PII, as defined by the Department of Homeland Security (DHS), is personally identifiable information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to the Department.
PHI is defined as information, including demographic data, that can be used to identify an individual. It can exist in any medium and can relate to an individual’s past, present, or future physical or mental health condition, to the provision of health care to the individual, or to past, present or future payment for the provision of health care to the individual. PHI includes common identifiers such as an individual’s name, address, date of birth, or Social Security Number.
EPHI is defined as information, including demographic data, that can be used to identify an individual. It can exist in any medium and can relate to an individual’s past, present, or future physical or mental health condition, to the provision of health care to the individual, or to past, present or future payment for the provision of health care to the individual. PHI includes common identifiers such as an individual’s name, address, date of birth, or Social Security Number.
CMP refers to a fine imposed on entities that violate certain laws and regulations. Penalties are adjusted yearly to adjust to inflation pursuant to the Federal Civil Penalties Inflation Adjustment Act of 1990, as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015. These laws required the head of each agency to adjust its CMPs for inflation.
CUI is information the government creates or possesses that a law, regulation, or governmentwide policy requires to be safeguarded. CUI information can only be handled only when using appropriate security controls.
FCI is information provided by or generated for the Government under contract that has not or will not be publicly released (within a reasonable period of time). Unlike CUI, FCI and its protection requirements are defined in the Federal Acquisition Regulation (FAR) rather than National Archives and Records Administration (NARA) documents and NIST 800-171 / DFARS 7012.
CDI Covered defense information is used to describe information that requires protection under DFARS Clause 252.204-7012.
CTI means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.
DFARs detail the terms and conditions for DoD procurement contracts. CMMC builds upon certain DFAR Supplement (DFARS) clauses that subject contractors to CMMC requirements.
C3PAO is an entity that is authorized and accredited by the government to perform CMMC assessments. The C3PAO also issues CMMC certificates based on the results of the assessments.
Registered Provider Organizations house Registered Practitioners and ensure that they receive the required basic CMMC-AB training and adhere to the CMMC-AB Code of Professional Conduct.
The Office of the Under Secretary of Defense for Acquisition and Sustainment is a DoD organization that led the development of the CMMC program.
NIST SP 800-171 catalogs a comprehensive set of security controls that CUI requires. CMMC includes these controls in addition to practices, processes, and references from many other standards and sources.
344 N. Washington Street
Saint Croix Falls, WI 54024
Hours: Mon-Fri, 10AM to 6PM
24/7/365 – Business Premium Partners ONLY