System Security Plan - Template

Aug 31, 2026

System Security Plan (SSP) template describing organisational policies, processes, and technical controls for a specified core system or network covering Microsoft workloads, endpoints, and other scoped components. Defines purpose and alignment to ASD’s Information Security Manual (ISM) documentation requirements for system authorisation. Provides guidance to explain secure operation, implemented controls, and residual controls, while directing readers to the System Security Plan Annex for detailed ISM control mappings, plus sections covering overview, boundaries, out-of-scope systems, risk assessment, and delivery.

LanguageEnglish

CategoryLetters

FormatDOCX

Pages100

Reading Time35 min

AccessFree to download

About this System Security Plan

Purpose of this System Security Plan

Overview

System information

System purpose

System overview

System boundary

Diagram

Out of scope

Risk assessment

System delivery

System Security Plan Documentation | Template This template provides the content of ASD’s System Security Plan as advised on ASD’s Blueprint for Secure Cloud. Users can use their own branding. users should remove or add sections relevant to their documentation requirement. Delete this and all other pre-populated instructions from the final version of your report. Table of Contents TOC \o "1-1" \h \z \u System Security Plan About this System Security Plan This System Security Plan (SSP) describes the organisational policies and processes relevant to, and technical controls implemented within the core or network that includes ’s Microsoft Workloads (Cloud and Software as a Service), endpoints and . Purpose of this System Security Plan The purpose of this SSP is to describe the organisational policies and processes relevant to, and technical controls implemented within ’s , including the underlying components leveraged in the system’s deployment. This document has been developed to comply with the Australian Signals Directorate’s (ASD’s) HYPERLINK "https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism" \h Information Security Manual’s (ISM’s) requirements in relation to documentation for system authorisation. This document is written using descriptive and explanatory language to assist readers in understanding how operates securely, the controls implemented, and the residual controls that are addressed elsewhere by . For detailed information on how addresses specific controls in ASD’s ISM, please refer to the HYPERLINK "https://blueprint.asd.gov.au/security-and-governance/annex" \h System Security Plan Annex Overview System information System purpose aims to provide a scalable, multi-classified, multi-vendor platform that enables trustworthy external suppliers, partners, and staff to collaboratively develop and enhance our services more rapidly. The objectives of the are to: Scale resources faster Support the development of more innovative solutions Provide faster on boarding for new staff Improve workplace and partner collaboration Assist with greater community engagement Enable scalable service continuity System overview is ’s implementation of a range of cloud services and applications focused on driving productivity and business outcomes and enabling ’s workforce to securely work and collaborate from the office, while travelling or from home. includes the following components that will improve the security posture of : Identity Microsoft Entra ID (previously known as Azure Active Directory) Multi-Factor Authentication (MFA) Conditional Access Privileged Identity Management Microsoft 365 including: Exchange Online & Exchange Online Protection SharePoint Online OneDrive for Business Power Platform (Power Automate and Power Apps) Microsoft Teams Office 365 Applications Device management (Intune) including: Windows 10 Windows 11 iOS Connectivity Cloud to cloud Endpoints Point to site Government to Government (GovLINK) Security and Compliance Services including: Microsoft Defender XDR Microsoft Defender for Cloud Apps Microsoft Defender for Endpoints Microsoft Defender for Identity Microsoft Defender for Office 365 Microsoft Defender Vulnerability Management (MDVM) Microsoft Information Protection Microsoft Purview Log Analytics Automation including: Desired State Configuration (DSC) Microsoft Graph PowerShell Support System boundary The boundary consists of: Physical Boundaries — comprising the perimeter security measures of ’s office locations and serv

FAQs

What does the System Security Plan (SSP) describe?

It describes organisational policies and processes and the technical controls implemented within the specified core system or network, including scoped Microsoft workloads, endpoints, and other components.

What is the purpose of this SSP template?

Its purpose is to document policies, processes, and technical controls for system authorisation and to support readers in understanding how the system operates securely, including residual controls addressed elsewhere.

How is the SSP aligned to ASD requirements?

The document is developed to comply with the Australian Signals Directorate (ASD) Information Security Manual (ISM) requirements for documentation for system authorisation, with detailed control information referenced in the SSP Annex.

Aug 31, 2026

Upload by Emma Mercer