What is a system security plan? The SSP an assessment starts from
Published 2026-10-23, 13 min read
109of 110 requirements
A system security plan (SSP) says what your system is and how it meets each security requirement. For 109 of the 110 Level 2 requirements, NIST lists the SSP among the documents an assessor may examine. The plan is the yardstick the rest of the assessment is held against.
- ACAccess control22/22
- ATAwareness and training3/3
- AUAudit and accountability9/9
- CMConfiguration management9/9
- IAIdentification and authentication11/11
- IRIncident response3/3
- MAMaintenance6/6
- MPMedia protection9/9
- PSPersonnel security1/2
- PEPhysical protection6/6
- RARisk assessment3/3
- CASecurity assessment4/4
- SCSystem and communications protection16/16
- SISystem and information integrity7/7
Filled: the requirement's Examine list names the system security plan. Hollow: PS.L2-3.9.2, protecting systems during terminations and transfers, the one that does not. Source: NIST SP 800-171A, as repeated in the DoD's CMMC Assessment Guide Level 2.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
What a system security plan is
The SSP is one requirement among the 110 in NIST SP 800-171 Rev 2, number 3.12.4. CMMC Level 2 takes it over unchanged as CA.L2-3.12.4: the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2. The whole requirement is one sentence.
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.NIST SP 800-171 Rev 2, 3.12.4, read 2026-10-23
Strip it down and the plan describes four things about one system, and keeps describing them as they change.
- Boundaries
- Where the system stops: which rooms, machines, accounts and cloud services are inside.
- Environment
- The building and surroundings the system runs in, and who can get near it.
- Implementation
- How each security requirement is met, at a high level, pointing to the proof.
- Connections
- Every other system it talks to: cloud, provider, customer portal.
The CMMC rule, 32 CFR Part 170, defines the SSP by borrowing NIST SP 800-53's wording: "the formal document that provides an overview of the security requirements for an information system" and "describes the security controls in place or planned for meeting those requirements." Note the word planned. The plan may describe a control you have not finished; the score will still count that requirement as NOT MET until it is done, which is where a POA&M comes in.
NIST is also clear about altitude. System security plans describe "at a high level, how the security controls meet those security requirements, but do not provide detailed, technical descriptions of the design or implementation of the controls." An SSP is not a configuration manual. It says what is done and points to where the detail and the proof live: a policy, a procedure, a screenshot folder, a provider's responsibility matrix.
No current SSP, no score
Most of the 110 requirements cost points when they are missing: 1, 3 or 5 off a maximum of 110. The SSP has no point value at all, and that is not leniency. The scoring rule treats it as the precondition for any score.
OSAs must have a System Security Plan (SSP) (CMMC security requirement CA.L2-3.12.4) in place at the time of assessment to describe each information system within the CMMC Assessment Scope. The absence of an up to date SSP at the time of the assessment would result in a finding that 'an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012.'32 CFR 170.24(c)(2)(i)(B)(5), read 2026-10-23
Two words carry the weight: up to date and each. A plan written two years ago for a different network fails the first; one plan that skips the shop-floor PCs feeding drawings to a CNC controller fails the second. And the plan can't be parked on a POA&M. Neither can any of its three neighbours in the security assessment family, as their point values show.
| Requirement | What it asks | Points | On a POA&M? |
|---|---|---|---|
| CA.L2-3.12.1 | Periodically assess the security controls to see if they work. | 5 | No: worth 5 |
| CA.L2-3.12.2 | Develop and implement plans of action to correct deficiencies. | 3 | No: worth 3 |
| CA.L2-3.12.3 | Monitor security controls on an ongoing basis. | 5 | No: worth 5 |
| CA.L2-3.12.4 | Develop, document and periodically update the SSP. | None | Never: named |
Points: 32 CFR 170.24(c)(2)(i)(B). POA&M limits: 170.21(a)(2)(ii)–(iii), which admit only 1-point items and name CA.L2-3.12.4 outright.
So the SSP is the one gap no score can absorb. The SPRS score calculator will count every other requirement for you; this one decides whether there is a score to count. What the plan feeds depends on who is assessing.
You assess yourself, under the CMMC rule.
- You assess against the NIST SP 800-171A objectives, so the eight objectives of 3.12.4 bind you exactly as they would bind an assessor. 32 CFR 170.16(c)(1)
- Without an up-to-date SSP (CA.L2-3.12.4) at the time of assessment, the assessment cannot be completed. 170.24(c)(2)(i)(B)(5)
- A cloud provider's or an ESP's customer responsibility matrix must be documented or referred to in your SSP. 170.16(c)(2)(iii), (c)(3)(i)
- SPRS gets your level, status date, scope, CAGE codes, score and POA&M status. The SSP itself is not uploaded; you keep it ready for anyone who asks. 170.16(a)(1)(i)
What an assessor reads, asks and tests
NIST SP 800-171A gives every requirement three ways to be assessed: examine documents, interview people, test processes. The assessor picks from each list. For 3.12.4 the lists show that the plan is judged as much on how it is kept as on what it says.
Documents they may read
- Security planning policy
- Procedures for SSP development and implementation
- Procedures for SSP reviews and updates
- Enterprise architecture documentation
- The system security plan
- Records of SSP reviews and updates
People they may ask
- Whoever plans security and keeps the SSP
- Whoever has information security responsibilities
Processes they may try
- How the SSP is developed, reviewed, updated and approved
- The mechanisms that support the SSP
Notice what sits on the Examine list beside the plan: a security planning policy, procedures for writing and reviewing the plan, and records of its reviews. An SSP with no review history fails objective [h] however good its content is. The DoD's own example in the assessment guide has senior leadership formally approve the plan and a policy that requires a formal review and update each year. Your security policies are where that review rule belongs.
Then come the eight objectives. Each must be MET or not applicable for 3.12.4 to be MET. The sheet below puts them beside what to have on the table; the SSP template checks your draft against the same eight as you write it.
SSP readiness sheet: the eight 3.12.4 objectives, cuideck.com
| Objective | Determine if | Have ready |
|---|---|---|
| 3.12.4[a] | a system security plan is developed. | The plan itself: named, versioned, dated and approved by someone with authority. Final, not a draft. |
| 3.12.4[b] | the system boundary is described and documented in the system security plan. | The scope in words, with the network diagram and the asset inventory it matches. |
| 3.12.4[c] | the system environment of operation is described and documented in the system security plan. | The building, rooms, doors and who can reach the equipment. |
| 3.12.4[d] | the security requirements identified and approved by the designated authority as non-applicable are identified. | Each N/A with its reason and who approved it. |
| 3.12.4[e] | the method of security requirement implementation is described and documented in the system security plan. | One statement per requirement or family, each pointing to its evidence. |
| 3.12.4[f] | the relationship with or connection to other systems is described and documented in the system security plan. | Every cloud, provider and outside system, with each provider's responsibility matrix referenced. |
| 3.12.4[g] | the frequency to update the system security plan is defined. | The review interval in writing: the DoD guide reads it as at least annually. |
| 3.12.4[h] | system security plan is updated with the defined frequency. | The version history: dates of past reviews, who did them, what changed. |
Objectives: NIST SP 800-171A. Have ready: our advice.
What goes in each part
The DoD's Level 2 assessment guide gives a minimum list, and Part 170 adds what it expects the plan to record about assets, providers and exceptions. Together they make 8 parts. Open any row for the rule and an example from a 30-person machine shop.
Scope and boundary[b]
A description of the CMMC Assessment Scope, with a high-level description of the assets in it. There is no requirement to embed every asset in the SSP. DoD Assessment Guide L2, p. 209
Example
CUI lives in the engineering office (two CAD workstations, one file server in the locked IT closet), the CAM PC on the shop floor and the cloud tenant that holds customer drawings. Everything else, including the front office, is outside, separated by its own network.
Asset treatment[b]
For each in-scope category (CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets): document in the asset inventory, document asset treatment in the SSP, document in the network diagram. 32 CFR 170.19(c)(1), table 3
Example
The firewall and the backup server are Security Protection Assets. The two CNC controllers that receive programs are Specialized Assets (OT): own network segment, no internet, managed under the shop's policy.
Environment of operation[c]
The physical surroundings in which the system processes, stores and transmits information. DoD Assessment Guide L2, p. 209
Example
One single-storey building. The engineering office and IT closet sit behind a badge-controlled door; visitors sign in and are escorted; the shop floor is open to employees only.
Requirements and what does not apply[d]
The identified and approved security requirements, and those approved by the designated authority as not applicable. An objective assessed N/A counts the same as MET. Guide p. 209; 170.24(b)(3)
Example
All 110 apply except SC.L2-3.13.5 (public-access system separation): no publicly accessible system sits in the scope, the marketing website is hosted outside it. Approved by the owner, with the date.
How each requirement is met[e]
A description of how the identified and approved requirements are implemented in the system or environment. DoD Assessment Guide L2, p. 210
Example
3.5.3: every user signs in with a password and an authenticator app, enforced by one sign-in policy for all accounts; policy export and enrolment report in Evidence/IA.
Connections and providers[f]
Related, dependent and interconnected systems. A cloud provider's or ESP's customer responsibility matrix is documented or referred to in the SSP. Guide p. 210; 170.16(c)(2)(iii), (c)(3)(i)
Example
Cloud tenant (its responsibility matrix: Appendix C). The IT provider's remote-management tool (service description and matrix: Appendix D). The prime's supplier portal, where drawings are downloaded.
Exceptions and adjudications[d], [e]
Enduring exceptions, described with their mitigations, are assessed as MET. A DoD CIO adjudication must be in the SSP to be considered. 170.4; 170.24(b)(1)(i), (c)(2)(i)(B)(8)
Example
The coordinate measuring machine's PC runs an operating system its maker no longer updates: enduring exception, isolated segment, USB transfers scanned at a kiosk first.
Review, version and approval[a], [g], [h]
A defined frequency of updates, at least annually. Evidence must be in final form, not draft. Guide p. 210; 170.24(b)(1)
Example
Version 3.0, approved by the owner. Reviewed every 12 months and whenever the boundary changes; the version table lists every review, who did it and what changed.
The guide adds three things an SSP often includes: a general technical and functional description of the system, design philosophies such as defense in depth and the interfaces and protocols allowed, and the roles and responsibilities of key people, such as the system owner and the system custodian. In a small shop the roles section is often one paragraph: who owns the plan, who keeps it current, and which outside provider does what.
The SSP and the documents around it
The SSP is rarely where the detail lives. It is the document that ties four others together, and an assessor reads them side by side. Each one below holds something the plan only describes or points to.
Says what the system is, where its line runs and how each requirement is met, then names the document or record that proves it. One plan for each information system in the scope.
Asset inventory and network diagram
Holds Every in-scope asset by category, and the drawing of the scope. 3.4.1 asks you to maintain inventories of hardware, software, firmware and documentation.
The SSP Records how each category is treated. Part 170 asks for all three, inventory, SSP and diagram, for every in-scope category, so the three must agree.
32 CFR 170.19(c)(1); NIST 3.4.1
Policies and procedures
Holds The rules your people follow and the steps they take: access, media, incidents, reviews.
The SSP Points to them instead of repeating them. NIST: effective plans make extensive use of references to policies and procedures. A security planning policy is on 3.12.4's own Examine list.
NIST 3.12.4 discussion; 800-171A
Plans of action and the POA&M
Holds What is not done yet, with tasks, owners and dates.
The SSP Describes controls in place or planned. NIST lets the plan and the plan of action be separate or combined, in any format. The SSP itself can never be a POA&M item.
NIST 3.12.2 discussion; 170.21(a)(2)(iii)
Provider documents
Holds Each cloud provider's and outside IT provider's service description and customer responsibility matrix.
The SSP Documents the provider's use, relationship and services, and documents or refers to the responsibility matrix: the line between what they do and what you do.
32 CFR 170.16(c)(2)(iii), (c)(3)(i)
Where SSPs fail
Most failed plans are not missing. They exist, they are long, and they describe something the assessor can't find. Five patterns, each with a line that fails and a line that holds. The lines are our examples; the rule each one breaks is cited beside it.
The plan describes the network you meant to build7020(a); 170.24(c)(2)(i)(B)(6)
Fails
“CUI is encrypted at rest on every system.” The CAM PC on the shop floor is not.
Holds
“Encrypted at rest: file server and both CAD workstations. CAM PC: not yet, on the POA&M as SC.L2-3.13.16, due 2026-12-15.”
A statement that fits any company3.12.4[e]
Fails
“We use multifactor authentication.”
Holds
“Every account signs in with a password and an authenticator app, enforced by one sign-in policy; export and enrolment report in Evidence/IA.”
N/A with nothing behind it3.12.4[d]; 170.24(b)(3)
Fails
“3.13.5: N/A.”
Holds
“3.13.5 N/A: no publicly accessible system in the scope; the website is hosted outside it. Approved by the owner, 2026-09-30.”
A provider named, its matrix missing170.16(c)(2)(iii)
Fails
“Email and files: our cloud provider.”
Holds
“Cloud tenant, responsibility matrix in Appendix C. We own accounts, MFA and sharing settings; the provider owns the data centre and its patching.”
Reviewed “as needed”3.12.4[g], [h]
Fails
No interval, no version table, one date on the cover from two years ago.
Holds
“Reviewed every 12 months and whenever the boundary changes. Last review 2026-09-30, version 3.0, by the IT lead.”
The first pair matters most. The plan may describe a control that is still planned, but a requirement not yet implemented is scored NOT MET whether or not it sits on a POA&M, and a High Assessment exists to check that the system is built the way the plan says. Write what is true today, and put the rest on the POA&M template if the rule lets it wait.
Questions about SSPs
Does CMMC Level 1 need a system security plan?
No. Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21(b)(1)(i)–(xv), and none of them is a plan. Writing your scope down in the same shape still makes the yearly self-assessment faster. The list is in the CMMC Level 1 requirements.
How long should an SSP be?
As long as it takes to cover the four descriptions and no longer. NIST says there is no prescribed format or specified level of detail, and that plans describe controls at a high level rather than in technical detail. A small shop's plan that points to its policies and evidence is often shorter than the template it started from.
Can the SSP go on a POA&M?
No. CA.L2-3.12.4 is one of the 6 requirements Part 170 names as never allowed on a POA&M. What a POA&M is covers the rest of the rule.
How often does the SSP have to be updated?
3.12.4 says periodically and leaves the interval to you: objective [g] asks that you define it, [h] that you keep to it. The DoD's Level 2 assessment guide reads it as at least annually. Our advice: also review it whenever the boundary changes, such as a new machine on the network, a move or a new cloud service.
Do we need one SSP or several?
Part 170 asks for an SSP that describes each information system within the scope. A shop with one network usually writes one. If you keep several, the DFARS Basic Assessment email lists every CAGE code each plan covers and a brief description of the plan architecture.
Do I upload the SSP to SPRS?
No. A Level 2 (Self) result in SPRS carries the level, status date, scope, CAGE codes, score and POA&M status, not the plan. A third-party assessment records the SSP's name, date and version with the result. Keep the plan ready to show; date and version it from the first draft.
Is there an official SSP template?
No template is mandatory. NIST's discussion of 3.12.4 points to its CUI supplemental material, which includes templates, and you may use any format. Our SSP template follows the parts on this page and checks a draft against the eight objectives.