Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

A system security plan describes your information system and how your company meets its security requirements.

Create a system security plan (SSP). Include a list of key personnel and roles responsible for your information system. Provide a high level description of your systems primary purpose and functions. List common types of user roles and their associated permissions. Describe the type of data your information systems process (e.g. “Controlled Unclassified Information” (CUI)). Create a network diagram and write a description about it. Reference your hardware and software list in your SSP. List out all of the security practices you need to implement. Describe how you have or plan to implement them. Periodically (e.g. bi-annually) update your system security plan (SSP) to reflect any changes.