SSP Builder
System Security Plan — NIST SP 800-171 / CMMC Level 2
SSP Completeness
0%
CMMC Level 2 Control Implementation0/110 implemented
0 Implemented0 Partial110 Not Started
SSP Document Sections
AI generates professional content for each section based on your program data
1. System Overview
Organization name, system name, system owner, authorization boundary, system description, operating environment
Click "Generate with AI" to populate this section with professional SSP content.
2. System Environment
Hardware, software, network topology, interconnections, cloud services, data flows
3. System Users
User roles, access levels, authentication methods, privileged users, external users
4. CUI Categories
Types of CUI processed, stored, or transmitted; data classification; handling requirements
5. Control Implementation
How each NIST 800-171 requirement is implemented, by domain
6. Plan of Action & Milestones
Deficiencies identified, remediation plans, responsible parties, target dates
Section 5: Control Implementation by Domain
14 NIST 800-171 domains — AI generates implementation narratives from your control data
AC
Access Control
22 practices · Limit system access to authorized users, processes, and devices
AT
Awareness and Training
3 practices · Ensure personnel are aware of security risks and trained
AU
Audit and Accountability
9 practices · Create and retain system audit logs
CM
Configuration Management
9 practices · Establish and maintain baseline configurations
IA
Identification and Authentication
11 practices · Identify and authenticate system users and devices
IR
Incident Response
3 practices · Establish operational incident-handling capability
MA
Maintenance
6 practices · Perform maintenance on organizational systems
MP
Media Protection
9 practices · Protect system media containing CUI
PE
Physical Protection
6 practices · Limit physical access to organizational systems
PS
Personnel Security
2 practices · Screen individuals prior to authorizing access
RA
Risk Assessment
3 practices · Periodically assess risk to organizational operations
CA
Security Assessment
4 practices · Periodically assess security controls
SC
System and Communications Protection
16 practices · Monitor, control, and protect communications
SI
System and Information Integrity
7 practices · Identify, report, and correct information system flaws