[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-174128-105":53,"doc-detail-174128-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","fedramp-system-security-plan-moderate-baseline-template","FedRAMP System Security Plan - Moderate Baseline Template","","Template instructions for preparing a FedRAMP System Security Plan for a Cloud Service Provider seeking Joint Authorization Board (JAB) Provisional Authorization (P-ATO) or Agency Authorization to Operate (ATO). The guide explains how to enter required security-control implementation details, including repeatable fields for consistent data population, date selection and choice lists, numeric and text entry behavior, and refreshing the template using F9. It also specifies documentation referencing requirements, inheritance rules for inherited controls, and how to interpret “organization defined” for Section 13.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/fedramp-system-security-plan-moderate-baseline-template/174128/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/fedramp-system-security-plan-moderate-baseline-template/174128.png","ImageObject",442,249,{"name":88,"@type":89},"Ivy","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/vnd.openxmlformats-officedocument.wordprocessingml.document","2026-10-23","2026-09-02",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",13,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What is the FedRAMP System Security Plan template used for?","Question",{"text":109,"@type":110},"It is used by a Cloud Service Provider to describe the security controls in use on the information system and how they are implemented when applying for JAB P-ATO or agency ATO through FedRAMP.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How do repeatable fields work in this template?",{"text":114,"@type":110},"Repeatable fields are linked so you enter the data once, and all instances are populated automatically. If a field does not populate, press F9 to refresh, and re-refresh if you change one of the repeatable fields.",{"name":116,"@type":107,"acceptedAnswer":117},"What guidance applies to controls that must be inherited?",{"text":118,"@type":110},"For SaaS/PaaS systems inheriting from an IaaS layer, the “inherited” checkbox must be selected and the implementation description should state “inherited,” with FedRAMP reviewers determining whether the inherited control set is appropriate.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},174128,1790679709,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":142},549758252649,"https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819","Instruction: This template contains a number of features to facilitate data entry. As you go through the template entering data, you will see prompts for you to enter different types of data.\nRepeatable Field\nSome multiple-occurring data fields have been linked together and you need only enter the data once. Enter the data once; then click outside the data entry field and all occurrences of that field will be populated. For example, when you see “Information System Abbreviation” and replace it with your system abbreviation, all instances of the abbreviation throughout the document will be replaced with the value you entered. This document contains the following repeatable fields:\nCSP Name\nInformation System Name\nVersion Number\nVersion Date\nInformation System Abbreviation\nIf you find a data field from the above list that has not populated, then press the F9 key to refresh the data.  If you make a change to one of the above data fields, you may also have to press the F9 key to refresh the data throughout the document. Remember to save the document after refreshes. The one exception to the repeatable fields is information system names for FedRAMP or leveraged authorizations that are identified as “Leveraged information system name:\nDate Selection\nData fields that must contain a date will present a date selection menu.\nItem Choice\nData fields that have a limited number of value choices will present a selection list.\nNumber Entry\nData fields that must have numeric values display “number.”\nText Entry\nMany data fields, particularly in tables, that can contain any text display “Enter text” or “Click here to enter text.”\nDelete this instruction from your final version of this document.\n\u000f\nSystem Security Plan\nPrepared by\nPrepared for\nTemplate Revision History\n\u000f\nDocument Revision History\nHow to contact us\nFor questions about FedRAMP, or for technical questions about this document including how to use it, contact \u0013 HYPERLINK \"mailto:info@fedramp.gov\" \u0014info@FedRAMP.gov\u0015\nFor more information about the FedRAMP project, see \u0013 HYPERLINK \"http://www.fedramp.gov\" \u0014www.FedRAMP.gov\u0015\nInstruction: The System Security Plan is the main document in which the Cloud Service Provider (CSP) describes all the security controls in use on the information system and their implementation.\nThis document is released in template format.  Once populated with content, this document will include detailed information about service provider information security controls.\nThis document is intended to be used by service providers who are applying for a Joint Authorization Board (JAB) Provisional Authorization to Operate (P-ATO) or an Agency Authorization to Operate (ATO) through the Federal Risk and Authorization Management Program (FedRAMP). \u000b\u000bIn the sections that follow, describe the information security control as it is implemented on the system.  All controls originate from a system or from a business process.  It is important to describe where the control originates from so that it is clear whose responsibility it is to implement, manage and monitor the control.  In some cases, the responsibility is shared by a CSP and by the customer.  Use the definitions in the table that follows to indicate where each security control originates from.\nNote that “-1” Controls (AC-1, AU-1, SC-1, etc.)* cannot be inherited and must be described in some way by the service provider.\u000b*Access Control (AC), Audit and Accountability (AU), System and Communications Protection (SC)\nThroughout this SSP, policies and procedures must be explicitly referenced (title and date or version) so that it is clear which document is being referred to.  Section numbers or similar mechanisms should allow the reviewer to easily find the reference.\nFor System as a Service (SaaS) and Platform as a Service (PaaS) systems that are inheriting controls from an Infrastructure as a Service (IaaS) (or anything lower in the stack), the “inherited” check box must be checked and the implementation description must sim","cbCaiuyg1re20WB5","https://ap.wps.com/l/cbCaiuyg1re20WB5","docx",725342,359,"English","# System Security Plan\n## Template Revision History\n## Document Revision History\n## Table of Contents\n## Contact Information","[{\"question\":\"What is the FedRAMP System Security Plan template used for?\",\"answer\":\"It is used by a Cloud Service Provider to describe the security controls in use on the information system and how they are implemented when applying for JAB P-ATO or agency ATO through FedRAMP.\"},{\"question\":\"How do repeatable fields work in this template?\",\"answer\":\"Repeatable fields are linked so you enter the data once, and all instances are populated automatically. If a field does not populate, press F9 to refresh, and re-refresh if you change one of the repeatable fields.\"},{\"question\":\"What guidance applies to controls that must be inherited?\",\"answer\":\"For SaaS/PaaS systems inheriting from an IaaS layer, the “inherited” checkbox must be selected and the implementation description should state “inherited,” with FedRAMP reviewers determining whether the inherited control set is appropriate.\"}]","FedRAMP System Security Plan - Moderate Baseline Template | DOCX",1788310329,126]