Glossary for a small federal contractor.

SBA describes the 8(a) Business Development program as a tool for experienced socially and economically disadvantaged small business owners who have been in business at least two years. Certification does not guarantee contract awards, but it makes a firm eligible to compete for the program's sole-source and competitive set-aside contracts. (SBA certifications)

A CMMC Third-Party Assessment Organization conducts Level 2 certification assessments and issues Certificates of CMMC Status. The Accreditation Body keeps the public list.

The source says: 32 CFR 170.4 says a C3PAO is authorized or accredited by the Accreditation Body. The Cyber AB describes a C3PAO as an organization that conducts assessments through certified professionals and certified assessors. (32 CFR 170.4, Cyber AB ecosystem roles)

A Commercial and Government Entity code is an identifier the Defense Logistics Agency's CAGE Branch assigns to entities in the United States or its outlying areas to identify a commercial or government entity by unique location, and SAM's data dictionary describes it as five alphanumeric characters. A NATO CAGE (NCAGE) code is the counterpart assigned outside the United States, which the CAGE Branch records in its master file. (FAR 2.101, SAM Functional Data Dictionary)

Cost Accounting Standards are the standards promulgated by the Cost Accounting Standards Board. FAR 30.101 says 41 U.S.C. chapter 15 requires certain contractors and subcontractors to comply with them and to disclose in writing and follow consistently their cost accounting practices. (FAR 30.101)

The Cybersecurity Maturity Model Certification program is how the Department of Defense verifies that contractors safeguard FCI and CUI on their own information systems, using FAR 52.204-21, NIST SP 800-171 Revision 2, and selected requirements from NIST SP 800-172. Since July 13, 2026, the Department of War has suspended Phase 2 of the rollout and allows only Level 1 and Level 2 self-assessments in new requirements. (32 CFR 170.1, DoD CIO, About CMMC)

Cost-plus contracts, such as the cost-plus-fixed-fee contract in FAR 16.306, are cost-reimbursement contracts. Cost-reimbursement contracts pay allowable incurred costs to the extent the contract prescribes, and they set an estimated total cost as a ceiling the contractor may not exceed, except at its own risk, without the contracting officer's approval. (FAR 16.306, FAR 16.301-1)

CPARS is the Contractor Performance Assessment Reporting System, and FAR 42.1501 says it is the official source for past performance information. The CPARS site says agencies are instructed to use it to create and measure the quality and timely reporting of performance information. (FAR 42.1501, CPARS)

Controlled unclassified information is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It does not include classified information, or information a non-executive branch entity keeps in its own systems that did not come from an executive branch agency. (32 CFR 2002.4(h))

The Defense Contract Audit Agency says it provides audit and financial advisory services to the War Department and other federal entities responsible for acquisition and contract administration, under the Under Secretary of Defense (Comptroller), and that its contract audits are independent reviews that help determine whether costs are allowable, allocable, and reasonable. For contractors other than educational institutions and nonprofit organizations, FAR 42.101 says DCAA is normally the responsible Government audit agency. (DCAA, FAR 42.101)

In the CMMC program, DCMA DIBCAC conducts Level 3 certification assessments, conducts Level 2 certification assessments of the Accreditation Body and of prospective C3PAOs' information systems, and may assess an organization when the CMMC program office requests it under DFARS 252.204-7019 and 252.204-7020. (32 CFR 170.7)

This clause (May 2024) requires adequate security for covered defense information, and it applies NIST SP 800-171 to covered contractor information systems that are not part of an IT service or system operated on behalf of the Government. If an external cloud provider will store, process, or transmit covered defense information, the contractor shall require that provider to meet security requirements equivalent to the FedRAMP Moderate baseline and paragraphs (c) through (g) of the clause. (DFARS 252.204-7012)

This provision (Nov 2023) says an offeror that must implement NIST SP 800-171 needs a current assessment, not more than 3 years old unless the solicitation says less, posted as a summary score in SPRS for each relevant covered contractor information system, in order to be considered for award. The summary is a single score, for example 95 out of 110, not the value of each requirement. (DFARS 252.204-7019)

This clause (Nov 2023) is the NIST SP 800-171 DoD assessment requirement. It defines a Basic Assessment as the contractor's own review of its system security plan, conducted under the DoD Assessment Methodology, with a confidence level of Low because the score is self-generated. (DFARS 252.204-7020)

This clause (Nov 2025) requires the contractor to have and maintain a current CMMC status, at the level the contracting officer inserts, for information systems that process, store, or transmit FCI or CUI in performance of the contract. Current means a conditional Level 2 status no older than 180 days, a final Level 2 status no older than 3 years, and an affirmation of continuous compliance no older than 1 year for a final status. (DFARS 252.204-7021)

FAR 31.205 is titled Selected costs. It has a subsection for each kind of cost, such as public relations and advertising (31.205-1), bad debts (31.205-3), compensation for personal services (31.205-6), contributions or donations (31.205-8), and lobbying and political activity costs (31.205-22), and whether a cost is allowable depends on the subsection that covers it. (FAR 31.205)

Federal contract information is information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information the Government provides to the public, such as on public websites, or simple transactional information needed to process payments. (FAR 4.1901)

A firm-fixed-price contract sets a price that is not adjusted based on the contractor's cost experience in performing the contract. The contractor bears maximum risk and full responsibility for all costs and for the resulting profit or loss. (FAR 16.202-1)

Microsoft describes Office 365 GCC High as an environment for Department of Defense requirements and for contractors holding or processing DoD CUI or subject to ITAR, available through volume licensing after a validation process, with no trials. Microsoft states that GCC High is assessed using NIST SP 800-53 controls at a FIPS 199 High categorization, and that eligible non-DoD entities might purchase it when they can demonstrate equivalency to IL4 or necessary inheritance for CMMC. (Microsoft Learn, GCC High and DoD) See the Microsoft 365 GCC High listing.

A governmentwide acquisition contract is a task-order or delivery-order contract for information technology, established by one agency for governmentwide use, and operated by an OMB-designated executive agent under 40 U.S.C. 11302(e), or under a GSA delegation issued before August 7, 1996. The Economy Act does not apply to orders under a governmentwide acquisition contract. (FAR 2.101)

SBA says the government limits competition for certain contracts to businesses in historically underutilized business zones, and that firms holding the HUBZone status are eligible for set-asides and a 10 percent price evaluation preference in full and open competition. SBA's qualification list includes being small, at least 51 percent owned and controlled by U.S. citizens or listed entity types, a principal office in a HUBZone, and at least 35 percent of employees living in a HUBZone. (SBA certifications)

An indefinite-quantity contract provides an indefinite quantity, within stated limits, of supplies or services during a fixed period, and the Government places orders for individual requirements. The contract must require the Government to order, and the contractor to furnish, at least a stated minimum. (FAR 16.504)

When FAR 52.216-7 is in the contract, the contractor shall submit an adequate final indirect cost rate proposal to the contracting officer and the auditor within the 6-month period after each fiscal year ends. Written extensions are only for exceptional circumstances. (FAR 52.216-7)

After direct costs are charged, indirect costs are those remaining to be allocated to intermediate or two or more final cost objectives. The contractor accumulates them by logical groupings, and a cost treated as direct in like circumstances is not also allocated as indirect. (FAR 31.203)

GSA's glossary defines the industrial funding fee as a fee paid by businesses awarded contracts under the Multiple Award Schedule to cover GSA's cost of operating the program. The fee is currently 0.75 percent of reported sales under MAS contracts unless the solicitation says otherwise. (GSA glossary)

SBA says joint ventures allow certain businesses to compete together for government contracts reserved for small businesses. To receive an exclusion from affiliation, SBA says the mentor-protege agreement has to be in place before the mentor and its protege submit an offer as a joint venture.

The source says: SBA's words are that the agreement must be approved before that offer. (SBA contracting assistance programs)

GSA's Multiple Award Schedule, also called Schedules or the Federal Supply Schedule, is the program through which federal, state, local, and tribal governments and other eligible buyers purchase commercial products, services, and solutions from contractors that hold a MAS award. A company submits an offer and, if awarded, sells at pre-negotiated prices. (GSA, Multiple Award Schedule)

SBA says proteges can get business development help from mentors, including guidance on internal business management systems, accounting, and marketing, financial assistance through equity investments, loans, and bonding, and help navigating federal bidding. A mentor and protege can joint venture as a small business for any small business contract when the protege individually qualifies as small. (SBA contracting assistance programs)

The North American Industry Classification System is the standard federal statistical agencies use to classify business establishments for collecting, analyzing, and publishing statistics on the U.S. business economy. The SAM.gov entity checklist tells a registrant to look up its codes at census.gov/naics and enter them. (Census NAICS, SAM entity checklist)

NIST Special Publication 800-171 is titled Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. NIST's publication page says Revision 2 was withdrawn on May 14, 2024 and superseded by Revision 3, while 32 CFR 170.14 and the CMMC program still identify Level 2 requirements with Revision 2. (NIST CSRC, Rev. 2, 32 CFR 170.14)

Past performance information is relevant information, for future source selection, about a contractor's actions under previously awarded contracts or orders. It includes the contractor's record of conforming to requirements, forecasting and controlling costs, and adherence to schedules. (FAR 42.1501)

A plan of action and milestones identifies tasks to accomplish, the resources those tasks need, milestones, and scheduled completion dates. For a conditional CMMC status, 32 CFR 170.21 allows one only for select NOT MET requirements and only on the conditions in that section. (32 CFR 170.4, 32 CFR 170.21)

Product Service Codes record the products and services the Federal Government buys, and when a contract covers more than one, the code reflects the predominant product or service. Product Service Codes are optional on a SAM.gov entity registration. (PSC Manual, SAM entity checklist)

FAR 15.201 lists requests for information among the exchanges the Government may use before proposals are due. An RFI may be used when the Government does not presently intend to award a contract and wants price, delivery, other market information, or capabilities for planning purposes, and responses are not offers. (FAR 15.201)

Requests for proposals are used in negotiated acquisitions to communicate Government requirements and to solicit proposals. At a minimum they describe the requirement and the anticipated terms and conditions. (FAR 15.203)

GSA's glossary describes a request for quotation as a document used to communicate government requirements that does not solicit binding offers, so quotations submitted in response are not offers. (GSA glossary)

A Registered Practitioner Organization is a consultative organization or managed service provider. 32 CFR part 170 does not define RPO.

The source says: The Cyber AB says a Registered Practitioner Organization delivers a non-certified advisory service through registered practitioners, and that these organizations do not conduct certified CMMC assessments. (Cyber AB ecosystem roles)

32 CFR 170.8 bars a CMMC ecosystem member from taking part in an assessment of an organization it prepared as a consultant within the prior 3 years. (32 CFR 170.8)

The System for Award Management is the system in FAR 52.204-7, and an offeror must be registered there when submitting an offer or quotation and at time of award. The SAM.gov entity checklist says there is no charge to get a Unique Entity ID, register, or maintain the registration. (FAR 52.204-7, SAM entity checklist)

SBA's Veteran Small Business Certification program says service-disabled veteran-owned small businesses in that program can compete for federal sole-source and set-aside contracts. For SDVOSB certification, SBA says no less than 51 percent of the business must be owned and controlled by one or more veterans rated as service-disabled by the VA. (SBA veterans)

The purpose of a small business set-aside is to award certain acquisitions exclusively to small business concerns. A set-aside may be total or partial. (FAR 19.501)

Standard Form 1408 (Rev. 1/2014) is the Preaward Survey of Prospective Contractor (Accounting System), prescribed by GSA under FAR 53.209-1(f). Its recommendation section records whether the accounting system is acceptable for award: yes, no, or yes with a follow-on review after award. (SF 1408)

The FAR does not define a general sources-sought notice. FAR 5.205 requires certain research and development advance notices to be titled "Research and Development Sources Sought" so sources can submit information for evaluation of their R&D capabilities, and FAR 15.201 says responses to a request for information are not offers. (FAR 5.205, FAR 15.201)

The Supplier Performance Risk System is the DoD system that describes itself as guiding the DoD in responsible acquisition decisions. CMMC status results are submitted there, and DFARS 252.204-7019 requires summary NIST SP 800-171 assessment scores to be posted there before award when that provision applies. (SPRS, 32 CFR 170.4)

A system security plan is the formal document that overviews the security requirements for a system and describes the controls in place or planned, the components, the environment, how the requirements are implemented, and connections to other systems. Without an up-to-date plan, 32 CFR 170.24 says a CMMC assessment could not be completed. (32 CFR 170.4, 32 CFR 170.24)

Except for the cases in FAR 19.702(b), a solicitation expected to exceed $900,000, or $2 million for construction, that has subcontracting possibilities must require an acceptable subcontracting plan from the apparently successful offeror or the selected bidder. Plans are not required from small business concerns, for personal services contracts, for work performed entirely outside the United States and its outlying areas, or for in-scope modifications when the contract does not contain FAR 52.219-8. (FAR 19.702)

A time-and-materials contract pays for direct labor hours at fixed hourly rates that include wages, overhead, general and administrative expenses, and profit, and it pays actual cost for materials, with the exceptions in FAR 31.205-26(e) and (f). It may be used only when the extent or duration of the work, or the costs, cannot be estimated with reasonable confidence at the time of award. (FAR 16.601)

The FAR term is contractor team arrangement. It means two or more companies form a partnership or joint venture to act as a potential prime, or a potential prime agrees with one or more other companies to have them act as subcontractors under a specified Government contract or acquisition program. (FAR 9.601)

A unique entity identifier is a number used to identify a specific commercial, nonprofit, or government entity, and FAR 2.101 points to SAM.gov as the place that establishes them. SAM's data dictionary describes it as a unique twelve-character identifier, and SBA says you receive it when you register at SAM.gov and that a DUNS number is no longer required. (FAR 2.101, SBA, Get started, SAM Functional Data Dictionary)

Costs that are expressly unallowable, or that the parties agree are unallowable, including directly associated costs, shall be identified and excluded from any billing, claim, or proposal applicable to a Government contract. A directly associated cost is one generated solely because the other cost was incurred. (FAR 31.201-6)

To be eligible for the Women-Owned Small Business Federal Contract program, SBA says a business must be small under SBA size standards, be at least 51 percent owned and controlled by women who are U.S. citizens, and have women manage day-to-day operations and make long-term decisions. Some contracts are set aside further for economically disadvantaged women-owned small businesses. (SBA certifications)

Contractors commonly use "wrap rate" for a single fully loaded hourly rate that rolls fringe, overhead, and general and administrative costs, often with profit, into direct labor. It is a trade term, and FAR 2.101 does not define it. FAR 31.203 covers how indirect costs are allocated, and FAR 16.601 describes a time-and-materials contract's fixed hourly rates as including wages, overhead, general and administrative expenses, and profit. (FAR 31.203, FAR 16.601)

Sources checked October 16, 2026. Not legal advice.