GovCon Glossary

A process improvement framework, maintained by the CMMI Institute (part of ISACA), that rates an organization's process maturity on a five-level scale from ad hoc to optimized. Federal buyers, especially in DoD software and systems development, often require or favor bidders holding a specific CMMI maturity level as evidence they can reliably deliver on schedule, cost, and quality.

A documented plan describing how an agency or contractor will sustain essential functions, personnel, and systems during a disruption such as a natural disaster, cyberattack, or facility loss. Federal COOP requirements stem from federal continuity directives, and contracts supporting critical missions often require contractors to maintain and periodically test their own COOP.

A project management method that integrates a contract's scope, schedule, and cost baselines to objectively measure work performance and forecast final cost and schedule outcomes. DoD and other agencies typically require EVM compliant with ANSI/EIA-748 on large or major systems contracts, using metrics like cost and schedule variance to flag problems early.

Integrated software that unifies core business functions, such as finance, accounting, HR, procurement, and supply chain, into a single system of record. Government contractors rely on ERP platforms to track incurred costs, timekeeping, and contract-level financials in a manner that satisfies DCAA accounting system requirements for cost-reimbursable and other flexibly priced contracts.

A performance or technical attribute of a system considered critical enough that failing to meet it can trigger a re-evaluation, restructuring, or cancellation of the acquisition program. KPPs are defined in DoD requirements documents, such as a Capability Development Document, and typically carry both a threshold (minimum acceptable) and objective (desired) value.

A type of statement of work that defines contract requirements in terms of required outcomes, performance standards, and measurable results rather than dictating specific methods. Used in performance-based acquisitions, a PWS is typically paired with a Quality Assurance Surveillance Plan the government uses to monitor and score contractor performance against those standards.

A management tool that documents identified security weaknesses in an information system, along with the remediation tasks, resources, responsible parties, and milestone dates needed to close them. Required under FISMA and the Risk Management Framework, POA&Ms are tracked throughout a system's Authorization to Operate to show a weakness is being actively resolved.

The Project Management Institute's guide codifying standard terminology, process groups, and knowledge areas, including scope, schedule, cost, risk, and quality, for managing projects. It underlies the PMP certification and gives GovCon program and project managers a common vocabulary, though specific contracts and agencies may layer their own management requirements on top of it.

A contractor-authored document describing the internal inspection, self-monitoring, and corrective-action procedures used to ensure deliverables and services meet contract quality requirements before the government ever inspects them. Commonly required on service and construction contracts, a QCP works alongside, not in place of, the government's own Quality Assurance Surveillance Plan.

NIST's structured, lifecycle process, comprising Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor steps, for managing cybersecurity risk in federal information systems, defined primarily in NIST SP 800-37. Contractors operating or connecting to federal systems are generally required to implement RMF-aligned security controls and support the assessment process leading to an Authorization to Operate (ATO).