What is a System Security Plan?

What an SSP contains

NIST SP 800-171 requirement 3.12.4 asks organisations to develop, document and periodically update a plan describing system boundaries, environments of operation, how the security requirements are implemented, and connections to other systems.

Requirements that are not yet met go on a Plan of Action and Milestones (POA&M), which sits alongside the SSP and records the fix, the owner and the date.

• Boundary. What is in scope: the systems, people, facilities and cloud services that store, process or transmit CUI.
• Environment. How the system is built and run, usually with network and data flow diagrams.
• Requirements. For each of the 110 requirements, how it is met, who is responsible and where the evidence is.
• Connections. External systems and service providers the system connects to, and what passes between them.

How assessors use it

In a CMMC Level 2 certification assessment, the C3PAO starts from the SSP. Assessors compare what it says against interviews, evidence and the systems themselves, and score each requirement met or not met. An SSP that describes an ideal system, rather than the one in use, leads to findings across many requirements.

The SSP requirement is one of those the CMMC rule, 32 CFR Part 170, does not allow on a POA&M. It has to be met on the day of the assessment.

Keeping it current

An SSP goes out of date quickly. A new cloud service, a change in who handles CUI or a new office can each move the boundary. Review it at least once a year and whenever the system changes, and keep the version history so you can show what was true at the time of assessment.

The SSP is also where scoping decisions are recorded. A tightly drawn CUI enclave reduces the number of systems the 110 requirements apply to, but the SSP then has to explain how CUI is kept inside it.

Outside CMMC, the same kind of document is used for US federal systems, with guidance in NIST SP 800-18, and for FedRAMP cloud authorisations.

Related terms

NIST SP 800-171

The US standard of 110 security requirements for protecting Controlled Unclassified Information in non-federal systems, and the control set behind CMMC Level 2.

Plan of Action and Milestones (POA&M)

The CMMC and NIST document listing unmet requirements with the planned fix, owner and date. Only a limited set of requirements may sit on a POA&M at a CMMC assessment.

C3PAO

A CMMC Third-Party Assessment Organisation: a company authorised by the Cyber AB to carry out CMMC Level 2 certification assessments for US defence contractors.

Controlled Unclassified Information (CUI)

US government information that is not classified but must be protected under law or policy. Handling CUI brings a defence contractor under CMMC Level 2.