Register:Glossary3 recordsSHA3-256 chainedhead sha3:0e4262ee7f5180e6e7a852a86bf3484e0c764ed12e301d1b4842ff1317ba2232Intact
REC 0001DEFINITIONsha3-256def573b10d342cc4f1a20a856cb25887c84cd62899d60bb1617c1372a20cf977prev:71d69f454167

SSP stands for System Security Plan.

The System Security Plan (SSP) documents your system boundary, the CUI data flows within it, and how each of the 110 NIST 800-171 controls is implemented. It is the central artifact a C3PAO reviews.

Assessors consistently report that documentation gaps — an SSP that does not match the live environment — drive more failed assessments than missing technical controls. SSPs commonly run to hundreds of pages.

Keeping the SSP true to a continuously changing cloud environment is the core challenge; automated evidence generation exists to close the gap between what the SSP claims and what the environment actually does.

REC 0002RELATED RECORDSsha3-2560e4262ee7f5180e6e7a852a86bf3484e0c764ed12e301d1b4842ff1317ba2232prev:def573b10d34

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Related terms and reading

  1. POA&M: Plan of Action and MilestonesA POA&M is a tracked plan for remediating security controls that are not yet fully implemented, with owners and target dates.
  2. NIST SP 800-171NIST SP 800-171 is the federal standard of 110 security controls for protecting CUI in non-federal systems: the technical basis of CMMC Level 2.
  3. C3PAO: CMMC Third-Party Assessment OrganizationA C3PAO is an organization authorized by the Cyber AB to conduct official CMMC Level 2 certification assessments.

Know the term. Then see the record behind it.

Request AccessBook a call
Sealed
Last amended
Unchanged since sealing
Register colophonRecomputable by a second party
SeqLabelSHA3-256Prev
REC 0000HEAD71d69f454167d8ccc3b5206f
REC 0001DEFINITIONdef573b10d3471d69f454167
REC 0002RELATED RECORDS0e4262ee7f51def573b10d34

The record headers on this page are SHA3-256 digests of this page's own copy, chained in sequence from a fixed genesis value. Edit one word of any record's copy above and every digest after it changes. Head of chain: sha3:0e4262ee7f51. The product does the same thing to your evidence.