Where the requirement comes from
NIST SP 800-171 requirement 3.12.4 (CA.L2-3.12.4 in CMMC) requires you to develop, document and periodically update a system security plan that describes your system boundaries, environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
What a strong SSP includes
- Scope and boundary. What's in and out of the assessment, with a network or data-flow diagram showing where CUI is stored, processed and transmitted.
- Asset inventory by CMMC category. CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and out-of-scope assets.
- Environment description. Locations, on-premises systems, cloud services and external service providers.
- An implementation statement for every requirement. Specific, verifiable descriptions of what you actually do, who does it and which tools you use, not a restatement of the requirement.
- Shared and inherited responsibilities. Which controls your cloud or managed service providers cover, backed by their customer responsibility matrix.
- Roles and connections. Who is responsible for security, and how the in-scope system connects to other systems.
- Version history. When the plan was reviewed and updated.
SSP vs. POA&M
The SSP describes how requirements are met today. A Plan of Action and Milestones (POA&M, requirement 3.12.2) lists the requirements that aren't met yet and how and when you'll fix them. Under CMMC, a POA&M is allowed only in limited cases at Level 2, so the goal is a plan with as few open items as possible.
Common SSP mistakes
- Template copy-and-paste. Generic language that doesn't match how your company actually operates.
- A plan that doesn't match reality. Assessors compare the SSP against interviews, configurations and evidence. Discrepancies cause findings.
- No clear boundary. A vague scope makes everything in the company look in scope.
- Missing provider responsibilities. Assuming a cloud provider covers a control without documenting it.
- Written once, never updated. The SSP must change when your systems change.
How assessors use your SSP
During a Level 2 certification assessment, the C3PAO uses the SSP to understand your environment, confirm the scope, and plan which evidence to examine and whom to interview. A clear, accurate SSP makes the assessment faster and reduces surprises.
Getting it done
An SSP is easiest to write after a gap assessment, when you know exactly what's in place. Quantum Shield Consulting offers SSP authoring as part of CMMC readiness engagements. See also: which CMMC level you need and key CMMC dates.
This guide is general information based on the CMMC Program rule (32 CFR Part 170) and the DFARS CMMC clause (DFARS 252.204-7021) as of November 2026. It isn't legal advice. The requirements in your solicitation or contract always govern. Last reviewed: November 4, 2026.