§204.7501. Definitions.
48 C.F.R. § 204.7501
As used in this subpart—
Controlled unclassified information means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).
Current means—
With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status—
Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with—
No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and
A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and
Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with—
No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and
A corresponding affirmation of continuous compliance by an affirming official;
With regard to Final CMMC Status—
Not older than 1 year for Final Level 1 (Self), with—
No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and
A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;
Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with—
No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and
A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and
Not older than 3 years for Final Level 3 (DIBCAC) assessments, with—
No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and
A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and
With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.
Cybersecurity Maturity Model Certification (CMMC) status means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:
Final Level 1 (Self).
Conditional Level 2 (Self).
Final Level 2 (Self).
Conditional Level 2 (C3PAO).
Final Level 2 (C3PAO).
Conditional Level 3 (DIBCAC).
Final Level 3 (DIBCAC). Cybersecurity Maturity Model Certification unique identifier (CMMC UID) means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.
Federal contract information (FCI) means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.
Notes, amendments, and revision history
Source
Source: 90 FR 43574, Sept. 10, 2025, unless otherwise noted.
Authority
Authority: 41 U.S.C. 1303 and 48 CFR chapter 1.
Source
Source: 56 FR 36289, July 31, 1991, unless otherwise noted.