System Security Plan template for movers
Every Level 2 self-assessment needs a System Security Plan (SSP): the document that describes your scope and how you meet each requirement. This free Word template is written for moving companies.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
Why you need one
Requirement 3.12.4 asks for a System Security Plan that describes your system boundaries, how each requirement is met and how your systems connect to others, updated at least once a year. Without a current SSP, a Level 2 assessment cannot be completed, and 3.12.4 can never wait on a plan of action.
Sources: NIST SP 800-171 Rev 2, 32 CFR 170.24, 32 CFR 170.21, 32 CFR 170.4
What is inside
- Company details and roles: your CAGE codes, scope, Affirming Official and who does what.
- Your scope: how DoD shipment information moves through your company, an asset inventory with typical mover systems as examples, your network diagram, outside service providers with their FedRAMP proof, and your locations.
- All 110 requirements: the official wording, where each usually applies at a moving company, your status, how you meet it, an example from a typical mover, who is responsible, where the evidence is kept, and the plan-of-action entry if it is not met.
- Plan of action, review and approval, sources and the disclaimer.
How to fill it in
- Work out your scope first. The plan describes only what is in scope.
- Replace everything in square brackets with your own details.
- For each requirement, write what your company actually does, then delete the grey example. A plan that describes things you do not do is worse than no plan.
- Track your status in the free workbook, and keep the evidence the plan points to.
- Review the plan at least once a year and whenever your systems change, and keep each version. Treat the filled-in plan as confidential.
Other free templates
Project Spectrum offers an SSP template once you sign in, and IAM's CMMC Resource Center offers a fillable CUI SSP template. Use whichever fits you best; this one is written for movers.
Sources: Project Spectrum FAQ, IAM CMMC Resource Center
The template is general information, not legal or compliance advice; see the disclaimer. Next: how to post in SPRS.