System Security Plan

What Is a System Security Plan?

A system security plan (SSP) is a formal document that provides an overview of an organization’s security requirements for a system and the existing or planned security measures for meeting those requirements. It describes the system and identifies the security controls and their implementation.

An SSP cybersecurity plan provides an organization with several benefits. It informs and aligns the company around a coherent security posture and set of operating controls. It assists with the management of those controls by identifying the responsibilities, accountability, and expected behavior of people who access the system. Documenting risks and mitigation strategies helps prevent security problems and prepares the company to respond swiftly and effectively to security incidents.

For legal protection, a system security plan also facilitates the organization’s  contractual requirements and adherence to relevant compliance standards, such as the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations) and the US Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC).

What Is the NIST SP 800-171 System Security Plan?

Since November 2016, the system security plan has been part of the NIST SP 800-171 security requirement set forth by the Defense Federal Acquisition Regulation Supplement (DFARS). The DoD’s latest update to CMMC 2.0 also mandates it.   

NIST SP 800-171 provides recommended requirements for protecting controlled unclassified information (CUI) confidentiality. The control security requirement 3.12.4 states that organizations must “develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationship with or connections to other systems.”

Defense contractors must implement NIST SP 800-171 to demonstrate their provision of adequate security to protect the covered defense information included in their defense contracts, as required by DFARS clause 252.204-7012. If a manufacturer is part of a DoD, General Services Administration (GSA), NASA, or other federal or state agencies’ supply chain, NIST SP 800-171 implementation is required. According to the CUI SSP cybersecurity template distributed by the NIST, these companies’ chief information officer (CIO) and systems security officers are responsible for the system security plan.

NIST SP 800-171 includes the following control families to organize system security plan requirements for controlled unclassified information. The control families are based on core security functions. Work on a new version of NIST SP 800-171 is expected to include several new controls, including Planning, System and Service Acquisition, and Supply Chain Risk Management.

The US Department of Defense (DoD) created CMMC based on NIST 800-171 and other cybersecurity standards. It ensures that companies handling national security information implement and comply with these standards by documenting procedures, management, and reviews of cyber events.

While NIST SP 800-171 is a set of recommended requirements for protecting CUI confidentiality, CMMC  is designed to enforce the protection of sensitive information across the Defense Industrial Base (DIB).

Companies have to conform with CMMC at different levels, depending on the type and sensitivity of the information being handled. Certain levels require compliance verification by a third-party assessment organization (C3PAO).

How Often Should a System Security Plan Be Updated?

Without regular updates to their system security plan, organizations are at risk of data breaches and could face significant financial and operational consequences. If an organization’s SSP fails to reflect the current operational state of its business environment, the organization could also be at risk of non-compliance with contracts and may face prosecution under the False Claims Act.

To avoid these potential consequences, a system security plan should be viewed as an evolving document that is reviewed and updated frequently to ensure and demonstrate robust SSP cybersecurity and compliance. The frequency of system security plan updates should be based on the following criteria.

• The organization’s environment
• The level of risk associated with the systems and data
• Changes in the organization’s security posture
• Changes to applicable laws and regulations

Whenever an organization adds a new process or tool, creates a new user role, or materially changes your IT environment, it is important to check whether it impacts the system security plan. Anytime a new cyberthreat or risk is identified, appropriate updates should be made, and the system security plan should be revised. New laws and regulations should be monitored to identify any new requirements that should be addressed in the system security plan.

For companies needing to follow NIST SP 800-171 requirements and attain CMMC certification, the system security plan should also be updated and completed prior to third-party assessment.

What Are the Different Types of Security Plans?

There are several types of security plans that are used by organizations to address different functions. The specifics of any deployment of these security plans depend on the size and scope of the organization’s needs. Most organizations employ some aspects of most of these types of security plans. While each of these has a different focus, all effective security plans share common characteristics, including:

• Alignment with the organization’s risk appetite
• Buy-in and support of senior management for the concepts and enforcement of policies
• Clearly articulated purpose and objectives
• Defined scope
• Feasibility to implement and enforce
• Reflection of the company’s current environment (e.g., technology, trends, and regulations)
• Statement of applicability that clarifies who it applies to (e.g., specific users or geographical regions) 
• Terminology that is clear and broadly understood

Organizational security plans
Also referred to as program policies, organizational security plans define an organization’s overall information security program. This blueprint of programs and policies provides a foundation for other security plans. Organizational security plans also articulate the objectives and scope of the program, including the applicable compliance requirements and roles and responsibilities. Program policies do not delve into the tactics and are technology-agnostic. Components of an organizational security plan include:

• Risk management plans that identify risks to digital assets and strategies for risk assessment, mitigation, and management
• Business continuity plans (BCP) to ensure continuity of operations by mitigating service disruptions after a disaster or similar incident
• Incident response plans include procedures for responding to a security breach as it is happening
• Security awareness and training plans to educate users on threats, security policies, and best practices

Issue-specific security plans
Issue-specific security plans or policies build upon a general security policy. They focus on current areas of relevance, concern, and even controversy. They provide more concrete guidance on topics of special concern to an organization’s workforce. Examples include:

• Use of Generative AI policy
• Internet access policy
• Network security policy
• Bring-your-own-device (BYOD) policy
• Social media policy
• Remote work policy
• Acceptable use plans lay out rules and regulations for employees’ use of company assets
• Policies related to email security, such as rules that prevent phishing attacks 
• Data protection and privacy plans that establish rules for how data can be collected, stored, and used 

Issue-specific policies usually come from a senior official in the organization. They typically include a statement about the issue, the organization’s position, and its applicability. They also outline roles and responsibilities for the policy, including any required approval authority.

System-specific security plans
Unlike issue-specific plans, system-specific security plans are often most relevant to the technical personnel that maintain them. A system-specific security plan is the most granular type of security plan. It targets system-specific aspects of the larger organizational plan, such as a firewall, web server, or individual computer, focusing on the cybersecurity policies for them. Two categories of system-specific security policies are directives on system implementation (i.e., managerial guidance) and configuration and user behavior to maximize security of the information on the system (i.e., technical specifications).

According to NIST, these plans should include both a security objective and operational rules. Each objective should be achievable and include statements about actions with respect to resources. Operating rules should describe who can take what action using what system resource. Examples of a system-specific security policy are:

• Access control plans specify which employees can access which resources
• Rules related to BYOD and how or if these devices may be connected to an organization’s network
• Mobile device management (MDM) plans that focus on mobile device security (e.g., use of encryption and multi-factor authentication)

Physical security plans
Physical security plans protect an organization’s physical assets, including buildings, rooms, vehicles, inventory, machines, and IT equipment such as servers, computers, and hard drives. They define how these assets are protected and who is authorized to access, handle, move, and monitor them. Their purpose is to protect against:

• Computer service interruptions
• Physical damage
• Unauthorized access to company data
• Loss of control over system integrity
• Physical theft

Physical security plans include the following:

Why Non Federal Organizations Can Use a System Security Plan

For non federal organizations, a system security plan provides proven guidance and best practices for protecting all types of sensitive information. Using a system security plan to inform cybersecurity decisions and programs helps organizations ensure that they are taking all precautions to protect sensitive information, which not only meet internal needs but also help meet the requirements of many regulations. 

During the process of using an SSP cybersecurity model, describing how the security requirements are met or explaining what changes or additions will be made to address known or anticipated threats helps identify gaps and opportunities for improvement. Whether working with federal agencies or not, creating and maintaining a system security plan delivers unquestionable value to any organization.

Egnyte has experts ready to answer your questions. For more than a decade, Egnyte has helped more than 17,000+ customers with millions of users worldwide.

Last Updated: 27th February, 2024