# NIST 800-171 System Security Plan (SSP) Template > Source: https://netray.co/tools/nist-800-171-system-security-plan-template > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine. ## Category compliance-legal ## Industry Defense Contracting ## Region United States ## Audience - Compliance manager - IT security lead - Defense supplier ## Tool **Kind:** template **Output:** document **Fields:** #### Company name **Key:** company **Type:** text **Default:** Apex Precision Components Inc. #### System / enclave name **Key:** system_name **Type:** text **Default:** Apex CUI Enclave #### SSP version **Key:** version **Type:** text **Default:** 1.0 #### Date **Key:** date **Type:** date **Default:** 2026-10-20 #### System owner **Key:** owner **Type:** text **Default:** VP Operations #### Security lead (ISSO) **Key:** isso **Type:** text **Default:** IT Security Manager #### CUI categories handled **Key:** cui_categories **Type:** text **Default:** Controlled Technical Information, Export Controlled #### Contracts or programs in scope **Key:** contracts **Type:** textarea **Default:** Prime contract flow-downs for machined housings and cable assemblies. List contract numbers in your controlled copy. #### System boundary description **Key:** boundary **Type:** textarea **Default:** On-premises Windows domain, one ERP server, one file server, a managed enclave for engineering workstations, and a cloud email tenant approved for CUI. Corporate guest Wi-Fi and the public website are out of scope. #### Hosting model **Key:** hosting **Type:** select **Options:** - On-premises - Private cloud - FedRAMP Moderate equivalent cloud - Hybrid **Default:** Hybrid #### CUI data flows **Key:** flows **Type:** textarea **Default:** Drawings arrive from the prime by secure portal, are stored on the engineering file share, referenced by the ERP item master by document number only, and returned through the same portal. **Blocks:** #### System Security Plan **Body:** Organization: {{company}} System: {{system_name}} Version: {{version}} Date: {{date}} System owner: {{owner}} Security lead: {{isso}} #### 1. Purpose and Scope **Body:** This plan describes how {{company}} implements the security requirements of NIST SP 800-171 for the system named {{system_name}}. CUI categories handled: {{cui_categories}}. Contracts or programs in scope: {{contracts}} #### 2. System Boundary **Body:** Hosting model: {{hosting}} {{boundary}} #### 3. CUI Data Flows **Body:** {{flows}} #### 4. Roles and Responsibilities **Table:** **Columns:** - Role - Name - Responsibility **Rows:** **0:** System owner **1:** {{owner}} **2:** Accepts residual risk, funds remediation **0:** Security lead **1:** {{isso}} **2:** Maintains this plan, runs assessments **0:** System administrators **2:** Configuration, patching, account lifecycle **0:** Facility security **2:** Physical access control and visitor logs #### 5. Control Family Implementation Summary **Table:** **Columns:** - Family - Status - Implementation summary - Evidence location **Rows:** **0:** Access Control (3.1) **0:** Awareness and Training (3.2) **0:** Audit and Accountability (3.3) **0:** Configuration Management (3.4) **0:** Identification and Authentication (3.5) **0:** Incident Response (3.6) **0:** Maintenance (3.7) **0:** Media Protection (3.8) **0:** Personnel Security (3.9) **0:** Physical Protection (3.10) **0:** Risk Assessment (3.11) **0:** Security Assessment (3.12) **0:** System and Communications Protection (3.13) **0:** System and Information Integrity (3.14) #### 6. Approvals **Signatures:** - System owner - Security lead - Executive sponsor **Notes:** This is a structural starting point, not legal or assessment advice. A complete SSP describes how each of the 110 requirements is met in your own environment; extend the family table into one row per requirement and link to evidence. Review with a qualified assessor before relying on it. ## Content **Intro:** The system security plan is the document an assessor reads first, and it is required by the DFARS 252.204-7012 chain and by CMMC Level 2. This template gives you the structure: boundary, data flows, roles and a family-by-family implementation summary you can expand. **Sections:** #### How to use this template **Body:** Fill in the company, system name and owner fields, then describe the boundary in plain language: which servers, endpoints, cloud tenants and facilities touch CUI, and which do not. Export to Word and keep expanding the control family table into one row per requirement. The goal is a document a new IT hire could use to find where each control lives and who owns it. **Bullets:** - Name one accountable system owner, not a department - Keep the boundary narrow; every extra asset adds scope - Reference evidence by location, not by pasting screenshots - Version and date every revision #### What the SSP is supposed to prove **Body:** NIST SP 800-171 organizes its requirements into 14 families, from Access Control to System and Information Integrity. The SSP must show, for each requirement, how your organization implements it, who is responsible, and where evidence is kept. A policy statement alone is weak; a statement that names the tool, the setting and the owner is what assessors accept. #### Reading your own plan critically **Body:** After the first draft, walk one real CUI file from the day it arrives to the day it is deleted. At each hop confirm the SSP names the system, the protection and the person. Gaps you find become entries in your plan of action and milestones. A plan that describes an ideal environment rather than the real one is a liability, because an assessor will test the real one. #### Common mistakes **Body:** The most frequent errors are copying a generic SSP that does not match the actual network, leaving cloud services out of the boundary, and never updating the document after a migration or ERP upgrade. Treat the SSP as a living record and tie its review to change management. **Bullets:** - Generic text that does not name real tools - Cloud email or file sync missing from the boundary - No link to the POA&M for unmet requirements - Plan not reviewed after major changes **Cta:** If CUI drawings and orders sit in your ERP, Netray can show how private, on-prem AI can be kept inside your boundary so it does not widen your scope. This tool needs no contact with us. **Faq:** #### Is an SSP required for CMMC Level 2? **Answer:** Yes. CMMC Level 2 assessments are based on NIST SP 800-171, and the system security plan is a core artifact assessors expect to see, along with evidence that the described controls actually operate. Requirements also appear in DFARS 252.204-7012 and the related assessment clauses. #### Can I put every control in one table? **Answer:** You can, and many organizations do, but the table must reach one row per requirement with an implementation statement and evidence pointer. The family-level table in this template is a starting scaffold and should be expanded before assessment. #### Does the SSP include a diagram? **Answer:** It should. Attach a network and data flow diagram next to the narrative boundary description. This template captures the text; add the diagram as an appendix in the Word export so assessors can match words to drawings. #### How often should the SSP be updated? **Answer:** Review at least annually and after any significant change such as a new cloud service, ERP migration, acquisition or network redesign. Record the version and date in the header so the history is easy to follow. ## Search terms nist 800-171 ssp template, system security plan template cmmc, dfars 7012 system security plan, cui system security plan example, cmmc level 2 ssp template word, 800-171 ssp format, system security plan for defense contractors --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json