Every acronym on this site, in plain language.
Federal security and AI work runs on acronyms. Each page spells them out the first time they appear; this page collects them in one place, with the OMB memoranda we cite.
Authorization and assessment · Maturity · Standards · Software and AI supply chain · Information and facilities · Security operations and identity · Acquisition · Accessibility · OMB memoranda
AO
Authorizing Official. The senior official who formally accepts the risk of operating a system and grants its authorization to operate.
ATO
Authorization to operate. The Authorizing Official's formal decision that a system may operate, based on the risk they accept. Defined in NIST SP 800-37, the Risk Management Framework.
Continuous ATO
Continuous authorization to operate (cATO). Keeping an authorization current through continuous monitoring of controls and evidence, rather than re-authorizing from scratch every few years. None of our products replaces the initial ATO; they produce evidence for it.
ISSO
Information System Security Officer. The person responsible for a system's day-to-day security and for keeping its authorization evidence current.
ISSM
Information System Security Manager. Oversees the security program for a group of systems. ISSOs usually report to the ISSM.
RMF
Risk Management Framework. NIST's process for categorizing a system, selecting and assessing controls, authorizing it, and monitoring it (NIST SP 800-37).
SSP
System Security Plan. The document that describes a system's boundary and how each security control is implemented.
SAR
Security Assessment Report. The assessor's findings after testing a system's controls.
POA&M
Plan of Action and Milestones. The list of known weaknesses in a system, each with a remediation plan, owner, and due date.
OSCAL
Open Security Controls Assessment Language. NIST's machine-readable formats for security plans, assessment results, and POA&Ms, so tools can exchange them without retyping.
FedRAMP
Federal Risk and Authorization Management Program. The government-wide program that authorizes cloud services for federal use. None of our products holds a FedRAMP authorization.
IL
Impact Level. The Department of Defense's cloud security levels (IL2 to IL6), set by the sensitivity of the data. None of our products holds an Impact Level accreditation.
CMMC
Cybersecurity Maturity Model Certification. The Department of Defense's program for verifying that contractors protect federal contract information and controlled unclassified information. We claim alignment, not certification.
TRL
Technology readiness level. A 1 to 9 scale for how proven a technology is. TRL 5: the components work together and have been validated in a relevant laboratory environment. TRL 6: a working prototype of the whole system has been demonstrated in a relevant environment. TRL 7 and above mean the system has been demonstrated or used in an operational environment. In plain terms, our products are at TRL 5 to 6: pilot-ready. A pilot runs the product on your own material, inside your boundary, to show it works there before you commit to production.
NIST
National Institute of Standards and Technology. The federal agency that publishes the security and AI frameworks most federal systems are built against.
NIST SP 800-53
Security and Privacy Controls. The catalog of security and privacy controls that federal systems select from. We build to Revision 5.
NIST AI RMF
AI Risk Management Framework. NIST's voluntary framework for identifying, measuring, and managing the risks of AI systems (NIST AI 100-1).
SSDF
Secure Software Development Framework. NIST's practices for building software securely (NIST SP 800-218).
C-SCRM
Cybersecurity Supply Chain Risk Management. Managing the security risks that come from suppliers and third-party components (NIST SP 800-161).
Zero Trust
Zero Trust Architecture. A security model that grants no implicit trust based on network location; every request is checked (NIST SP 800-207).
STIG
Security Technical Implementation Guide. Configuration standards published by the Defense Information Systems Agency (DISA) for hardening systems and software.
FIPS
Federal Information Processing Standards. Federal standards, including FIPS 140-3 for validated cryptographic modules.
SBOM
Software bill of materials. An inventory of every software component and dependency in a product, so buyers can check for known vulnerabilities.
AI-BOM
AI bill of materials. The same idea for AI: an inventory of models, datasets, versions, and dependencies, with their provenance.
LLM
Large language model. An AI model trained on large amounts of text that can read and generate language.
LLMOps
Large language model operations. Releasing, evaluating, monitoring, and updating language models in production.
IaC
Infrastructure as code. Defining servers, networks, and configuration in version-controlled files instead of configuring them by hand.
Model card
Model card and data card. Short structured documents that describe what an AI model or dataset is, how it was built, and its known limits.
CUI
Controlled Unclassified Information. Government information that is not classified but still requires safeguarding under law or policy.
SCIF
Sensitive Compartmented Information Facility. An accredited room or building for handling classified information.
NSS
National Security System. A system that handles intelligence, cryptologic, military command, or classified information, governed by separate national security policy.
High-side
High-side and air-gapped. High-side means a classified network. Air-gapped means a network with no connection to the internet.
SIEM
Security information and event management. The system that collects and analyzes security logs.
SOAR
Security orchestration, automation and response. Tools that automate security response steps.
ITSM
IT service management. Ticketing and change-management systems such as ServiceNow.
KMS / HSM
Key management service and hardware security module. Services and devices that store and use cryptographic keys securely.
CAC / PIV
Common Access Card and Personal Identity Verification card. The smart cards Department of Defense and civilian federal staff use to sign in.
ABAC
Attribute-based access control. Access decisions based on attributes of the user, the data, and the request, rather than fixed roles alone.
OMB
Office of Management and Budget. The White House office that issues the memoranda ("M-" numbers) setting federal IT, security, and AI policy.
Section 508
Section 508 of the Rehabilitation Act. The law requiring federal technology to be accessible to people with disabilities.
WCAG
Web Content Accessibility Guidelines. The technical standard Section 508 points to; federal buyers usually ask for WCAG 2.1 Level AA.
ACR / VPAT
Accessibility Conformance Report and Voluntary Product Accessibility Template. An ACR states how a product meets Section 508 and WCAG; the VPAT is the template used to write one. ACR status for each product is available on request.
Each memo title links to the official text on whitehouse.gov. The summaries are plain-language orientation, not legal guidance; read the memo before relying on it.
OMB M-24-15
Modernizing the Federal Risk and Authorization Management Program (July 2024). Updates FedRAMP, the program that authorizes cloud services for federal use.
OMB M-25-21
Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (April 2025). Sets how agencies govern their own use of AI, including minimum risk practices for high-impact AI and the role of each agency's Chief AI Officer.
OMB M-25-22
Driving Efficient Acquisition of Artificial Intelligence in Government (April 2025). Sets how agencies buy AI, including contract terms on the use of government data and steps to avoid vendor lock-in.
OMB M-26-04
Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles (December 2025). Sets contract and transparency requirements for agencies that buy large language models, implementing Executive Order 14319.
OMB M-26-05
Adopting a Risk-based Approach to Software and Hardware Security (January 2026). Replaces the single government-wide secure software attestation form set by M-22-18 and M-23-16 with a risk-based approach. Agencies set their own requirements and may still ask for a self-attestation or an SBOM.