Glossary

Government contracting has a large vocabulary, and much of it is acronyms. These are the terms used on this site, grouped by the subject they belong to. Use your browser’s find command to jump to one.

Definitions here are short on purpose. Where a term has a legal definition, the regulation is the authority, not this page.

1. Area 1Buying and contractsSolicitations, UCF sections, CLINs, and contracting officer roles.
2. Area 2Contract types and evaluationFFP, T&M, cost reimbursement, best value, and Section M criteria.
3. Area 3Pricing and cost accountingFAR Part 31 allowable costs, wrap rates, indirect pools, and prompt payment.
4. Area 4Security and complianceFCI, CUI, NIST SP 800-171, CMMC, and SPRS scores.
5. Area 5Technical formats and disconnected workAir gaps, SHA-256 checksums, client-side execution, and OSCAL.
6. Area 6Registration, codes and small businessSAM.gov, UEI, CAGE, NAICS, PSC, NDC, and small business set-asides.
7. Area 7Agencies and namesDoD, DISA, GSA, NARA, OMB, and Treasury.
8. Area 8Project and authoringPrior art, clean room, provenance, knockout gates, deterministic sub-tools, and authoring AI.

Buying and contracts#

• Acquisition. The government’s word for buying: the whole process from deciding a need to closing out the contract.
• Amendment. A written change to a solicitation before award. Each one is part of the solicitation.
• Award. The government’s decision to give a contract to an offeror, and the act of signing it.
• BPA (blanket purchase agreement). A standing arrangement for repeated small purchases from the same vendor.
• CFR (Code of Federal Regulations). The collected regulations of federal agencies, arranged in numbered titles. Title 48 holds the acquisition regulations.
• CLIN (contract line item number). A numbered line in a contract for one thing being bought, with its quantity and price. A SLIN is a sub-line under it.
• Contracting officer (CO or KO). The government official with authority to sign, change and end a contract. Only a contracting officer can commit the government.
• COR (contracting officer’s representative). A government employee who monitors the work day to day. A COR cannot change the contract.
• DFARS (Defense Federal Acquisition Regulation Supplement). The Department of Defense’s additions to the FAR.
• FAR (Federal Acquisition Regulation). The main rulebook for how federal executive agencies buy goods and services.
• GWAC (government-wide acquisition contract). A large ordering contract for technology that any agency can use.
• IDIQ (indefinite delivery, indefinite quantity). A contract that sets terms and prices in advance and is then used by placing individual orders.
• IFB (invitation for bids). A solicitation for sealed bids, awarded on price.
• Modification. A written change to a contract after award.
• Offeror. A company that submits a proposal. Also called a bidder, quoter or respondent, depending on the kind of solicitation.
• Option. A right the government holds to extend a contract or buy more at prices already agreed.
• OT (other transaction). An agreement that is not a FAR contract, used by some agencies for research and prototypes. Also called an OTA.
• Period of performance. The dates between which the work is done.
• Prime contractor. The company that holds the contract with the government. A subcontractor holds a contract with the prime.
• PWS (performance work statement). A description of the work in terms of results required.
• RFI (request for information). Market research. Not a solicitation.
• RFP (request for proposals). A solicitation for negotiated contracts.
• RFQ (request for quotation). A request for prices, usually for simpler purchases.
• SBIR and STTR. Small Business Innovation Research and Small Business Technology Transfer: programs that fund research by small businesses in phases.
• Section L and Section M. The parts of a solicitation that give proposal instructions (Section L) and evaluation factors for award (Section M). This site borrows the letters: the guides are numbered under L, and How we decide what to build is its Section M.
• Solicitation. The government’s written request for offers.
• SOO (statement of objectives). A short statement of goals. The offeror proposes how to meet them.
• Sources sought. A notice asking who is capable of doing a piece of work. Market research, like an RFI.
• SOW (statement of work). A description of the work to be done.
• Task order. An individual order for services placed under an ordering contract.
• UCF (uniform contract format). The traditional layout of a solicitation in lettered Sections A through M.

Contract types and evaluation#

• Best value tradeoff. A basis for award in which the government may pay more for a better proposal.
• Cost reimbursement. A contract type in which the government pays the contractor’s allowable costs, usually plus a fee. CPFF, cost plus fixed fee, is the common form.
• CPARS (Contractor Performance Assessment Reporting System). Where the government records how a contractor performed. Other agencies read it when judging past performance.
• FFP (firm fixed price). A contract type with a set price that does not change with the contractor’s costs.
• LPTA (lowest price technically acceptable). A basis for award in which the lowest-priced proposal that meets the requirements wins.
• Past performance. How well a company did on earlier, similar work. A common evaluation factor.
• T&M (time and materials). A contract type that pays fixed hourly rates for labor, plus materials at cost. Labor hour, LH, is the same without materials.

Pricing and cost accounting#

• Allocable. Able to be assigned to a contract because it benefits that contract or the business as a whole.
• Allocation base. The measure an indirect cost pool is divided by to make a rate, such as direct labor dollars.
• Allowable cost. A cost the government will pay on a cost-based contract: reasonable, allocable, consistent with accounting standards and the contract, and not excluded by FAR Part 31.
• CAS (Cost Accounting Standards). Accounting rules for large negotiated contracts. Small businesses are exempt.
• Certified cost or pricing data. Detailed cost information a contractor must certify as accurate on large negotiated awards without adequate competition. The dollar threshold is set by law and differs between defense and civilian agencies.
• Cost pool. A group of indirect costs gathered together to be shared out.
• DCAA (Defense Contract Audit Agency). The agency that audits contractors’ costs and accounting systems for the Department of Defense.
• DCMA (Defense Contract Management Agency). The agency that administers defense contracts after award.
• Direct cost. A cost incurred for one specific contract.
• Escalation. A planned yearly increase in a rate or price.
• Fee. Profit on a cost-based contract.
• Fringe. The cost of employee benefits and payroll taxes, usually expressed as a rate on labor.
• Fully burdened rate. An hourly rate that includes the wage, all indirect costs and fee.
• G&A (general and administrative). The cost of running the company as a whole.
• Incurred cost submission. The yearly report of actual indirect costs that a contractor with cost-reimbursement work sends to the government.
• Indirect cost. A cost that supports more than one contract or the business generally.
• ODC (other direct cost). A direct cost that is not labor, such as travel or materials.
• Overhead. The cost of supporting the people who do contract work.
• Proper invoice. An invoice with every element the contract and the prompt payment rules require.
• Prompt Payment Act. The law that sets when agencies must pay and requires interest when they pay late.
• Provisional billing rate. An indirect rate used for invoicing during the year, settled against actual costs afterward.
• Unallowable cost. A cost the government will not pay, such as entertainment or alcohol.
• Wage determination. A list of minimum wages and benefits for job classes on certain service and construction contracts.
• WAWF (Wide Area WorkFlow). The Department of Defense’s system for submitting invoices and receiving reports.
• Wrap rate. The multiplier that turns a wage into a burdened rate.

Security and compliance#

• Affirmation. A statement by a senior company official that the company meets, and will keep meeting, its security requirements.
• ATO (authorization to operate). A government official’s formal decision that a system may be used.
• Banner marking. The marking at the top of each page of a document containing CUI.
• C3PAO. A third-party organization accredited to carry out CMMC assessments.
• CMMC (Cybersecurity Maturity Model Certification). The Department of Defense program for verifying that contractors protect FCI and CUI.
• CDI (covered defense information). The term in the DFARS for CUI handled under a defense contract.
• CUI (controlled unclassified information). Unclassified information that a law, regulation or government-wide policy requires to be protected.
• CUI Registry. The official list of CUI categories, kept by the National Archives.
• Designation indicator. The block on a CUI document that names who controls it.
• Export controls. Rules limiting who may receive certain technical data and items. The ITAR covers defense articles and the EAR covers dual-use items.
• FCI (federal contract information). Non-public information provided by or created for the government under a contract.
• FedRAMP. The government’s program for authorizing cloud services.
• NIST. The National Institute of Standards and Technology, which publishes the security standards most contracts refer to.
• NIST SP 800-53. The catalog of security and privacy controls for federal systems.
• NIST SP 800-171. The requirements for protecting CUI on non-federal systems.
• NIST SP 800-172. Enhanced requirements for CUI at higher risk.
• POA&M (plan of action and milestones). The list of unmet requirements, with a plan and a date for each.
• RMF (Risk Management Framework). The process federal agencies use to authorize their own systems.
• SPRS (Supplier Performance Risk System). The Department of Defense system where assessment scores and affirmations are recorded.
• SSP (system security plan). The document describing a system and how it meets each security requirement.

Technical formats and disconnected work#

• Air gap. A physical separation between a network and all others.
• CA (certificate authority). An organization that issues and signs certificates.
• Certificate chain. The sequence from a server’s certificate through intermediates to a trusted root.
• Checksum. A short fingerprint computed from a file’s contents. Also called a hash.
• Client-side. Running on the user’s own computer, in the browser, and not on a server.
• CSP (content security policy). An instruction from a web page telling the browser what it may load and where it may connect.
• Digest. The checksum that identifies a container image by its contents.
• Lockfile. A file recording the exact version and checksum of every dependency of a project.
• Manifest. A list describing the contents of a package, an image or a transfer.
• OSCAL (Open Security Controls Assessment Language). NIST’s formats for security controls, plans and assessment results as structured data.
• SBOM (software bill of materials). A list of the components a piece of software is built from.
• SHA-256. The checksum algorithm in general use for verifying files.
• SRG (Security Requirements Guide). Security requirements for a class of technology. A STIG applies one to a specific product.
• STIG (Security Technical Implementation Guide). Configuration rules for a specific product, published by DISA.
• X.509. The standard format for certificates.
• XCCDF. The XML format STIGs are published in.

Registration, codes and small business#

• 8(a). A Small Business Administration business development program for small businesses owned by disadvantaged individuals.
• Affiliation. A relationship of control between businesses that causes their sizes to be added together.
• CAGE code. A five-character code identifying a business location.
• HUBZone. Historically Underutilized Business Zone: an area, and the program for small businesses located in one.
• Limitations on subcontracting. The rule limiting how much of a set-aside contract a small prime can pass to others.
• Micro-purchase threshold. The dollar value under which purchases can be made without competition.
• NAICS (North American Industry Classification System). Six-digit codes classifying businesses by industry. Each has a size standard.
• NDC (nontraditional defense contractor). A business that has not recently performed defense work subject to full Cost Accounting Standards coverage.
• PSC (product and service code). A four-character code describing what is being bought.
• Rule of two. The rule that a purchase is set aside when two capable small businesses can be expected to offer at fair prices.
• SAM (System for Award Management). The government’s register of the businesses it contracts with, and its site for posting opportunities.
• SBA. The Small Business Administration.
• SDVOSB. Service-disabled veteran-owned small business.
• Set-aside. A competition limited to small businesses, or to one program’s participants.
• Simplified acquisition threshold. The dollar value under which simpler buying procedures apply.
• Size standard. The largest a business can be, in receipts or employees, and still count as small for a NAICS code.
• Sole source. An award made without competition.
• UEI (Unique Entity ID). The twelve-character identifier assigned to a business in SAM.
• WOSB and EDWOSB. Women-owned small business, and economically disadvantaged women-owned small business.

Agencies and names#

• DISA. The Defense Information Systems Agency. It publishes the STIGs.
• DoD. The Department of Defense. Since 2025 the department has also used the name Department of War on its own sites and correspondence. The regulations and contract clauses cited in these guides still say Department of Defense, and so do the guides.
• GSA. The General Services Administration. It runs SAM.gov and many government-wide contracts.
• NARA. The National Archives and Records Administration. It oversees the CUI program across the government.
• OMB. The Office of Management and Budget.
• Treasury. The Department of the Treasury. Its Bureau of the Fiscal Service publishes the Prompt Payment interest rate.

Project and authoring#

• Antigravity. An agentic AI coding assistant used during development to draft code, tests, and documentation under human direction.
• Claude Code. An agentic AI coding tool used during development to draft code, tests, and documentation under human direction.
• Clean room. Building software from functional specifications and public regulations without examining or copying another tool's proprietary code, text, or design.
• Decision log. A public record documenting every evaluation outcome, score rationale, drafting agent, and maintainer decision.
• Knockout gate. A non-negotiable pass/fail screening check that an idea must satisfy before being scored or built.
• Prior art. Pre-existing tools, spreadsheets, or documents solving a compliance or paperwork task, observed from public pages to identify the job to be done.
• Provenance. A record stating where the idea for a tool came from, what was taken (the job), and what was done differently.

A term is missing#

Tell the project. Email [email protected] or open an issue on GitHub. The glossary is a text file, so a pull request that adds a term is welcome too.