Short answer: A System Security Plan (SSP) is the document that describes the systems that handle your Controlled Unclassified Information (CUI) and explains how each of the 110 NIST SP 800-171 requirements is implemented. It’s required by NIST SP 800-171 (requirement 3.12.4), it’s the starting point for your SPRS score, and it’s one of six CMMC Level 2 requirements that can never be deferred to a POA&M. Under the CMMC rule, if you don’t have a current SSP at the time of an assessment, the assessment can’t be completed.
What does NIST SP 800-171 require in an SSP?
Requirement 3.12.4 asks organizations to develop, document, and periodically update system security plans that describe:
- System boundaries: what’s in scope and what isn’t
- Environments of operation: where the systems run (offices, cloud, remote users)
- How security requirements are implemented: for each requirement
- Relationships with or connections to other systems: including outside providers
NIST notes that an SSP doesn’t have to be a single document. It can be a collection of documents, including ones that already exist, as long as together they cover these elements.
Why does the SSP matter so much?
- DFARS 252.204-7012 requires contractors that handle CUI to implement NIST SP 800-171, and 3.12.4 is part of it. See DFARS 252.204-7012 explained.
- Your SPRS score depends on it. A NIST SP 800-171 self-assessment is a review of your SSP against each requirement. An SSP that’s vague or outdated produces a score you can’t defend.
- CMMC treats it as a gate. The CMMC scoring rule (32 CFR § 170.24) states that without an up-to-date SSP at the time of assessment, the result is a finding that “an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012.”
- Assessors start with it. For a CMMC Level 2 certification assessment, the name, date, and version of your SSP are recorded with the results.
What goes in an SSP? A section-by-section outline
| Section | What to include |
|---|---|
| 1. System identification | System name, organization, CAGE code(s), system owner, and security contact |
| 2. Purpose and CUI description | What the system is used for and what types of CUI it handles, for which contracts |
| 3. Scope and boundary | What’s inside the boundary: locations, networks, cloud services, user groups. What’s explicitly out of scope and why. |
| 4. Asset inventory | Hardware, software, and services, grouped by CMMC asset category (see below) |
| 5. Network diagram and data flows | How CUI enters, moves through, is stored in, and leaves the environment |
| 6. Roles and responsibilities | Who owns security decisions, who administers systems, and the responsibilities of any outside providers |
| 7. External providers | Each cloud or managed service provider, what it does, and its customer responsibility matrix |
| 8. Requirement implementation | For each of the 110 requirements: status (implemented, partially, planned), a description of how it’s met, responsible party, and where the evidence lives |
| 9. Related documents | Policies, procedures, the POA&M, incident response plan, configuration baselines |
| 10. Plan maintenance | Who updates the SSP, what triggers an update, and version history |
How should you document asset categories?
For CMMC Level 2, the scoping rule (32 CFR § 170.19) sorts assets into categories, each documented differently:
| Category | What it is | SSP treatment |
|---|---|---|
| CUI Assets | Process, store, or transmit CUI | Inventory, network diagram, assessed against all requirements |
| Security Protection Assets | Provide security functions to the environment (e.g., firewalls, identity, logging) | Inventory, SSP, network diagram, assessed |
| Contractor Risk Managed Assets | Can but aren’t intended to handle CUI, because of policies and controls in place | Inventory, SSP, network diagram |
| Specialized Assets | Can’t be fully secured: IoT, operational technology, government-furnished equipment, test equipment | Inventory, SSP, network diagram |
| Out-of-Scope Assets | Physically or logically separated from CUI assets and can’t handle CUI | Be ready to justify why |
A smaller, well-defined boundary makes everything else easier. Some organizations isolate CUI in a dedicated enclave to shrink scope.
What does a good implementation statement look like?
Section 8 is where most SSPs fall short. Compare:
| Weak | Strong |
|---|---|
| “MFA is implemented.” | “3.5.3: Multifactor authentication is enforced through [identity provider] conditional access for all users accessing the CUI environment, including privileged and remote access. Local administrator logons on CUI workstations require [method]. Configuration is reviewed when policies change. Evidence: conditional access policy export; admin logon procedure.” |
A strong statement names the mechanism, the scope (who and what it applies to), the responsible party, and the evidence. An assessor should be able to read it and know exactly what to test.
What are the most common SSP mistakes?
- Copying a template without tailoring it. Generic text that doesn’t match your environment fails the moment an assessor asks to see it working.
- Claiming “implemented” for partial controls. This inflates your SPRS score and creates legal exposure. Mark it partial and add it to the POA&M.
- Leaving providers out. Cloud and managed service providers that touch CUI are in scope. Their responsibilities and yours must be documented, usually through a customer responsibility matrix.
- No diagram or data flow. Without them, scope can’t be verified.
- Writing it once. An SSP must be updated when systems, providers, or locations change.
Frequently Asked Questions
Is an SSP required for CMMC Level 1?
CMMC Level 1 has 15 basic requirements and doesn’t include NIST SP 800-171 requirement 3.12.4. An SSP is required for Level 2. Documenting your Level 1 environment is still good practice. See CMMC Level 1 vs. Level 2.
Can the SSP and POA&M be one document?
Yes. NIST SP 800-171 allows the SSP and plan of action to be separate or combined, in any format. Many small organizations keep the SSP as a document and the POA&M as a linked spreadsheet. See our POA&M guide.
How long does it take to write an SSP?
It depends on the size and complexity of your environment and how much is already documented. The writing is usually faster than the discovery: confirming scope, data flows, and how each requirement is actually met.
Does NIST SP 800-171 Rev. 3 change the SSP?
Rev. 3 keeps the system security plan requirement with updated wording. The CMMC rule assesses Level 2 against Rev. 2 (using NIST SP 800-171A, June 2018), so write your SSP against the Rev. 2 requirement numbers. See the Level 2 requirements.
How USCIBER can help
USCIBER writes SSPs from your real environment, not a fill-in template: scope, asset categories, diagrams, provider responsibilities, and implementation statements for all 110 requirements, with a matching POA&M and an accurate SPRS score. The Compliance Documentation Project is scoped after a short call. If you need to find your gaps first, start with a CMMC Readiness Review from $7,500. USCIBER is a readiness consultant; it is not a C3PAO and does not issue CMMC certifications.
Sources
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirements 3.12.2 and 3.12.4
- 32 CFR Part 170 — § 170.19 CMMC scoping, § 170.24 CMMC Scoring Methodology, § 170.17 Level 2 certification assessment (eCFR)
- DFARS 252.204-7020 — NIST SP 800-171 DoD Assessment Requirements (a Basic Assessment is based on the contractor’s review of its SSP)
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting (eCFR)
- DoD CIO — Cybersecurity Maturity Model Certification
This article is general information, not legal advice.