What Is a System Security Plan?
A System Security Plan (SSP) is the document that defines your CUI environment and describes how each NIST SP 800-171 requirement is implemented within it — who is responsible, which systems are involved, and how the control operates. Having an SSP is itself a requirement (NIST SP 800-171 §3.12.4), and an assessment can’t be completed without one.
A strong SSP includes:
- System boundary — what’s in scope for CUI, and what isn’t
- Network and data-flow diagrams — where CUI enters, is stored, processed, and leaves
- Asset inventory — systems, users, and external service providers in scope
- Implementation statements — for each of the 110 requirements, how it’s actually met
- Roles and responsibilities — including what your MSP or cloud provider owns
- Interconnections — connections to other systems and providers
What Is a POA&M?
A Plan of Action & Milestones (POA&M) documents each requirement that is not yet fully implemented, the plan to fix it, who owns the fix, the resources needed, and target completion dates (NIST SP 800-171 §3.12.2).
For CMMC Level 2, POA&Ms are tightly limited: conditional status requires a minimum score of 88 out of 110, only certain lower-weighted requirements can remain open, and open items must be closed within 180 days. A POA&M is a commitment, not a parking lot.
Compliance Documentation Project
| Who it’s for | Contractors who know their requirements but lack complete, accurate documentation — often after a gap assessment |
| You receive | System Security Plan with boundary definition and implementation statements for all 110 requirements · network and CUI data-flow diagrams · POA&M with owners, milestones, and closeout dates · core policy and procedure set mapped to requirements · evidence index organized by requirement |
| How we work | Working sessions with your leadership, IT team, or MSP; we write, you verify, we refine |
| Typical duration | 4–8 weeks, depending on environment complexity and responsiveness |
| Pricing | Scoped and priced in writing after a short call, based on environment size and complexity |
Why Template SSPs Fail
- They describe a company that doesn’t exist. Assessors compare your SSP to interviews and evidence. Mismatches are findings.
- They hide scope decisions. A template can’t tell you where your CUI boundary should be — and boundary choices drive cost.
- They ignore your providers. Your MSP and cloud services implement many controls. The SSP must say which, and how.
- Nobody can maintain them. If your team can’t update the SSP when systems change, it’s out of date within months.
We write documentation in plain language, tied to evidence, with a clear owner for every section.
Your Role
You know your business; we know the requirements. Expect to provide access to the people who run your systems (internal IT or MSP), existing policies and diagrams, and timely review of drafts. Your organization remains responsible for the accuracy of its SSP and any assessment affirmation — our job is to make sure it’s accurate, complete, and defensible.
Frequently Asked Questions
Do we need an SSP for CMMC Level 1?
Level 1 doesn’t require a formal SSP, but documenting how you meet the 15 Level 1 requirements makes your annual self-assessment and affirmation far easier to defend. For Level 2, an SSP is mandatory.
Can we use an SSP template?
A template is a reasonable starting structure. The problem is the content: assessors need statements that match how your environment actually operates. We use a proven structure and write the content from your real environment.
How long does it take to write an SSP?
For a small, well-scoped environment, typically 4–8 weeks including working sessions and reviews. Larger or poorly documented environments take longer.
What can go on a POA&M for CMMC?
For CMMC Level 2 conditional status, you need a score of at least 88/110, and only certain lower-weighted requirements may remain on the POA&M. Those items must be closed within 180 days. Higher-weighted requirements must be fully implemented at assessment.
Do you work with our MSP?
Yes. Most of our documentation projects involve the client’s MSP, because they implement many of the technical controls. We document what they own and coordinate evidence collection with them.
How do we keep the SSP current?
Update it whenever systems, providers, or scope change, and review it at least annually. Our vCISO service includes ongoing SSP and POA&M maintenance.
Get Documentation That Holds Up
Book a 30-minute call. We’ll review what documentation you have, recommend a scope, and send a written proposal — usually within one business day.