CMMC Level 2 SSP Example for a Machine Shop
A System Security Plan is the document every CMMC Level 2 assessment starts from. This example is filled in for a machine shop, so you can see the level of detail an assessor expects before you write your own.
Fill in
CMMC Level 2 SSP Example for a Machine Shop
System Security Plan: Ridgeline Precision Machining, Inc.
CAGE code: 1AB23 System owner: Dana Whitfield, Operations Director Security lead: Marcus Lee, IT Manager Plan date: 2026-10-20 Target: CMMC Level 2 (NIST SP 800-171 Rev 2, 110 requirements)
1. System description and purpose
Ridgeline Precision Machining, Inc. is a contract machine shop producing precision parts for defense aerospace primes. The system described here receives, stores, processes and transmits CUI needed to quote, program, machine, inspect and ship those parts. It supports order entry, engineering review, CNC programming, quality records and shipping.
2. CUI handled
Controlled Technical Information: export-controlled drawings, CAD models, and process sheets received from prime contractors on DoD aerospace programs.
3. System boundary and CUI enclave
A dedicated VLAN (VLAN 40) holds the ERP database VM, a file server share named ENG-CUI, three engineering workstations and two CNC programming stations. A firewall rule set permits only listed ports from the office VLAN.
In scope: CUI assets (systems that store or process CUI), security protection assets (firewall, identity provider, logging, patching tools), and contractor risk-managed assets. Out of scope: office-only workstations on the general VLAN, guest wireless, and shop machines with no network path to the enclave. Out-of-scope assets are separated by firewall rules reviewed quarterly.
4. ERP and business systems in scope
On-prem ERP (job costing, routings, purchasing) hosted on two VMs in the server room
The ERP holds job travelers that reference customer drawing numbers and revision levels. Drawings and models themselves are stored on the ENG-CUI share. ERP users are provisioned by role; access to routing and document attachment screens is limited to engineering and quality. Database backups inherit the same protections as production.
5. External service providers and shared responsibility
Managed IT provider (remote monitoring, patching): in scope as a security protection asset. Email: GCC High tenant. Backups: encrypted off-site vault operated by the managed provider.
A written responsibility matrix records which requirements are met by the provider, which by Ridgeline Precision Machining, Inc., and which are shared. Provider evidence is requested annually.
6. Requirement implementation statements (sample extracts)
| Req | Status | How it is met |
|---|---|---|
| 3.1.1 Limit access to authorized users | Implemented | Named accounts in directory; enclave access by security group; reviewed quarterly by Marcus Lee, IT Manager. |
| 3.1.12 Monitor remote access | Implemented | VPN sessions logged and forwarded to the log server; reviewed weekly. |
| 3.5.3 Multifactor authentication | Implemented | Hardware or app-based MFA on VPN, admin accounts and enclave workstations. |
| 3.8.3 Sanitize media with CUI | Implemented | Drives wiped to a documented standard or physically destroyed; certificate kept. |
| 3.13.8 Encrypt CUI in transit | Implemented | FIPS-validated modules; BitLocker on workstations; TLS 1.2 or higher in transit. |
| 3.13.11 FIPS-validated cryptography | Partially implemented | Workstations compliant; legacy CNC file transfer under POA&M item 7. |
| 3.14.1 Identify and correct flaws | Implemented | Critical patches within 14 days; others within 30 days; tracked by provider ticket. |
7. Plan of Action and Milestones reference
Unmet or partial requirements are tracked in the separate POA&M with owner, resources, milestone dates and status. Current open items: legacy CNC file transfer (3.13.11), log retention extension (3.3.1).
Approvals
This is a sample for a fictional shop. Replace every statement with what you actually do and can prove; an SSP that claims controls you have not implemented is a false statement risk under DoD contracts. Expand the requirement table to cover all 110 requirements. Not legal advice.
AI that stays inside your enclave
Optional: talk through how an on-prem AI layer over your ERP fits inside the boundary described in your SSP.
Optional. The tool and every export work without this. No spam.
How to use the example
Edit the fields on the left with your own company, boundary, ERP and service provider details. The sample requirement table updates with your MFA and encryption wording. Export the result to Word, then extend the table to all 110 requirements. Keep the structure: description, CUI types, boundary, external providers, requirement statements, POA&M reference and approvals.
What assessors look for in an SSP
An assessor reads the SSP to decide where to test. Each statement should say who does what, with which tool, how often, and where the evidence lives. Vague lines such as 'we follow best practice' give the assessor nothing to verify and invite deeper probing. Statements that name a system, a setting and a review cadence are easy to confirm.
- A boundary description that matches the network diagram
- Every external provider named, with the shared responsibility split
- Status for each requirement: implemented, partial, planned, or not applicable with reason
- A link between each partial item and a POA&M entry
Drawing the CUI boundary around the ERP
Many shops forget that the ERP holds CUI by reference: drawing numbers, revisions, specifications and attached files. Decide whether the ERP is inside the enclave, or whether CUI attachments stay on a separate share with the ERP outside scope. Either can work, but write the choice down and make the technical controls match it. If you add AI or search tools over ERP data, they inherit the same boundary and must run inside it.
Common mistakes
Copying a generic template unchanged is the most common mistake, followed by statements that do not match what the network actually does.
- Claiming FIPS-validated encryption without checking the module certificate
- Leaving out security protection assets such as the firewall and log server
- Describing policy but not the operating procedure
- Never updating the SSP after a network change
Frequently Asked Questions
What is a CMMC Level 2 SSP?
The System Security Plan describes your system boundary, the CUI you handle and how each of the 110 NIST SP 800-171 requirements is met. It is required by the CA domain and is the main document assessors use to plan their testing.
Is this example safe to copy as is?
No. It describes a fictional shop. Every statement must reflect your real environment and be provable with evidence. Use it for structure and level of detail, then replace the content with your own facts.
Does the ERP need to be inside the CUI boundary?
If the ERP stores, processes or transmits CUI, including drawings or technical data attachments, it is in scope. If CUI is kept entirely outside it and the ERP holds none, it may be out of scope, but you must justify and enforce that separation.
Can I get this as a Word document?
Yes. After editing the fields, export the plan to Word or PDF. The requirement table is included, so you can extend it to all 110 requirements in your own editor.
If you plan to add search or AI over ERP and drawing data, we can design it to run entirely inside your CUI enclave and document it for your SSP.
Related Tools
NIST SP 800-171 System Security Plan (SSP) Template
A fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine.
Aerospace & DefenseCMMC Level 2 Compliance Checklist by Domain
A CMMC Level 2 requirements checklist grouped by the 14 NIST SP 800-171 domains, with the critical items flagged. Export it to PDF.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
Compliance & ContractsCMMC POA&M (Plan of Action and Milestones) Worksheet
An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
Compliance & ContractsCMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
Record who implements each practice, where the evidence lives and what share is yours. Useful when an MSP, MSSP or cloud service provider runs part of your CUI environment.
More Aerospace & Defense tools
See all- CMMC 2.0 Level 2 Readiness Assessment
- ITAR Compliance Checklist for Manufacturers
- DFARS 252.204-7012 Compliance Self-Assessment
- AS9100 Audit Readiness Checklist
- Export Control Screening Checklist
- Defense Contractor AI Readiness Assessment
- Counterfeit Parts Risk Assessment (AS5553)
- Aerospace Supplier Scorecard
- First Article Inspection (AS9102) Checklist
Keep exploring
Free tools
- NIST SP 800-171 System Security Plan (SSP) TemplateA fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine.
- CMMC Level 2 Remediation Budget CalculatorTurn a gap count and CUI headcount into a first-year CMMC Level 2 budget, with a sweep showing how cost scales with the number of CUI users.
- CMMC Level 1 ChecklistTick through every CMMC Level 1 practice for Federal Contract Information, see example evidence for each, and finish with the annual affirmation steps.
ERP fixes and how-tos
- How to Set Up Revenue Recognition With NetSuite ARMHow to configure NetSuite Advanced Revenue Management: revenue recognition rules, revenue elements, SSP for allocation, and generating revenue plans.
- Costpoint Cloud or On-Prem for a Contractor Handling CUI?Deciding between Deltek Costpoint cloud and self-hosted for a defense contractor with CUI: scope, shared responsibility, cost, control, what to verify.
- On-Prem vs Cloud ERP AI for Regulated ManufacturersHow CIOs at ITAR, CMMC, and export-controlled manufacturers should weigh on-prem versus cloud AI for their ERP, including what actually needs to stay on-prem and what does not.
Guides
- CMMC Level 2 for a Small CNC Machine Shop: What Applies and Where to StartCMMC Level 2 for small CNC machine shops: when it applies, what CUI in drawings means, the scope decisions that control cost, and how AI tools fit the boundary.
- CMMC 2.0 for Small ManufacturersCMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit.
- CMMC Level 2 for Small Screw Machine and Swiss Turned-Parts ShopsCMMC Level 2 for small screw machine and Swiss shops: when you need it, what CUI means for drawings, scoping an enclave, and realistic first steps and costs.
AI on your ERP
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.