Intel
Defense Technology Glossary
Plain-language definitions of the acquisition, cybersecurity, software assurance, and AI assurance terms that come up on defense programs.
A
- ATO (Authority to Operate)
- The formal decision by a designated authorizing official to accept the residual risk of operating an information system. It's the outcome of the Risk Management Framework. Cybersecurity services →
C
- C3PAO (CMMC Third-Party Assessment Organization)
- An organization authorized to conduct CMMC Level 2 certification assessments.
- cATO (Continuous Authorization to Operate)
- An authorization approach in which ongoing monitoring, automated security testing, and an active cybersecurity program replace point-in-time reauthorization. It's typically tied to a DevSecOps pipeline. Software engineering →
- CC SRG (Cloud Computing Security Requirements Guide)
- DISA's guidance that defines security requirements and Impact Levels for DoW use of commercial cloud services. It's now published as a Cloud Service Provider SRG and a Mission Owner SRG.
- CMMC (Cybersecurity Maturity Model Certification)
- The DoW program for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information. It's codified in 32 CFR Part 170 and applied to contracts through DFARS clause 252.204-7021.
- Counter-AI
- Tactics, techniques, and procedures for degrading, deceiving, or defeating an adversary's AI-enabled systems. AI assurance & counter-AI →
- CUI (Controlled Unclassified Information)
- Government information that requires safeguarding or dissemination controls under law, regulation, or policy, but isn't classified.
- CVE (Common Vulnerabilities and Exposures)
- A public catalog of specific, disclosed vulnerabilities in software and hardware products, each with a unique identifier.
- CVSS (Common Vulnerability Scoring System)
- An open standard for rating the severity of a vulnerability on a 0–10 scale.
- CWE (Common Weakness Enumeration)
- A community-maintained list of software and hardware weakness types, such as buffer overflow or improper input validation. CVEs are instances; CWEs are their underlying causes. SPECTREIQ →
D
- DevSecOps
- A software practice that integrates development, security, and operations into one automated pipeline, so security testing happens continuously rather than at the end. Software engineering →
- DT&E / OT&E (Developmental / Operational Test and Evaluation)
- DT&E verifies that a system meets its technical requirements. OT&E evaluates whether it's effective and suitable in realistic operational use by representative users.
E
- EVM (Earned Value Management)
- A program management method that integrates scope, schedule, and cost to measure performance against a baseline. It's defined by the guidelines in EIA-748. Program management →
I
- IDIQ (Indefinite-Delivery/Indefinite-Quantity)
- A contract type that provides for an indefinite quantity of supplies or services over a fixed period, ordered through task or delivery orders. Contract vehicles →
- Impact Level (IL2/IL4/IL5/IL6)
- Cloud security categories defined by DISA's cloud security requirements guides. IL4 covers Controlled Unclassified Information and other mission data. IL5 covers unclassified national security systems and CUI that needs more protection than IL4. IL6 covers classified information up to SECRET.
- IV&V (Independent Verification and Validation)
- Assessment of a system's work products by an organization that is technically, managerially, and financially independent of the developer. Software IV&V →
J
- JFAC (Joint Federated Assurance Center)
- A DoW federation that provides best practices and tools supporting software assurance and cyber developmental test and evaluation (Cyber DT&E) for defense programs.
L
- LVC (Live, Virtual, Constructive)
- Training and test environments that combine real people operating real systems (live), real people operating simulated systems (virtual), and simulated people and systems (constructive). Threat systems →
M
- MITRE ATLAS
- A public knowledge base of adversary tactics and techniques against AI-enabled systems, modeled on MITRE ATT&CK.
N
- NIST AI RMF
- NIST's AI Risk Management Framework (AI 100-1). It organizes AI risk management into four functions: Govern, Map, Measure, Manage.
P
- POA&M (Plan of Action and Milestones)
- A document listing security weaknesses, the actions planned to fix them, and target dates.
- PPP (Program Protection Plan)
- The acquisition program document describing how the program protects critical technology, components, and information, including software assurance countermeasures, as required by DoDI 5000.83.
R
- RMF (Risk Management Framework)
- The NIST SP 800-37 process the DoW uses (via DoDI 8510.01) to categorize, secure, assess, authorize, and monitor information systems. Cybersecurity services →
S
- SBOM (Software Bill of Materials)
- A formal, machine-readable inventory of the components and dependencies in a piece of software.
- SPRS (Supplier Performance Risk System)
- The DoW system where contractors report NIST SP 800-171 assessment scores and CMMC status.
- STIG (Security Technical Implementation Guide)
- DISA configuration standards for securing specific products and technologies.
T
- TEVV (Test, Evaluation, Verification, and Validation)
- The full set of activities used to establish confidence that an AI-enabled system performs as intended, including under adversarial conditions. AI assurance & counter-AI →
Z
- Zero Trust
- A security model that assumes no implicit trust based on network location. Every user, device, and request is continuously verified. The DoW's strategy defines it across seven pillars. Zero trust for DoW programs →
Last reviewed: