[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-355533-105":53,"doc-detail-355533-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","cmmc-ssp-system-security-plan-template-last-updated","CMMC SSP - System Security Plan Template - Last Updated","","CMMC SSP (System Security Plan) template for documenting a system’s security planning under the NIST SP 800-171 framework. It provides structured fields to identify the system, categorization, unique identifier, responsible organization, information owner, system owner, and security officer roles. The template includes sections for system environment (hardware/software), maintenance ownership, and a requirements narrative describing implementation or planned implementation of controls, including scoping guidance and rationale when not applicable. Includes access control families such as limiting system access and controlling CUI flow.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/cmmc-ssp-system-security-plan-template-last-updated/355533/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/cmmc-ssp-system-security-plan-template-last-updated/355533.png","ImageObject",442,249,{"name":88,"@type":89},"4398046744996","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-23","2026-09-22",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",7,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What information does the System Identification section require?","Question",{"text":109,"@type":110},"It requires the system name/title, system categorization, system unique identifier, and details for the responsible organization including the information owner and system owner, plus the system security officer.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What does the System Environment section capture?",{"text":114,"@type":110},"It captures inventories of hardware and software components and includes fields to confirm whether hardware/software are maintained and owned by the organization.",{"name":116,"@type":107,"acceptedAnswer":117},"How should security requirements be documented in the Requirements section?",{"text":118,"@type":110},"For each requirement, it must include the requirement number and description, how it is implemented or planned, and any applied scoping guidance; if not applicable, provide rationale.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},355533,1791562893,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":60,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},4398046744996,"CMMC SSP  \nSystem Security Plan Template  \nPrepared for: Last updated:  \n\u003Cinsert name System Security Plan Last Updated  \n1. System Identification  \n1.1. System Name/Title: [State the name of the system. Spell out acronyms.  \n1.1.1. System Categorization: Moderate Impact for Confidentiality  \n1.1.2. System Unique Identifier: [Insert the System Unique Identifier]  \n1.2. Responsible Organization:  \n\n| Name: |  |\n| --- | --- |\n| Address: |  |\n| Phone: |  |\n\n1.2.1. Information Owner (Government point of contact responsible for providing and/or receiving CUI):  \n\n| Name: |  |\n| --- | --- |\n| Title: |  |\n| Office Address: |  |\n| Work Phone: |  |\n| E-mail Address: |  |\n\n1.2.2. System Owner (assignment of security responsibility):  \n\n| Name: |  |\n| --- | --- |\n| Title: |  |\n| Office Address: |  |\n| Work Phone: |  |\n| E-mail Address: |  |\n\n2  \n\u003Cinsert name System Security Plan Last Updated  \n1.2.2.1. System Security Officer:  \n\n| Name: |  |\n| --- | --- |\n| Title: |  |\n| Office Address: |  |\n| Work Phone: |  |\n| E-mail Address: |  |\n\n1.3. General Description/Purpose of System: What is the function/purpose of the system? s[ Provysteie] a short, high-level description of the function/purpose of the  \n1.3.1. Number of end users and privileged users: [In the table below, provide the approximate number of users and administrators of the system. Include all those with privileged access such as system administrators, database administrators, application administrators, etc. Add rows to define different roles as needed.]  \nRoles of Users and Number of Each Type:  \n\n| Number of Users | Number of Administrators/ Privileged Users |\n| --- | --- |\n|  |  |\n|  |  |\n|  |  |\n\n1.4. General Description of Information: CUI information types processed, stored, or transmitted by the system are determined and documented. For more information, see the CUI Registry at [https://www.archives.gov/cui/registry/category-list](https://www.archives.gov/cui/registry/category-list).  \n[Document the CUI information types processed, stored, or transmitted by the system below] .  \n3  \n\u003Cinsert name System Security Plan Last Updated  \n2. System Environment  \n| Hardware | Type | Purpose |\n| --- | --- | --- |\n|  |  |  |\n|  |  |  |\n|  |  |  |\n\n2.2. List all software components installed on the system.  \n\n| Software | Purpose |\n| --- | --- |\n|  |  |\n|  |  |\n|  |  |\n\n2.3. Hardware and Software Maintenance and Ownership-Is all hardware and software maintained and owned by the organization?  Yes  No  \n4  \n\u003Cinsert name System Security Plan Last Updated  \n3. Requirements  \n(Note: The source of the requirements is NIST Special Publication 800-171, dated December 2016)  \nProvide a thorough description of how all of the security requirements are being implemented or planned to be implemented. The description for each security requirement contains: 1) the security requirement number and description; 2) how the security requirement is being implemented or planned to be implemented; and 3) any scoping guidance that has been applied (e.g., compensating mitigations(s) in place due to implementation constraints in lieu of the stated requirement) . If the requirement is not applicable to the system, provide rationale.  \n3.1. Family: Access Control (AC)  \n3.1.1. Limit system access to authorized users, processes acting on behalf of authorized users, or devices (including other systems) .  \nAssessment Objective:  \nDetermine if:  \n[a] authorized users are identified.  \n[b] processes acting on behalf of authorized users are identified.  \n[c] devices (and other systems) authorized to connect to the system are identified.  \n[d] system access is limited to authorized users.  \n[e] system access is limited to processes acting on behalf of authorized users.  \n[f] system access is limited to authorized devices (including other systems).  \nStatus:  Implemented  Planned  Not Applicable  \nStrike Graph Guidance: Organizations must implement strict access controls ensuring only approved users, devices, and pr","cbCaikoQYpN4Dzwe","https://ap.wps.com/l/cbCaikoQYpN4Dzwe","pdf",2855599,56,"English","# System Identification\n## System Name/Title\n## System Categorization\n## Responsible Organization\n## Information Owner\n## System Owner\n## System Security Officer\n## General Description/Purpose of System\n## General Description of Information\n# System Environment\n## Hardware\n## Software\n## Maintenance and Ownership\n# Requirements\n## Access Control (AC)\n## Limit System Access\n## Limit Transaction Types and Functions\n## Control Flow of CUI","[{\"question\":\"What information does the System Identification section require?\",\"answer\":\"It requires the system name/title, system categorization, system unique identifier, and details for the responsible organization including the information owner and system owner, plus the system security officer.\"},{\"question\":\"What does the System Environment section capture?\",\"answer\":\"It captures inventories of hardware and software components and includes fields to confirm whether hardware/software are maintained and owned by the organization.\"},{\"question\":\"How should security requirements be documented in the Requirements section?\",\"answer\":\"For each requirement, it must include the requirement number and description, how it is implemented or planned, and any applied scoping guidance; if not applicable, provide rationale.\"}]","CMMC SSP - System Security Plan Template - Last Updated | PDF",1790119681,20]