CA.L2-3.12.4

System Security Plan

Source and approval

CMMC Assessment Guide — Level 2 · Revision 2.13

Publisher approved · Complete cited source edition 2026-10-31

See CA.L2-3.12.4 in the reference catalog with its NIST cross-references

Official requirement

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

Assessment objectives

a. a system security plan is developed;

b. the system boundary is described and documented in the system security plan;

c. the system environment of operation is described and documented in the system security plan;

d. the security requirements identified and approved by the designated authority as non-applicable are identified;

e. the method of security requirement implementation is described and documented in the system security plan;

f. the relationship with or connection to other systems is described and documented in the system security plan;

g. the frequency to update the system security plan is defined; and

h. system security plan is updated with the defined frequency.

Implementation guidance

Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.

In plain language

Maintain a system security plan describing boundaries, environments, implementation, and connections.

Implementation example

Example from the source assessment guide (not a mandatory implementation): You are in charge of system security. You develop an SSP and have senior leadership formally approve the document [a]. The SSP explains how your organization handles CUI and defines how that data is stored, transmitted, and protected [d,e]. The criteria outlined in the SSP is used to guide configuration of the network and other information resources to meet your company’s goals. Knowing that it is important to keep the SSP current, you establish a policy that requires a formal review and update of the SSP each year [g,h].

Evidence examples

Examples suggested by the source guide (not an exhaustive or mandatory checklist): Security planning policy; procedures addressing system security plan development and implementation; procedures addressing system security plan reviews and updates; enterprise architecture documentation; system security plan; records of system security plan reviews and updates; other relevant documents or records

Common mistakes

Using a generic policy template that does not describe the actual system and its controls.

Apply this in your workspace →