Skip to content
FORGEPOINT CYBER
MENU
Schedule a readiness conversation (opens Microsoft Teams booking in a new tab)

Free tool · 25 questions · about 6 minutes

Would your SSP hold up in front of an assessor?

Your System Security Plan (SSP) is the one CMMC document you can't defer to a POA&M. Answer questions about it, never upload it, and see where an assessor would stop: each red flag lands on the section of the plan it belongs to.

No uploads, ever. Your answers stay in your browser. Nothing is sent unless you ask for the outline.

Answer about your plan · don't upload it

Have your System Security Plan open beside you. "Partly" and "Not sure" are fine answers: both raise a flag worth checking.

1. Plan identification and approval

Do you have a written System Security Plan (SSP) for the systems that handle CUI?

Basis: 3.12.4[a]

Does the SSP name one person who owns it, and the senior official who approved the current version?

ForgePoint practice

Was the current version approved in the last 12 months?

ForgePoint practice

2. System boundary

Does it say which users, systems, locations and cloud services handle CUI, and which don't?

Basis: 3.12.4[b]

Does it say how CUI arrives, where it's stored and how it leaves (email, portals, file shares, removable media)?

ForgePoint practice

Does it include a network or data-flow diagram that matches today's environment?

Basis: 32 CFR 170.19(c)(1)

3. Environment of operation

Does it describe the environment of operation: sites, remote work, and the platforms you run on (for example Microsoft 365 commercial or GCC)?

Basis: 3.12.4[c]

Does it describe who uses the system, including privileged users and administrators?

ForgePoint practice

4. Asset inventory and categories

Is there an asset inventory, and does the SSP point to it?

Basis: 32 CFR 170.19(c)(1)

Are assets sorted into the CMMC asset categories (CUI, Security Protection, Contractor Risk Managed, Specialized, Out-of-Scope)?

Basis: 32 CFR 170.19(c)(1)

For Contractor Risk Managed and Specialized Assets, does the SSP say how they're managed?

Basis: 32 CFR 170.19(c)(1)

5. Connections and external providers

Does it list connections to other systems (a prime's portal, customer or government systems, other networks)?

Basis: 3.12.4[f]

If an MSP or other provider handles CUI or security data, does the SSP describe that relationship?

Basis: 32 CFR 170.19(c)(2)(ii)

Do you have each provider's customer responsibility matrix, and does the SSP match it?

Basis: 32 CFR 170.19(c)(2)(ii)

For each cloud service that holds CUI, does the SSP record its FedRAMP status or the equivalency evidence on file?

Basis: DFARS 252.204-7012

6. How each requirement is implemented

Does the SSP address every one of the 110 requirements?

Basis: 3.12.4[e]

Does each requirement say how it's met today: the setting, process or tool, not "the organization ensures…"?

Basis: 3.12.4[e]

Does each requirement say who does it: your staff, your MSP or a cloud provider?

ForgePoint practice

Is every requirement marked not applicable backed by a written reason and an approval?

Basis: 3.12.4[d]

Does every statement describe what's in place now, with planned work kept out of the implementation text?

ForgePoint practice

Have all template placeholders, sample names and boilerplate been rewritten?

ForgePoint practice

7. Open items and the POA&M

Does each requirement point to evidence you could show (a policy, an export, a screenshot, a record)?

ForgePoint practice

Are known gaps in a POA&M with an owner, a milestone and a date, rather than hidden in the SSP?

Basis: 3.12.2

8. Review and update

Does the SSP say how often it's reviewed and updated?

Basis: 3.12.4[g]

Has it actually been updated on that schedule, including after system or provider changes?

Basis: 3.12.4[h]

One more thing

Have you had a Level 2 readiness or gap assessment in the last 12 months?

It decides the next step we suggest, not the result.

Your answers stay in this browser tab. Nothing is sent unless you ask for the outline below.

Fig. · Your System Security Plan

Answer the questions to see where your SSP would draw an assessor's attention.

Red flag PartlyNot an assessment or a score

What the SSP requirement asks · NIST SP 800-171 Rev. 2, 3.12.4 · as of Nov 5, 2026

The eight things an assessor checks

“Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.”

Assessment objectives, NIST SP 800-171A · Determine if:

  1. 3.12.4[a]a system security plan is developed.
  2. 3.12.4[b]the system boundary is described and documented in the system security plan.
  3. 3.12.4[c]the system environment of operation is described and documented in the system security plan.
  4. 3.12.4[d]the security requirements identified and approved by the designated authority as non-applicable are identified.
  5. 3.12.4[e]the method of security requirement implementation is described and documented in the system security plan.
  6. 3.12.4[f]the relationship with or connection to other systems is described and documented in the system security plan.
  7. 3.12.4[g]the frequency to update the system security plan is defined.
  8. 3.12.4[h]system security plan is updated with the defined frequency.

The outline's eight sections

  1. 1. Plan identification and approval

    Says which system the plan covers, who owns it and who approved this version.

    3.12.4[a]; ForgePoint practice

  2. 2. System boundary

    Draws the line around everything that handles CUI, and says what is outside it.

    3.12.4[b]

  3. 3. Environment of operation

    Describes where and on what the system runs.

    3.12.4[c]

  4. 4. Asset inventory and categories

    Lists the assets in scope and sorts them into the CMMC Level 2 asset categories.

    32 CFR 170.19(c)(1), Table 3

  5. 5. Connections and external providers

    Names every other system this one connects to and every provider that handles CUI or security data.

    3.12.4[f]; 32 CFR 170.19(c)(2)

  6. 6. How each requirement is implemented

    For each of the 110 requirements: how it is met today, by whom, and with what evidence.

    3.12.4[d], [e]

  7. 7. Open items and the POA&M

    Keeps known gaps in the plan of action, not hidden in the SSP's prose.

    3.12.2; 32 CFR 170.21

  8. 8. Review and update

    Says how often the plan is reviewed and records that it was.

    3.12.4[g], [h]

Questions

System Security Plans, answered

What does a CMMC Level 2 System Security Plan have to contain?

NIST SP 800-171 requirement 3.12.4 asks for system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems, and that are periodically updated. Its assessment objectives also check that requirements marked not applicable are identified and approved, and that the update frequency is defined and followed.

Can the SSP go on a POA&M?

No. The CMMC rule names the System Security Plan (CA.L2-3.12.4) among the requirements that may never be placed on a Level 2 POA&M, and without a current SSP an assessment can't be completed.

Do I have to describe my MSP in the SSP?

If an external service provider handles your CUI or security protection data, the CMMC rule requires the relationship to be documented in your SSP and described in the provider's service description and customer responsibility matrix.

Do I upload my SSP?

Never. You answer questions about it; the plan stays with you. Please don't send CUI, contracts, credentials or security evidence to ForgePoint.

Is the result an SPRS score?

No. It reflects your own answers about your SSP, weighted by ForgePoint. It isn't an assessment, an SPRS score or a determination that any requirement is met.

What's in the SSP outline template?

A Word document in the same eight sections as the review, with guidance for each, a fill-in table for all 110 NIST SP 800-171 Rev. 2 requirements (status, how it's met today, who does it, evidence) and appendices for assets, providers, connections and change history.

What happens to my answers?

They stay in your browser tab. If you ask for the outline, ForgePoint keeps your name, work email, company, the suggested next step and the date in its CRM, not your answers, and the PDF report is drawn on request and not kept.

Where it leads

SSP & POA&M Buildout

An SSP has to be written from the environment, so the Level 2 Readiness Assessment comes first: it confirms the boundary and checks all 110 requirements against evidence. The SSP & POA&M Buildout then writes the plan and the POA&M from what it found. See the Level 2 Readiness Assessment → SSP & POA&M Buildout → POA&M Eligibility Checker →