal Regulations. The DFAR actually implements and supplements the FAR (Federal Acquisition Regulation). DFARS consists of 252 contract clauses. The 252.204-7012 clause covers CUI and is what incorporated NIST 800-171 compliance in 2018.

DIB: Defense Industrial Base

There are often references to “the DIB” when CMMC or NIST 800-171 is discussed (along with other myriad defense and aerospace topics). DIB stands for Defense Industrial Base. It is also a term used in political science circles. CISA (Cybersecurity & Infrastructure Security Agency) defines DIB as “ the worldwide industrial complex that enables research and development, as well as design, production, delivery, and maintenance of military weapons systems, subsystems, and components or parts, to meet U.S. military requirements.”

DIBCAC: Defense Industrial Base Cybersecurity Assessment Center

The full name of this agency is quite a mouthful so having an acronym is beneficial. The primary role of DIBCAC is to assess how DoD contractors are doing in terms of complying with DFARS 252.204.7012 and NIST 800-171. Currently DIBCAC is offering joint surveillances with C3PAOs for early CMMC letters of conformance.

DOD: Department of Defense

It is easy to think of the Department of Defense as “just” the over-arching body covering armed services, but, in reality, that is just the beginning of this sprawling federal agency. Several branches of the Department of Defense are involved in cybersecurity, so it is important to learn the infrastructure as you continue or start to work as a defense contractor. The DOD has an exhaustive list of its services on its website.

DODCIO: Department of Defense Chief Information Officer

The Chief Information Officer for the Department of Defense has many responsibilities, as you might expect. They are the primary advisor to both the Secretary of Defense and the Deputy Secretary of Defense for issues relating to information technology. In addition to cybersecurity, they are responsible for communications and many other areas of operation. For defense contractors, the DODCIO is primarily significant as the authority for cybersecurity for the Department of Defense.

FedRAMP: Federal Risk and Authorization Management Program

FedRAMP may affect you peripherally as your organization strives for NIST/CMMC compliance. If your organization is a CSP (Cloud Service Provider) it will impact you in a significant way. FedRAMP was created in 2011 with the idea of creating secure cloud environments for government data.

At times there are references to “FedRAMP equivalent” or “FedRAMP Ready.” These terms show up especially in conversations about NIST/CMMC and DFARS 252.204-7012. Defining “equivalent” has been a commonly voiced bone of contention during the conversations about NIST 800-171 rev 3 and CMMC 2.0. FedRAMP was created by the OMB (Office of Management and Budget).

FIPS: Federal Information Processing Standards

FIPS is the creation of NIST. NIST defines FIPs as:

standards and guidelines for federal computer systems that are developed by National Institute of Standards and Technology (NIST) in accordance with the Federal Information Security Management Act (FISMA) and approved by the Secretary of Commerce. These standards and guidelines are developed when there are no acceptable industry standards or solutions for a particular government requirement. Although FIPS are developed for use by the federal government, many in the private sector voluntarily use these standards.

There are FIPS requirements in NIST 800-171, and many companies find this a major obstacle to overcome on their way to compliance.