Certifications Glossary

An SBA program for small disadvantaged businesses. Provides access to sole-source contracts and mentoring.

8(a) graduation occurs when a firm completes its 9-year term in the SBA 8(a) Business Development Program. Firms may also exit early if they exceed size standards, the owner's net worth exceeds $850K (excluding primary residence and business equity), or program violations occur. After graduation, the firm retains SDB status but loses 8(a) sole-source and competitive set-aside eligibility.

ATO (Authority to Operate) is the formal authorization for an IT system to operate in a federal environment. Issued by the Authorizing Official after security assessment. Required before any system goes live. Governed by NIST RMF.

A Certificate of Competency (COC, FAR 19.6) is an SBA determination that a small business is capable of performing a specific contract, overriding the contracting officer's non-responsibility finding. The CO must refer any small business found non-responsible to SBA, which conducts its own investigation. If SBA issues a COC, the CO must award to that small business.

A cybersecurity framework required for defense contractors. Different levels based on data sensitivity.

CMMC Level 2 (Advanced) requires implementation of all 110 security practices from NIST SP 800-171 Rev 2. Applies to contractors handling CUI on DoD contracts. Requires third-party assessment by a C3PAO (Certified Third-Party Assessment Organization) every three years. Most DoD contractors handling CUI will need Level 2.

COMSEC clearance authorizes access to communications security material, including cryptographic equipment, keys, and procedures used to protect classified communications. COMSEC is managed by the NSA and is critical for protecting government and military communications. COMSEC access is required for contracts involving installation, maintenance, and operation of encrypted communications systems. This includes work on SIPR networks, Type 1 cryptographic equipment, and key management systems. Contractors providing communications support to military units and agencies need COMSEC-authorized personnel.

The Confidential clearance is the lowest level of security clearance, granting access to information whose unauthorized disclosure could cause damage to national security. This is the entry-level clearance used across DoD and other agencies for personnel who need limited access to classified materials. Some defense contracts require Confidential clearances for personnel handling classified material at the lowest level. This clearance is relatively quick to obtain and is common for manufacturing, logistics, and administrative support contracts where limited classified access is needed.

CNWDI is a DoD category of Top Secret Restricted Data revealing the theory of operation or design of the components of a nuclear weapon. Access to CNWDI is limited to the minimum number of personnel whose official duties require it. CNWDI is a subset of Restricted Data that receives additional protection. CNWDI access is required for contracts involving nuclear weapons design, stockpile stewardship, warhead life extension programs, and nuclear weapons effects testing. The primary customers are NNSA, the nuclear weapons laboratories, and the military services' nuclear enterprise. Highly specialized contracts with very limited competition.

A WOSB owned by women who are economically disadvantaged. Eligible for additional set-aside opportunities.

A WOSB whose owner is also economically disadvantaged. Eligible for additional set-aside opportunities.

FAC-C (Federal Acquisition Certification in Contracting) is the certification for federal contracting officers and specialists. Three levels based on education, experience, and training. Required by OFPP.

FAC-COR (Federal Acquisition Certification for Contracting Officer's Representatives) certifies government CORs. Three levels of training required based on contract complexity.

FAC-P/PM (Federal Acquisition Certification for Program and Project Managers) certifies federal program/project managers. Three levels aligned with program size and complexity.

FedRAMP Authorization is the formal approval for a cloud service provider to operate in the federal environment. Two paths: Agency Authorization (sponsored by a single agency) and JAB Authorization (reviewed by the Joint Authorization Board — DoD, DHS, GSA). JAB authorization is more rigorous but provides broader reuse across agencies.

FedRAMP High is the highest FedRAMP authorization baseline, requiring implementation of approximately 421 security controls from NIST 800-53. Required for cloud systems processing highly sensitive government data where loss of confidentiality, integrity, or availability would have severe or catastrophic impact (e.g., law enforcement, emergency services, financial systems).

FedRAMP Low is the entry-level FedRAMP authorization baseline with approximately 125 security controls. Applies to cloud systems handling non-sensitive, publicly available data where loss would have limited adverse impact. Least costly to achieve but covers a narrow set of government use cases.

FedRAMP Moderate is the most common FedRAMP authorization baseline, requiring approximately 325 security controls. Applies to cloud systems where loss of confidentiality, integrity, or availability would have serious adverse impact. Covers the majority of federal cloud deployments including email, collaboration, and CUI-handling systems.

A program for businesses in economically distressed areas. Must maintain 35% of employees in HUBZone areas.

SBA program for businesses in economically distressed areas. Provides set-aside and sole source opportunities.

IATO (Interim Authority to Operate) is a temporary, time-limited ATO allowing a system to operate while completing full security assessment. Typically 90-180 days. Requires risk acceptance by the Authorizing Official.

An Interim Secret clearance is a temporary clearance granted while the full Secret investigation is pending. It allows contractors to begin work on classified projects before the complete background investigation is adjudicated, reducing workforce gaps and contract start delays. Interim clearances allow contractors to place personnel on classified work quickly while awaiting full adjudication. However, some contracts and agencies do not accept interim clearances, and access may be restricted to specific programs. Interim clearances can be revoked if derogatory information surfaces during the full investigation.

An Interim Top Secret clearance is a temporary authorization granted while the full SSBI investigation is pending. It provides limited Top Secret access to allow personnel to begin work on classified programs. Interim TS clearances are granted less frequently than Interim Secret due to the higher risk level. Interim Top Secret clearances help contractors place personnel on TS-level programs while the full investigation (which can take over a year) is completed. Not all agencies grant interim TS clearances, and access restrictions may apply. The uncertainty of interim status makes workforce planning challenging for contractors.

The L clearance is the Department of Energy equivalent of a Secret clearance. It grants access to Confidential Restricted Data, Secret National Security Information, and Confidential Formerly Restricted Data. L clearances are used for personnel who need limited access to classified information in the DOE complex. L clearances are required for many support contracts at DOE facilities, national laboratories, and nuclear sites. Positions in facilities management, IT support, administrative services, and non-weapons research at DOE sites often require an L clearance. This is the most common DOE clearance for contractor personnel.

The NACI is the baseline investigation for federal employees in non-sensitive, low-risk positions. While not a security clearance per se, it is the standard background check for most federal contractor positions that do not require access to classified information or sensitive systems. NACI-equivalent investigations are required for contractor personnel accessing federal facilities, non-sensitive IT systems, and unclassified government networks. Many civilian agency contracts require at minimum a completed NACI for all on-site contractor personnel. This is the most accessible level for small businesses entering federal contracting.

COSMIC Top Secret is NATO's highest classification level, equivalent to a national Top Secret clearance. COSMIC stands for Control of Secret Material in an International Command. Access requires both a national Top Secret clearance and additional NATO vetting for the most sensitive alliance information. COSMIC Top Secret clearances are required for the most sensitive NATO contracts including nuclear sharing arrangements, strategic planning, and allied intelligence programs. Very few contractors need CTS clearances, but those supporting senior NATO command structures and strategic systems require them.

A NATO Secret clearance allows access to NATO classified information at the Secret level. NATO clearances are processed through the national security authority and are based on the holder's existing national clearance. NATO has its own classification system parallel to U.S. classifications. NATO clearances are required for contracts supporting NATO operations, exercises, and infrastructure. This includes work at NATO headquarters in Brussels, SHAPE, Allied Command Transformation in Norfolk, VA, and NATO Communications and Information Agency. U.S. defense contractors working on NATO-interoperable systems often need NATO-cleared personnel.

A high-risk public trust position involves duties that can cause significant damage to the public trust if performed improperly. This includes access to sensitive financial data, critical IT infrastructure, law enforcement information, or policy-making positions. High-risk public trust designations are required for contracts involving access to critical government IT systems, financial management, tax data (IRS), and law enforcement databases. Contractors working on systems like Healthcare.gov, IRS modernization, or financial management systems typically need this level.

A Public Trust position at the moderate risk level requires a background investigation but is not a security clearance in the traditional sense. It is used for positions that involve access to sensitive but unclassified information, moderate-risk duties, or IT systems processing sensitive data. Many federal IT, healthcare, and financial contracts require contractor personnel to hold at least a moderate risk public trust determination. This is common in CMS, SSA, VA, and other civilian agency contracts. Contracts requiring public trust are more accessible to smaller firms than those requiring security clearances.

The Q clearance is the Department of Energy equivalent of a Top Secret clearance. It grants access to classified Restricted Data (RD) and Formerly Restricted Data (FRD) related to nuclear weapons design, production, and stockpile stewardship. Q clearances are administered by DOE's Office of Personnel Security. Q clearances are required for contractors at national laboratories (Los Alamos, Sandia, Lawrence Livermore), nuclear weapons production facilities, and nuclear navy propulsion programs. DOE contracts for nuclear cleanup, stockpile stewardship, and weapons engineering require Q-cleared personnel.

Sensitive Compartmented Information access is granted on a compartment-by-compartment basis to individuals who hold a Top Secret clearance and have been nominated for access to specific intelligence programs. Each SCI compartment (e.g., SI, TK, G, HCS) controls access to a specific category of intelligence information. SCI access is required for contracts supporting intelligence collection, analysis, and dissemination. These include SIGINT, IMINT, HUMINT, and cyber intelligence programs. Contractors must have a SCIF and an SCI contract nexus. SCI contracts are among the highest-margin opportunities in government contracting due to limited competition.

SDB (Small Disadvantaged Business) is a small business at least 51% owned by one or more individuals who are socially and economically disadvantaged. Eligible for price evaluation adjustments.

A small business owned by socially and economically disadvantaged individuals, as defined by SBA.

A certification for businesses owned by veterans with service-connected disabilities. Eligible for set-aside contracts.

A small business owned by a veteran with a service-connected disability, eligible for sole source and set-aside contracts.

The Secret clearance grants access to information whose unauthorized disclosure could cause serious damage to national security. It is the most commonly held clearance level, with approximately 3 million active Secret clearance holders across government and industry. Most defense contracts require at least a Secret clearance. The Secret clearance is the most commonly required clearance in federal contracting. The majority of DoD contracts, particularly in IT, engineering, logistics, and professional services, require Secret clearances. Having a cleared workforce is a significant competitive advantage and barrier to entry in defense contracting.

Special Access Programs (SAPs) impose additional security measures beyond those for standard classified information. SAPs protect the most sensitive military technologies, intelligence methods, and covert operations. Access is strictly controlled and limited to individuals with a specific, validated need to know. SAP contracts cover the most advanced and sensitive defense technologies including stealth, space, cyber, and next-generation weapons. SAP contracts are highly lucrative but extremely restricted. Only contractors with established SAP facilities and pre-cleared personnel can compete. Many SAP contracts are sole-sourced due to extreme security requirements.

TS/SCI adds Sensitive Compartmented Information access to a Top Secret clearance. SCI is a classification for intelligence information that requires special handling and is compartmented so that access to one SCI program does not automatically grant access to another. SCI is primarily used by the intelligence community. TS/SCI is required for intelligence community contracts, signals intelligence programs, imagery analysis, cyber operations, and classified technology development. These contracts are among the most lucrative in government contracting, with limited competition due to the high barrier of cleared personnel and SCIF requirements.

The Top Secret clearance grants access to information whose unauthorized disclosure could cause exceptionally grave damage to national security. The investigation is comprehensive, covering the applicant's entire adult life. Approximately 1.3 million people hold active Top Secret clearances. Top Secret clearances are required for contracts involving intelligence, national security, advanced weapons systems, and classified R&D. Companies with TS-cleared personnel can compete for higher-value, less competitive contracts. The lengthy investigation timeline means contractors must plan workforce development well in advance.

A business owned and controlled by one or more veterans. May qualify for certain set-aside contracts.

A business at least 51% owned by one or more women. Eligible for WOSB set-aside contracts in certain industries.

A small business at least 51% owned and controlled by women, eligible for WOSB set-aside contracts.

Yankee White is an administrative designation for personnel who work in direct support of the President and Vice President of the United States. It is the most stringent personnel reliability program, requiring extensive vetting beyond standard Top Secret / SCI investigations. Yankee White clearances are required for contractors providing direct Presidential support services including communications, transportation, medical, and food services at the White House and Presidential support facilities. These are extremely limited and specialized contracts.