NIST 800-171 3.12.4 (CA.L2-3.12.4): System Security Plan

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

NIST SP 800-171 Rev. 2, requirement 3.12.4

CMMC Level 2 practice CA.L2-3.12.4Published 2026-11-11

What 3.12.4 means in practice

The system security plan describes the system: its boundary, its environment of operation, how each requirement is implemented, and how it connects to other systems. It is updated on a set schedule and when the system changes. Without one an assessment cannot be completed, so no SPRS score is produced.

SPRS points and the CMMC POA&M

CMMC Level 2 practice: CA.L2-3.12.4
SPRS points: No point value of its own.
CMMC POA&M: Never. 32 CFR 170.21(a)(2)(iii) names 3.12.4 among the 6 requirements a CMMC POA&M may never include, whatever their point value.
Scoring note: No point value. Without a system security plan an assessment cannot be completed, so no score is produced.

Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.

What an assessor checks for 3.12.4

NIST SP 800-171A gives 8 determination statements for 3.12.4, each found satisfied or other than satisfied. Determine if:

3.12.4[a] a system security plan is developed.
3.12.4[b] the system boundary is described and documented in the system security plan.
3.12.4[c] the system environment of operation is described and documented in the system security plan.
3.12.4[d] the security requirements identified and approved by the designated authority as non-applicable are identified.
3.12.4[e] the method of security requirement implementation is described and documented in the system security plan.
3.12.4[f] the relationship with or connection to other systems is described and documented in the system security plan.
3.12.4[g] the frequency to update the system security plan is defined.
3.12.4[h] system security plan is updated with the defined frequency.

NIST SP 800-171A (June 2018), assessment objectives for 3.12.4

Evidence that shows 3.12.4 is met

The current system security plan, with its approval and date.
The boundary diagram and the list of connections to other systems in the plan.
An implementation description for each requirement.
The update schedule and the revision history.

How PolicyCortex gathers the evidence

No PolicyCortex collector reads the evidence for 3.12.4. Your team provides the evidence listed above.

Related pages

Calculator: SPRS score calculator: mark 3.12.4 and the other 109 requirements and see the score.
Sample package: Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.
Family: All 4 Security Assessment requirements (3.12).
Previous: 3.12.3: Ongoing Monitoring
Next: 3.13.1: Boundary Protection
All requirements: All 110 NIST SP 800-171 requirements, by family.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where the evidence is stored in each delivery mode.
authorization: Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
baseline: NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.