Plain-English glossary

The terms a mover meets in CMMC and on Project Spectrum, in alphabetical order. Acronyms come first, so CUI is under C.

This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.

Facts last checked: 6 November 2026.

A

Affirmation: A statement, posted in SPRS by a senior official of your company, that the company meets the CMMC requirements. For DP3, the Tender of Service sets when TSPs must post theirs.
Source: IAM CMMC Resource Center
Affirming Official: The senior person in your company who is responsible for its CMMC compliance and has the authority to affirm it in SPRS: after each assessment, after a plan of action is closed, and every year after a Final status, counted from the CMMC Status Date.
Sources: 32 CFR 170.22, 32 CFR 170.4
Assessment scope: The set of all your assets, such as systems, devices, people, places and outside providers, that are assessed against the CMMC requirements. You set it before you assess.
Source: 32 CFR 170.19

C

C3PAO (CMMC Third-Party Assessment Organization): An organization authorized to carry out CMMC certification assessments. Project Spectrum's advisors can help you prepare for one.
Source: Project Spectrum FAQ
CAGE code (Commercial and Government Entity code): The five-character code that identifies your company to the government. It comes with your SAM registration, and SPRS uses it to tie your assessment to your company.
Sources: SPRS: access instructions, SPRS CMMC Level 2 Self-Assessment Quick Entry Guide
CAM (Contractor Account Administrator): The person at your company who approves PIEE roles for your CAGE code, including SPRS access. A CAM cannot approve their own role.
Sources: SPRS: access instructions, Johns Hopkins APL supplier webinar on SPRS, 25 August 2026
CMMC (Cybersecurity Maturity Model Certification): The Department of War's framework that requires contractors to put cybersecurity practices in place and show that they have. It has three levels: Level 1 (Foundational), Level 2 (Advanced) and Level 3 (Expert).
Source: Project Spectrum FAQ
CMMC Level 1: The foundational level: the 15 basic security requirements of FAR 52.204-21 for protecting Federal Contract Information (FCI). Project Spectrum counts them as 17 practices, and says its Level 1 self-assessment typically takes under an hour. For DP3, the Tender of Service sets the deadline.
Sources: 32 CFR 170.14, Project Spectrum FAQ, IAM: What You Need to Do for CMMC, DP3 Household Goods Tender of Service, section A.2
CMMC Level 2: The advanced level: 110 requirements for protecting Controlled Unclassified Information (CUI), drawn from NIST SP 800-171. For DP3, the Tender of Service sets when TSPs owe a Level 2 self-assessment and affirmation.
Sources: Project Spectrum FAQ, IAM CMMC Resource Center
CMMC Status Date: The date you post the results of a self-assessment in SPRS. Closing out a plan of action does not change it, and your yearly affirmations and three-year cycle count from it.
Sources: 32 CFR 170.4, 32 CFR 170.16, 32 CFR 170.22
CMMC UID (CMMC Unique Identifier): The identifier SPRS gives your assessment. For Level 1, IAM says DP3 TSPs sent it, with evidence of the affirmation, to TRANSCOM, and it expects the same for Level 2.
Sources: Johns Hopkins APL supplier webinar on SPRS, 25 August 2026, IAM CMMC Resource Center
Conditional and Final status: Final: every requirement met or not applicable, a score of 110. Conditional: a score of at least 88 with only allowed gaps on a plan of action, which must be closed within 180 days.
Sources: 32 CFR 170.16, 32 CFR 170.21
CUI (Controlled Unclassified Information): Information the government creates or possesses that must be safeguarded under law, regulation or government-wide policy, but is not classified. IAM says the information TSPs and their subcontractors handle in DP3 includes CUI.
Sources: Project Spectrum FAQ, IAM CMMC Resource Center
Cyber Advisor: A Project Spectrum advisor. Sessions are free; you can book one through the platform or email support@projectspectrum.io.
Sources: Project Spectrum FAQ, Department of War, business.defense.gov/cmmc

D

DIB (Defense Industrial Base): The companies that supply the Department of War. Project Spectrum is built for the small and medium businesses among them.
Source: Project Spectrum FAQ
DoD (Department of Defense, also called the Department of War): Under Executive Order 14347 of 5 September 2025, the Department of Defense may also be called the Department of War, the name the official CMMC pages now use. DoD, DoW and Department of War mean the same department.
Sources: Executive Order 14347, 5 September 2025, Department of War, business.defense.gov/cmmc
DP3 (Defense Personal Property Program): The Department's program for moving service members' household goods.
Source: IAM CMMC Resource Center

E

Eccalon, LLC: The company that operates LYNX, the account platform Project Spectrum uses.
Source: LYNX Terms of Use

F

FCI (Federal Contract Information): Information provided by or generated for the government under a contract to develop or deliver a product or service for the government. It does not include information given to the public or simple transactional data.
Source: Project Spectrum FAQ
FedRAMP Moderate: The federal government's security standard for cloud services at the moderate level. A cloud service that holds, processes or sends CUI for you must be FedRAMP authorized at Moderate or higher, or meet security requirements equivalent to the Moderate standard under DoD policy.
Sources: 32 CFR 170.16, FedRAMP Marketplace

L

LYNX: The account platform behind Project Spectrum's sign-up, operated by Eccalon, LLC. One LYNX login also connects to Eccalon's other products.
Sources: LYNX Terms of Use, Project Spectrum FAQ

N

NAICS code (North American Industry Classification System): The six-digit code that says what kind of business you are. Household goods moving is 484210. Your code sets which SBA size standard applies to you; it does not decide whether CMMC applies.
Sources: Census Bureau, 2022 NAICS code list, FAR 19.102
NIST SP 800-171: The federal standard that sets the 110 security requirements, across 14 domains, for protecting CUI on contractors' systems. CMMC Level 2 is built on it.
Source: IAM CMMC Resource Center

O

Operational plan of action: The running list that requirement 3.12.2 asks for: problems found after a requirement is in place, and how each will be fixed. It is not the POA&M.
Source: 32 CFR 170.4

P

Phase I and Phase II: CMMC is being added to contracts in phases. Phase I, self-assessments, is in place. The Department has suspended Phase II; its CMMC page gives the current status.
Source: Department of War, business.defense.gov/cmmc
PIEE (Procurement Integrated Enterprise Environment): The Department's sign-in portal that you go through to reach SPRS.
Sources: SPRS: access instructions, SPRS CMMC Level 2 Self-Assessment Quick Entry Guide
POA&M (Plan of Action and Milestones): A list of the requirements you do not yet meet, with what you will do about each and by when. Project Spectrum offers a template.
Source: Project Spectrum FAQ

S

SAM.gov (System for Award Management): The government's system where companies register to work with the government and get a Unique Entity ID and a CAGE code. You need it before you can use PIEE and SPRS.
Sources: SPRS: access instructions, IAM: What You Need to Do for CMMC
SPRS (Supplier Performance Risk System): The Department's system where contractors' cybersecurity assessment scores and affirmations are recorded. Project Spectrum's self-assessment generates your SPRS score.
Sources: IAM CMMC Resource Center, Project Spectrum FAQ
SPRS Cyber Vendor User: The SPRS role that lets you add, edit and affirm cybersecurity assessments. Your Affirming Official needs it too.
Sources: SPRS: access instructions, Johns Hopkins APL supplier webinar on SPRS, 25 August 2026
SSP (System Security Plan): The document that describes your systems and how you meet each requirement. Project Spectrum offers a template, and IAM's Resource Center offers a fillable CUI SSP template.
Sources: Project Spectrum FAQ, IAM CMMC Resource Center

T

Tender of Service (ToS): The rules a TSP agrees to in order to carry DoD household goods shipments in DP3. Section A.2 sets the CMMC deadlines for TSPs and for subcontractors that hold CUI or FCI.
Source: DP3 Household Goods Tender of Service, 2026 Change 3, section A.2
TSP (Transportation Service Provider): The company that holds a DP3 shipment with the Department. Agents, haulers and other companies work under it.
Source: IAM CMMC Resource Center

Back to Start here or Resources home. Looking for a page or a requirement number? Try Find anything: A to Z.