NIST 800-171 System Security Plan (SSP) Template
The system security plan is the document an assessor reads first, and it is required by the DFARS 252.204-7012 chain and by CMMC Level 2. This template gives you the structure: boundary, data flows, roles and a family-by-family implementation summary you can expand.
Fill in
NIST SP 800-171 System Security Plan (SSP) Template
System Security Plan
Organization: Apex Precision Components Inc. System: Apex CUI Enclave Version: 1.0 Date: 2026-10-20 System owner: VP Operations Security lead: IT Security Manager
1. Purpose and Scope
This plan describes how Apex Precision Components Inc. implements the security requirements of NIST SP 800-171 for the system named Apex CUI Enclave. CUI categories handled: Controlled Technical Information, Export Controlled.
Contracts or programs in scope: Prime contract flow-downs for machined housings and cable assemblies. List contract numbers in your controlled copy.
2. System Boundary
Hosting model: Hybrid
On-premises Windows domain, one ERP server, one file server, a managed enclave for engineering workstations, and a cloud email tenant approved for CUI. Corporate guest Wi-Fi and the public website are out of scope.
3. CUI Data Flows
Drawings arrive from the prime by secure portal, are stored on the engineering file share, referenced by the ERP item master by document number only, and returned through the same portal.
4. Roles and Responsibilities
| Role | Name | Responsibility |
|---|---|---|
| System owner | VP Operations | Accepts residual risk, funds remediation |
| Security lead | IT Security Manager | Maintains this plan, runs assessments |
| System administrators | Configuration, patching, account lifecycle | |
| Facility security | Physical access control and visitor logs |
5. Control Family Implementation Summary
| Family | Status | Implementation summary | Evidence location |
|---|---|---|---|
| Access Control (3.1) | |||
| Awareness and Training (3.2) | |||
| Audit and Accountability (3.3) | |||
| Configuration Management (3.4) | |||
| Identification and Authentication (3.5) | |||
| Incident Response (3.6) | |||
| Maintenance (3.7) | |||
| Media Protection (3.8) | |||
| Personnel Security (3.9) | |||
| Physical Protection (3.10) | |||
| Risk Assessment (3.11) | |||
| Security Assessment (3.12) | |||
| System and Communications Protection (3.13) | |||
| System and Information Integrity (3.14) |
6. Approvals
This is a structural starting point, not legal or assessment advice. A complete SSP describes how each of the 110 requirements is met in your own environment; extend the family table into one row per requirement and link to evidence. Review with a qualified assessor before relying on it.
Keep CUI inside your boundary when adding AI
Optional review of how an on-prem or air-gapped AI deployment would sit inside your SSP boundary.
Optional. The tool and every export work without this. No spam.
How to use this template
Fill in the company, system name and owner fields, then describe the boundary in plain language: which servers, endpoints, cloud tenants and facilities touch CUI, and which do not. Export to Word and keep expanding the control family table into one row per requirement. The goal is a document a new IT hire could use to find where each control lives and who owns it.
- Name one accountable system owner, not a department
- Keep the boundary narrow; every extra asset adds scope
- Reference evidence by location, not by pasting screenshots
- Version and date every revision
What the SSP is supposed to prove
NIST SP 800-171 organizes its requirements into 14 families, from Access Control to System and Information Integrity. The SSP must show, for each requirement, how your organization implements it, who is responsible, and where evidence is kept. A policy statement alone is weak; a statement that names the tool, the setting and the owner is what assessors accept.
Reading your own plan critically
After the first draft, walk one real CUI file from the day it arrives to the day it is deleted. At each hop confirm the SSP names the system, the protection and the person. Gaps you find become entries in your plan of action and milestones. A plan that describes an ideal environment rather than the real one is a liability, because an assessor will test the real one.
Common mistakes
The most frequent errors are copying a generic SSP that does not match the actual network, leaving cloud services out of the boundary, and never updating the document after a migration or ERP upgrade. Treat the SSP as a living record and tie its review to change management.
- Generic text that does not name real tools
- Cloud email or file sync missing from the boundary
- No link to the POA&M for unmet requirements
- Plan not reviewed after major changes
Frequently Asked Questions
Is an SSP required for CMMC Level 2?
Yes. CMMC Level 2 assessments are based on NIST SP 800-171, and the system security plan is a core artifact assessors expect to see, along with evidence that the described controls actually operate. Requirements also appear in DFARS 252.204-7012 and the related assessment clauses.
Can I put every control in one table?
You can, and many organizations do, but the table must reach one row per requirement with an implementation statement and evidence pointer. The family-level table in this template is a starting scaffold and should be expanded before assessment.
Does the SSP include a diagram?
It should. Attach a network and data flow diagram next to the narrative boundary description. This template captures the text; add the diagram as an appendix in the Word export so assessors can match words to drawings.
How often should the SSP be updated?
Review at least annually and after any significant change such as a new cloud service, ERP migration, acquisition or network redesign. Record the version and date in the header so the history is easy to follow.
If CUI drawings and orders sit in your ERP, Netray can show how private, on-prem AI can be kept inside your boundary so it does not widen your scope. This tool needs no contact with us.
Related Tools
CMMC POA&M (Plan of Action and Milestones) Worksheet
An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
Compliance & ContractsDFARS 252.204-7012 Cyber Incident Report Template
An internal worksheet document that gathers the facts needed to file a cyber incident report on a covered defense information system within the required window.
Compliance & ContractsDefense Subcontractor Flow-Down Tracker Worksheet
A supplier-by-supplier register of flowed-down clauses, CUI access, certification status and acknowledgement dates.
Aerospace & DefenseCMMC 2.0 Level 2 Readiness Assessment
Answer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps.
More Compliance & Contracts tools
See all- EAR ECCN Self-Classification Worksheet
- Technology Control Plan (TCP) Template
- Export License Tracking Worksheet
- DFARS 252.204-7012 Cyber Incident Report Template
- ITAR USML Categories Reference Table
- Foreign Person Visitor Access Request Template
- ITAR Technical Data Transfer Log Worksheet
- Export Classification Matrix Worksheet (USML and ECCN)
- End-Use and End-User Statement Template