GovCon Glossary

Key terms every government contractor should know — from CMMC compliance and CUI handling to federal acquisition and proposal management.

B

BPA(Blanket Purchase Agreement)

A simplified acquisition method for filling recurring needs for supplies or services by establishing charge accounts with qualified sources.

Acquisition

C

C3PAO(CMMC Third-Party Assessment Organization)

An organization authorized by the CMMC Accreditation Body (the Cyber AB) to conduct CMMC Level 2 assessments of defense contractors. Third-party assessment as a condition of award was suspended on July 13, 2026 pending review, so a C3PAO assessment is not currently required to be eligible for a contract.

Compliance

CAGE Code

A five-character Commercial and Government Entity code used to identify companies doing business with the federal government, assigned by DLA.

Acquisition

Capture Management

The process of identifying, assessing, and winning new government business opportunities from pre-RFP intelligence through proposal submission and award.

General

CMMC(Cybersecurity Maturity Model Certification)

A DoD framework requiring defense contractors to meet specific cybersecurity standards before handling federal contract information.

Compliance

CMMC Level 1 (Foundational)

The basic CMMC tier requiring the 15 safeguarding requirements at FAR 52.204-21(b)(1)(i)-(xv) for protecting Federal Contract Information (32 CFR 170.14(c)(2)). Allows annual self-assessment.

Compliance

CMMC Level 2 (Advanced)

The mid-tier CMMC level requiring all 110 NIST SP 800-171 controls. Third-party (C3PAO) assessment at this level was suspended as an award condition in July 2026 pending review; Level 2 self-assessment remains in force.

Compliance

CO(Contracting Officer)

The government official with authority to enter into, administer, and terminate contracts and make related determinations and findings on behalf of the government.

General

COR(Contracting Officer's Representative)

An individual designated by the contracting officer to assist in the technical monitoring and administration of a contract.

General

COTS(Commercial Off-The-Shelf)

Products or software available in the commercial marketplace that can be purchased and used under government contract without modification.

General

CPARS(Contractor Performance Assessment Reporting System)

The government-wide system for recording contractor performance evaluations on federal contracts, accessible to all federal agencies during source selection.

General

CUI(Controlled Unclassified Information)

Government-created or -owned information that requires safeguarding controls per law, regulation, or government-wide policy, but is not classified.

Security

CUI Marking

The required banner and portion marking standards for CUI documents, including category indicators, dissemination controls, and designation indicators.

Security

CUI Registry

The official online repository maintained by NARA listing all CUI categories, subcategories, and the laws or policies authorizing their protection.

Security

CUI-Safe CRM

A customer relationship management system that meets the security controls required for handling Controlled Unclassified Information, including NIST SP 800-171 compliance.

Security

D

DFARS(Defense Federal Acquisition Regulation Supplement)

DoD-specific supplement to the FAR that implements defense acquisition policies, including cybersecurity clauses like DFARS 252.204-7012 for CUI protection.

Acquisition

DIB(Defense Industrial Base)

The worldwide industrial complex of companies that enable research, development, production, and sustainment of military weapon systems and components.

General

E

EAR(Export Administration Regulations)

Regulations administered by the Bureau of Industry and Security (BIS) controlling the export of dual-use commercial items, software, and technology.

Security

F

FAR(Federal Acquisition Regulation)

The primary regulation governing all federal procurement, establishing uniform policies and procedures for acquiring supplies and services by executive agencies.

Acquisition

FAR 52.204-21

The FAR clause requiring basic safeguarding of Federal Contract Information on contractor systems. Specifies 15 security requirements aligned with CMMC Level 1.

Acquisition

FCI(Federal Contract Information)

Information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service.

Security

FedRAMP(Federal Risk and Authorization Management Program)

A government-wide program providing a standardized approach to security assessment, authorization, and continuous monitoring of cloud products and services.

Compliance

G

GOTS(Government Off-The-Shelf)

Software or technology developed by or for the government that is available for use by other government agencies or their contractors.

General

GovCon(Government Contracting)

The business of providing goods, services, and solutions to federal, state, or local government agencies through competitive and non-competitive procurement processes.

General

GovCon Pipeline

The collection of identified government contract opportunities at various stages of pursuit, from early identification through proposal submission and award.

General

GWAC(Government-Wide Acquisition Contract)

A pre-competed, multi-agency IDIQ contract for IT products and services available to all federal agencies. Examples include Alliant 2, 8(a) STARS III, and VETS 2.

Acquisition

I

IDIQ(Indefinite Delivery/Indefinite Quantity)

A contract type that provides for an indefinite quantity of supplies or services during a fixed period. Task or delivery orders are placed against the contract as needs arise.

Acquisition

ITAR(International Traffic in Arms Regulations)

U.S. regulations controlling the export of defense-related articles, services, and technical data listed on the U.S. Munitions List, administered by the State Department.

Security

N

NAICS(North American Industry Classification System)

A six-digit coding system used to classify business establishments by industry. Federal contracts specify NAICS codes to determine applicable small business size standards.

General

NARA(National Archives and Records Administration)

The federal agency responsible for managing the CUI program, maintaining the CUI Registry, and establishing policies for CUI marking and handling.

General

NIST SP 800-171

The NIST standard for protecting CUI in non-federal systems. Revision 2 — the revision DoD assesses — specifies 110 security requirements and forms the basis of CMMC Level 2 and DFARS 252.204-7012 compliance.

Compliance

NIST SP 800-172

Enhanced security requirements beyond NIST 800-171 for protecting CUI when APT-level threats are a concern. Aligns with CMMC Level 3.

Compliance

O

OCI(Organizational Conflict of Interest)

A situation where a contractor's existing relationships or access to non-public information could give it an unfair competitive advantage or impair its objectivity.

General

P

Past Performance

A contractor's record of prior work quality, timeliness, and customer satisfaction on previous contracts, used as a key evaluation factor in source selection.

General

POA&M(Plan of Action and Milestones)

A document identifying security weaknesses, the planned remediation actions, required resources, and scheduled completion dates for achieving full compliance.

Compliance

Proposal Writing

The specialized discipline of crafting compliant, persuasive responses to government solicitations that address evaluation criteria and demonstrate past performance.

General

Pwin(Probability of Win)

A quantified assessment of the likelihood of winning a specific government contract opportunity, used in bid/no-bid decisions and resource allocation.

General

R

RFI(Request for Information)

A pre-solicitation document used by government agencies to gather market information, assess industry capabilities, and refine requirements before issuing a formal solicitation.

Acquisition

RFP(Request for Proposal)

A formal solicitation document issued by a government agency requesting vendors to submit detailed proposals for a specific requirement, evaluated on technical merit and price.

Acquisition

RFQ(Request for Quotation)

A solicitation used to obtain price quotes from vendors for clearly defined commercial supplies or services, typically evaluated primarily on price.

Acquisition

S

SAM(SAM.gov)

The System for Award Management — the official U.S. government website for entity registration, contract opportunity search, and federal award data.

Acquisition

SBA(Small Business Administration)

The federal agency that supports small businesses through size-standard determinations, certification programs (8(a), HUBZone), and government contracting assistance.

General

Set-Aside

A procurement restricted to a specific category of small business (e.g., 8(a), HUBZone, SDVOSB, WOSB) to promote small business participation in federal contracting.

Acquisition

Small Business Concern

A business meeting SBA size standards (by revenue or employee count per NAICS code) eligible for set-aside contracts and small business programs.

General

Sources Sought Notice

A pre-solicitation notice posted on SAM.gov by a government agency to determine if qualified sources exist for a planned procurement and whether to set aside for small business.

Acquisition

SPRS(SPRS Score)

The Supplier Performance Risk System score (-203 to 110) reflecting a contractor's self-assessed compliance with NIST SP 800-171. Required for DoD contracts involving CUI.

Compliance

SSP(System Security Plan)

A formal document describing the security controls in place or planned for a system, including the system boundary, environment, and how each NIST 800-171 requirement is satisfied.

Security

T

Task Order

An order placed against an established IDIQ contract for specific services or deliverables. Each task order defines scope, period, and funding for a defined effort.

Acquisition

The Cyber AB

The official accreditation body for the CMMC ecosystem, responsible for authorizing C3PAOs, certifying assessors, and overseeing the assessment process.

Compliance

U

UEI(Unique Entity Identifier)

A 12-character alphanumeric ID assigned by SAM.gov to uniquely identify entities doing business with the federal government. Replaced the DUNS number in April 2022.

Acquisition