What goes in a system security plan (SSP) for NIST SP 800-171

A system security plan (SSP) describes the system that handles controlled unclassified information (CUI): its boundary, the environment it runs in, how each of the 110 NIST SP 800-171 requirements is implemented, and its connections to other systems. Requirement 3.12.4 asks for one, and under 32 CFR 170.24 an assessment cannot be completed without it, so no SSP means no SPRS score and no CMMC Level 2 status. NIST prescribes no format; it publishes a template.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What is a system security plan?

32 CFR 170.4 takes its definition from NIST SP 800-53: a System Security Plan is "the formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements", and it "describes the system components that are included within the system, the environment in which the system operates, how the security requirements are implemented, and the relationships with or connections to other systems".

NIST SP 800-171 Revision 2's discussion of 3.12.4 says what level of detail that means: "System security plans relate security requirements to a set of security controls. System security plans also describe, at a high level, how the security controls meet those security requirements, but do not provide detailed, technical descriptions of the design or implementation of the controls." And it need not be one file: "Security plans need not be single documents; the plans can be a collection of various documents including documents that already exist."

What does requirement 3.12.4 say?

Requirement 3.12.4 is a basic security requirement in the Security Assessment family (3.12) of NIST SP 800-171 Revision 2: "Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems."

The family's other three requirements, with their points and objectives, are at 3.12 Security Assessment; all 110, by family, under Requirements.

NIST SP 800-171A (June 2018) turns that into eight assessment objectives, the checklist an assessor, or you, works from:

Objectives [b], [c], [e] and [f] are the four things the requirement names. The other four are easy to miss: the plan has to exist, say which requirements you treat as not applicable, say how often it is reviewed, and show that it was.

Why does no SSP mean no SPRS score?

32 CFR 170.24(c)(2)(i)(B)(5) says it plainly: "OSAs must have a System Security Plan (SSP) (CMMC security requirement CA.L2-3.12.4) in place at the time of assessment to describe each information system within the CMMC Assessment Scope. The absence of an up to date SSP at the time of the assessment would result in a finding that 'an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012.'"

Two consequences follow. There is no score to post in SPRS, because the assessment was never completed; the DoD Assessment Methodology's scoring template gives 3.12.4 no point value for the same reason. And 3.12.4 is one of the six requirements 32 CFR 170.21(a)(2)(iii) says may never be on a plan of action, so a Conditional status cannot buy time to write one; see POA&M rules for CMMC Level 2.

The clause behind the finding is DFARS 252.204-7012. Its paragraph (b)(3) says that additional security measures a contractor adopts for special circumstances or temporary deficiencies "may be addressed in a system security plan."

What goes in a system security plan for CMMC?

Beyond the four descriptions in 3.12.4, 32 CFR part 170 names things it expects to find in the SSP:

• How each asset category is treated. Table 3 to 32 CFR 170.19(c)(1) tells the OSA, for CUI Assets, Security Protection Assets, Contractor Risk Managed Assets and Specialized Assets alike, to "Document asset treatment in the System Security Plan (SSP)" (the CUI Assets row; the other three rows say "in the SSP"), with an asset inventory and a network diagram of the scope. For Contractor Risk Managed Assets the assessor is told to "Review the SSP" and, "If sufficiently documented, do not assess against other CMMC security requirements". What the plan says about those assets decides how they are assessed.
• Cloud and external service providers. Under 32 CFR 170.16(c)(2)(iii), when a cloud service provider handles CUI, "the security requirements from the Customer Responsibility Matrix (CRM) must be documented or referred to in the OSA's System Security Plan (SSP)." Under 170.16(c)(3)(i), for a non-cloud provider, "The use of the ESP, its relationship to the OSA, and the services provided are documented in the OSA's SSP".
• Enduring exceptions. Under 32 CFR 170.24(b)(1)(i), "Enduring exceptions when described, along with any mitigations, in the system security plan shall be assessed as MET."
• DoD CIO adjudications. Under 170.24(c)(2)(i)(B)(8), a prior DoD CIO decision that a requirement is not applicable or that an alternative measure is equally effective "must be included in the system security plan to receive consideration during an assessment."
• A name, a version and a date. SPRS's NIST SP 800-171 Assessments module records the "System Security Plan (SSP) name, SSP version, SSP date" with each assessment. Treat the plan as a controlled document.

How the scope itself is set is in How to do a NIST SP 800-171 self-assessment for CMMC Level 2.

Is there a NIST SSP template for 800-171?

Yes. The CSRC pages for NIST SP 800-171 Revision 2 and NIST SP 800-171A both list a "CUI SSP template" (a Word file) among their supplemental material, next to a "CUI Plan of Action template". The planning note beside the link, which repeats footnote 28 of Revision 2, is the only rule NIST gives about form: "There is no prescribed format or specified level of detail for system security plans. However, organizations ensure that the required information in [SP 800-171 Requirement] 3.12.4 is conveyed in those plans." The discussion of 3.12.4 in Revision 2 says NIST's CUI material "provides supplemental material for Special Publication 800-171 including templates for system security plans".

NIST withdrew Revision 2 and the June 2018 edition of 800-171A on May 14, 2024, when Revision 3 of each was published. The templates are still posted, and the withdrawn editions are the ones 32 CFR 170.2 incorporates by reference, so they remain the basis for a CMMC Level 2 plan.

How often should an SSP be updated?

Requirement 3.12.4 says "periodically update", and objectives [g] and [h] ask whether the frequency is defined and kept. 32 CFR 170.4 fixes an upper bound for CMMC: "Periodically means occurring at a regular interval as determined by the OSA that may not exceed one year." Separately, 170.24 requires "an up to date SSP at the time of the assessment". Write the interval into the plan and date each revision.

Tiermark's SSP outline, section by section

With Supplier Pro, the System security plan page in the Tiermark supplier console takes a twelve-field form about your system and everything in your self-assessment workspace, and builds an outline of a system security plan as a PDF. Its sections are:

1. The system: System name, Purpose, Boundary.
2. Environment and connected systems: Environment, Connected systems.
3. Controlled unclassified information (CUI): Where CUI is stored, Where CUI is processed, How CUI is sent.
4. Roles: System owner, System owner contact, Security contact, Security contact details.
5. Security requirements: the 110 requirements by family. Each one you have touched shows its Status, how many objectives are determined, How it is implemented, Owner, Evidence, Plan of action, and, once any objective is determined, each NIST SP 800-171A objective with your determination; the rest are listed by number and title at the end of their family.
6. Plan of action and milestones (POA&M): each plan in requirement order, with the requirement's status, Weakness, Planned fix, Planned completion, Milestones, whether 32 CFR 170.21 allows the requirement on a POA&M, and Owner.
7. SPRS score: the score as the SPRS score page shows it, the counts of answers, your Conditional Level 2 (Self) status date and POA&M closeout deadline if entered, and the calculator's disclaimer.

Against 3.12.4's objectives: section 1 answers [b], section 2 answers [c] and [f], section 5 answers [e], and a requirement you mark not applicable is listed as such for [d]. The update frequency ([g] and [h]) is yours to set and record. A field you have not filled in reads "Not entered", and the foot of every page says "Prepared with Tiermark from the organization's own entries. Not an assessment." Whether you have an SSP for 3.12.4 is your own answer on the SPRS score page; downloading the outline does not answer it.

Where Tiermark fits

Tiermark is supplier-assurance software for defense contractors and their suppliers. With Supplier Pro, the SSP outline above is a starting point for your organization's own plan, built from your entries, and the same page exports your POA&M as a CSV. The free SPRS score calculator gives no score while 3.12.4 is not met, as the regulation has it. Tiermark does not write, assess or verify your plan, and it never holds CUI: text that carries a CUI marking is refused.

Sources

• NIST SP 800-171 Rev. 2, with the CUI SSP template and CUI Plan of Action template under Supplemental Material, NIST SP 800-171A (June 2018) and the CUI SSP template (docx)
• 32 CFR 170.4, 170.16, 170.17, 170.19, 170.21 and 170.24
• DFARS 252.204-7012
• SPRS: NIST SP 800-171 Assessments