# CMMC Level 2 SSP Example for a Machine Shop

> Source: https://netray.co/tools/cmmc-level-2-ssp-example-machine-shop
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A System Security Plan template pre-filled with a realistic machine shop example, including the ERP system and the CUI boundary. Edit and export.

## Category

aerospace-defense

## Industry

Defense

## Audience

- Defense supplier IT and compliance leads
- Machine shop owners

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Ridgeline Precision Machining, Inc.

#### CAGE code

**Key:** cage

**Type:** text

**Default:** 1AB23

#### System owner

**Key:** owner

**Type:** text

**Default:** Dana Whitfield, Operations Director

#### Security lead (ISSO)

**Key:** isso

**Type:** text

**Default:** Marcus Lee, IT Manager

#### Plan date

**Key:** date

**Type:** date

**Default:** 2026-10-20

#### CUI categories handled

**Key:** cui_types

**Type:** textarea

**Default:** Controlled Technical Information: export-controlled drawings, CAD models, and process sheets received from prime contractors on DoD aerospace programs.

#### ERP system in scope

**Key:** erp

**Type:** text

**Default:** On-prem ERP (job costing, routings, purchasing) hosted on two VMs in the server room

#### CUI enclave description

**Key:** enclave

**Type:** textarea

**Default:** A dedicated VLAN (VLAN 40) holds the ERP database VM, a file server share named ENG-CUI, three engineering workstations and two CNC programming stations. A firewall rule set permits only listed ports from the office VLAN.

#### External service providers

**Key:** cloud

**Type:** textarea

**Default:** Managed IT provider (remote monitoring, patching): in scope as a security protection asset. Email: GCC High tenant. Backups: encrypted off-site vault operated by the managed provider.

#### MFA method

**Key:** mfa

**Type:** text

**Default:** Hardware or app-based MFA on VPN, admin accounts and enclave workstations

#### Encryption approach

**Key:** encryption

**Type:** text

**Default:** FIPS-validated modules; BitLocker on workstations; TLS 1.2 or higher in transit

**Blocks:**

#### System Security Plan: {{company}}

**Body:** CAGE code: {{cage}}
System owner: {{owner}}
Security lead: {{isso}}
Plan date: {{date}}
Target: CMMC Level 2 (NIST SP 800-171 Rev 2, 110 requirements)

#### 1. System description and purpose

**Body:** {{company}} is a contract machine shop producing precision parts for defense aerospace primes. The system described here receives, stores, processes and transmits CUI needed to quote, program, machine, inspect and ship those parts. It supports order entry, engineering review, CNC programming, quality records and shipping.

#### 2. CUI handled

**Body:** {{cui_types}}

#### 3. System boundary and CUI enclave

**Body:** {{enclave}}

In scope: CUI assets (systems that store or process CUI), security protection assets (firewall, identity provider, logging, patching tools), and contractor risk-managed assets. Out of scope: office-only workstations on the general VLAN, guest wireless, and shop machines with no network path to the enclave. Out-of-scope assets are separated by firewall rules reviewed quarterly.

#### 4. ERP and business systems in scope

**Body:** {{erp}}

The ERP holds job travelers that reference customer drawing numbers and revision levels. Drawings and models themselves are stored on the ENG-CUI share. ERP users are provisioned by role; access to routing and document attachment screens is limited to engineering and quality. Database backups inherit the same protections as production.

#### 5. External service providers and shared responsibility

**Body:** {{cloud}}

A written responsibility matrix records which requirements are met by the provider, which by {{company}}, and which are shared. Provider evidence is requested annually.

#### 6. Requirement implementation statements (sample extracts)

**Table:**

**Columns:**

- Req
- Status
- How it is met

**Rows:**

**0:** 3.1.1 Limit access to authorized users

**1:** Implemented

**2:** Named accounts in directory; enclave access by security group; reviewed quarterly by {{isso}}.

**0:** 3.1.12 Monitor remote access

**1:** Implemented

**2:** VPN sessions logged and forwarded to the log server; reviewed weekly.

**0:** 3.5.3 Multifactor authentication

**1:** Implemented

**2:** {{mfa}}.

**0:** 3.8.3 Sanitize media with CUI

**1:** Implemented

**2:** Drives wiped to a documented standard or physically destroyed; certificate kept.

**0:** 3.13.8 Encrypt CUI in transit

**1:** Implemented

**2:** {{encryption}}.

**0:** 3.13.11 FIPS-validated cryptography

**1:** Partially implemented

**2:** Workstations compliant; legacy CNC file transfer under POA&M item 7.

**0:** 3.14.1 Identify and correct flaws

**1:** Implemented

**2:** Critical patches within 14 days; others within 30 days; tracked by provider ticket.

#### 7. Plan of Action and Milestones reference

**Body:** Unmet or partial requirements are tracked in the separate POA&M with owner, resources, milestone dates and status. Current open items: legacy CNC file transfer (3.13.11), log retention extension (3.3.1).

#### Approvals

**Signatures:**

- System owner
- Security lead (ISSO)
- Executive sponsor

**Notes:** This is a sample for a fictional shop. Replace every statement with what you actually do and can prove; an SSP that claims controls you have not implemented is a false statement risk under DoD contracts. Expand the requirement table to cover all 110 requirements. Not legal advice.

## Content

**Intro:** A System Security Plan is the document every CMMC Level 2 assessment starts from. This example is filled in for a machine shop, so you can see the level of detail an assessor expects before you write your own.

**Sections:**

#### How to use the example

**Body:** Edit the fields on the left with your own company, boundary, ERP and service provider details. The sample requirement table updates with your MFA and encryption wording. Export the result to Word, then extend the table to all 110 requirements. Keep the structure: description, CUI types, boundary, external providers, requirement statements, POA&M reference and approvals.

#### What assessors look for in an SSP

**Body:** An assessor reads the SSP to decide where to test. Each statement should say who does what, with which tool, how often, and where the evidence lives. Vague lines such as 'we follow best practice' give the assessor nothing to verify and invite deeper probing. Statements that name a system, a setting and a review cadence are easy to confirm.

**Bullets:**

- A boundary description that matches the network diagram
- Every external provider named, with the shared responsibility split
- Status for each requirement: implemented, partial, planned, or not applicable with reason
- A link between each partial item and a POA&M entry

#### Drawing the CUI boundary around the ERP

**Body:** Many shops forget that the ERP holds CUI by reference: drawing numbers, revisions, specifications and attached files. Decide whether the ERP is inside the enclave, or whether CUI attachments stay on a separate share with the ERP outside scope. Either can work, but write the choice down and make the technical controls match it. If you add AI or search tools over ERP data, they inherit the same boundary and must run inside it.

#### Common mistakes

**Body:** Copying a generic template unchanged is the most common mistake, followed by statements that do not match what the network actually does.

**Bullets:**

- Claiming FIPS-validated encryption without checking the module certificate
- Leaving out security protection assets such as the firewall and log server
- Describing policy but not the operating procedure
- Never updating the SSP after a network change

**Cta:** If you plan to add search or AI over ERP and drawing data, we can design it to run entirely inside your CUI enclave and document it for your SSP.

**Faq:**

#### What is a CMMC Level 2 SSP?

**Answer:** The System Security Plan describes your system boundary, the CUI you handle and how each of the 110 NIST SP 800-171 requirements is met. It is required by the CA domain and is the main document assessors use to plan their testing.

#### Is this example safe to copy as is?

**Answer:** No. It describes a fictional shop. Every statement must reflect your real environment and be provable with evidence. Use it for structure and level of detail, then replace the content with your own facts.

#### Does the ERP need to be inside the CUI boundary?

**Answer:** If the ERP stores, processes or transmits CUI, including drawings or technical data attachments, it is in scope. If CUI is kept entirely outside it and the ERP holds none, it may be out of scope, but you must justify and enforce that separation.

#### Can I get this as a Word document?

**Answer:** Yes. After editing the fields, export the plan to Word or PDF. The requirement table is included, so you can extend it to all 110 requirements in your own editor.

## Search terms

cmmc level 2 ssp example, cmmc system security plan example, ssp template cmmc, nist 800-171 ssp sample, machine shop ssp example, cui boundary diagram description, cmmc ssp download

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json