System Security Plan (SSP)

What it is

The System Security Plan is the document a CMMC Level 2 assessor reads first. It describes the system that handles Controlled Unclassified Information (CUI), where its boundary sits, who holds each security role, and how each of the 110 practices is implemented. CMDash builds it from your practice data and keeps the two sections only you can write, the System Description and the Authorization Boundary, as stored, numbered versions.

The document is regenerated from your current practice data every time you open or export it. What you type replaces the prompts in the document; it never replaces the facts. A banner reads Not ready for submission until both narratives are written and every security role has a holder.

When to use it

Use it when you are preparing for a CMMC Level 2 assessment, answering an assessor or a prime contractor who asks for your SSP, or checking how complete your own documentation is before you submit an SPRS score or sign an annual affirmation.

Before you start

Tier: The SSP page is open on every plan, including Free. The C3PAO audit package (the SSP with the POA&M, SPRS score and evidence manifest as a ZIP) and the OSCAL SSP export start at Starter.
Role: Anyone with access to the workspace can read and download the SSP. Owner and Admin write the narratives.
Scope: The page covers CMMC Level 2. A Level 3 SSP is generated for the audit package but is not editable on the page.
Security roles: Name the holders first under Security roles: System Owner, Authorizing Official, ISSM/ISSO and CMMC point of contact. A role with no holder keeps the banner up.

How to

Write the two narratives

Go to Security → All Security tools → Security Program → System Security Plan.
Read the banner. It lists the sections still to write and any security role with no holder.
In System Description, describe the systems that store, process or transmit CUI: names and purpose, the CUI categories, how many users have access, the hosting model and providers, and the physical locations.
In Authorization Boundary, list the components inside the boundary, the outside systems that exchange data with it, any interconnection agreements, and a reference to your network diagram.
Select Save. Tick Mark as reviewed first if a second person has read the text. Markdown is allowed: headings, lists and bold text.

Check what changed

Select History under a section to list its versions: number, status, date and length.
If someone saved a newer version while you were typing, CMDash refuses your save and reloads the page. Merge your changes and save again; nothing is overwritten silently.

Read the practice text

Each practice in the SSP is written from your practice notes and the assessment objectives you recorded on it. Where a stored practice narrative exists, the page tells you how many practices use your own words instead of the drafted text.

Export it

Select Download as Markdown for an editable copy.
Select Download print-ready page (save as PDF), then use your browser's print dialog to save a PDF for the assessor.
Use Preview the full document to read the whole plan on the page before exporting.

Common questions

Why does it still say "Not ready for submission"? The banner names what is missing: a narrative that is empty, or a security role with no holder. CMDash cannot write the narratives, because they describe your systems. The banner clears the moment the last item is done.

Can I edit the practice-by-practice text on this page? No. This page holds the two narratives that belong to the whole system; the practice text comes from your practice notes and objectives.

Why can I read the page but not save? Saving is limited to Owner and Admin. A read-only member sees a note saying so.

What does the page say if my plan was set up before the SSP became part of every plan? It shows a notice that the SSP is not enabled for the workspace. Contact support and your entitlement is refreshed.

Is the SSP the same as the audit package? No. The SSP is one document. The audit package bundles it with the POA&M, the SPRS score and the evidence manifest, and starts at Starter.

CMMC, POA&M, SPRS and OSCAL: the practices, the POA&M and the exports.
Security Programme: the system boundary and security roles.
Signer's File: what the affirming official signs once the plan is in place.
In-app: Security → All Security tools → Security Program → System Security Plan.

This page is the product manual, published from the repository at docs/user/feature-guides/system-security-plan.md. Customers read the same text inside CMDash under Help. Last updated October 12, 2026.