[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-183723-105":53,"doc-detail-183723-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","fedramp-system-security-plan-ssp-high-baseline-template-document-instructions","FedRAMP System Security Plan (SSP) High Baseline Template - Document Instructions","","FedRAMP System Security Plan (SSP) High Baseline template instructions guide Cloud Service Providers in entering and maintaining consistent security plan data for Joint Authorization Board (JAB) P-ATO or Agency ATO submissions. The template supports repeatable fields that automatically populate across the document, and uses date selection menus, constrained choice lists, and numeric/text entry prompts to standardize inputs. Guidance emphasizes explicit policy and procedure references, control ownership and origin, handling of inherited controls for SaaS/PaaS, and interpretation rules for NIST “organization defined.”",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/fedramp-system-security-plan-ssp-high-baseline-template-document-instructions/183723/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/fedramp-system-security-plan-ssp-high-baseline-template-document-instructions/183723.png","ImageObject",442,249,{"name":88,"@type":89},"Berry Peter","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/vnd.openxmlformats-officedocument.wordprocessingml.document","2026-10-23","2026-09-02",true,{"@type":98,"interactionType":99,"userInteractionCount":25},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Which fields are repeatable and how do they work in the template?","Question",{"text":108,"@type":109},"Repeatable fields include CSP Name, Information System Name, Version Number, Version Date, Information System Abbreviation, and associated leveraged information system name. Enter each once, then click outside the field so all occurrences populate throughout the document.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What should be done if a data field from the repeatable list does not populate?",{"text":113,"@type":109},"Refresh the document data by pressing the F9 key. If you change one of the repeatable fields, you may also need to press F9 to refresh values across the template, and then save the document after refreshes.",{"name":115,"@type":106,"acceptedAnswer":116},"How should security controls be described with respect to ownership and inheritance?",{"text":117,"@type":109},"Controls must be described as implemented on the system, including where they originate (system or business process) and whose responsibility it is to implement, manage, and monitor them. For SaaS/PaaS inheriting controls from IaaS (or lower), check the “inherited” box and state the implementation as “inherited,” letting FedRAMP determine whether the control set is appropriate.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},183723,1790679526,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":25,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},1374402524268,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Instruction: This template contains a number of features to facilitate data entry. As you go through the template entering data, you will see prompts for you to enter different types of data.\nRepeatable Field\nSome multiple-occurring data fields have been linked together and you need only enter the data once. Enter the data once; then click outside the data entry field and all occurrences of that field will be populated. For example, when you see “Information System Abbreviation” and replace it with your system abbreviation, all instances of the abbreviation throughout the document will be replaced with the value you entered. This document contains the following repeatable fields:\nCSP Name\nInformation System Name\nVersion Number\nVersion Date\nInformation System Abbreviation\nIf you find a data field from the above list that has not populated, then press the F9 key to refresh the data.  If you make a change to one of the above data fields, you may also have to press the F9 key to refresh the data throughout the document. Remember to save the document after refreshes. The one exception to the repeatable fields is information system names for FedRAMP or leveraged authorizations that are identified as “Leveraged information system name:\nDate Selection\nData fields that must contain a date will present a date selection menu.\nItem Choice\nData fields that have a limited number of value choices will present a selection list.\nNumber Entry\nData fields that must have numeric values display “number.”\nText Entry\nMany data fields, particularly in tables, that can contain any text display “Enter text” or “Click here to enter text.”\nDelete this instruction from your final version of this document.\n\u000f\nSystem Security Plan\nPrepared by\nPrepared for\nTemplate Revision History\n\u000f\nDocument Revision History\nHow to contact us\nFor questions about FedRAMP, or for technical questions about this document including how to use it, contact \u0013 HYPERLINK \"mailto:info@fedramp.gov\" \u0014info@FedRAMP.gov\u0015\nFor more information about the FedRAMP project, see \u0013 HYPERLINK \"http://www.fedramp.gov\" \u0014www.FedRAMP.gov\u0015\nInstruction: The System Security Plan is the main document in which the Cloud Service Provider (CSP) describes all the security controls in use on the information system and their implementation.\nThis document is released in template format.  Once populated with content, this document will include detailed information about service provider information security controls.\nThis document is intended to be used by service providers who are applying for a Joint Authorization Board (JAB) Provisional Authorization to Operate (P-ATO) or an Agency Authorization to Operate (ATO) through the Federal Risk and Authorization Management Program (FedRAMP).\u000b\u000bIn the sections that follow, describe the information security control as it is implemented on the system.  All controls originate from a system or from a business process.  It is important to describe where the control originates from so that it is clear whose responsibility it is to implement, manage and monitor the control.  In some cases, the responsibility is shared by a CSP and by the customer.  Use the definitions in the table that follows to indicate where each security control originates from.\nNote that “-1” Controls (AC-1, AU-1, SC-1, etc.)* cannot be inherited and must be described in some way by the service provider.\u000b*Access Control (AC), Audit and Accountability (AU), System and Communications Protection (SC)\nThroughout this SSP, policies and procedures must be explicitly referenced (title and date or version) so that it is clear which document is being referred to.  Section numbers or similar mechanisms should allow the reviewer to easily find the reference.\nFor System as a Service (SaaS) and Platform as a Service (PaaS) systems that are inheriting controls from an Infrastructure as a Service (IaaS) (or anything lower in the stack), the “inherited” check box must be checked and the implementation description must simp","cbCaipiobmSxD1FS","https://ap.wps.com/l/cbCaipiobmSxD1FS","docx",846249,457,"English","# Repeatable Field\n## Data fields that populate across the document\n# Date Selection and Input Controls\n## Date selection menus\n## Item choice lists\n## Number and text entry prompts\n# System Security Plan Content Guidance\n## SSP purpose and intended use for ATO/P-ATO\n## Control descriptions, origin, and shared responsibility\n## Inherited controls and inheritance handling\n## Policy and procedure citation requirements\n# Table of Contents Structure","[{\"question\":\"Which fields are repeatable and how do they work in the template?\",\"answer\":\"Repeatable fields include CSP Name, Information System Name, Version Number, Version Date, Information System Abbreviation, and associated leveraged information system name. Enter each once, then click outside the field so all occurrences populate throughout the document.\"},{\"question\":\"What should be done if a data field from the repeatable list does not populate?\",\"answer\":\"Refresh the document data by pressing the F9 key. If you change one of the repeatable fields, you may also need to press F9 to refresh values across the template, and then save the document after refreshes.\"},{\"question\":\"How should security controls be described with respect to ownership and inheritance?\",\"answer\":\"Controls must be described as implemented on the system, including where they originate (system or business process) and whose responsibility it is to implement, manage, and monitor them. For SaaS/PaaS inheriting controls from IaaS (or lower), check the “inherited” box and state the implementation as “inherited,” letting FedRAMP determine whether the control set is appropriate.\"}]","FedRAMP System Security Plan (SSP) High Baseline Template - Document Instructions | DOCX",1788353770,160]