NIST Special Publication 800-171 Revision 2

Date Published: January 28th, 2021

Withdrawn on May 14, 2024. Superseded by SP 800-171 Rev. 3

Author(s): Ron Ross (NIST), Victoria Pillitteri (NIST), Kelley Dempsey (NIST), Mark Riddle (NARA), Gary Guissanie (IDA)

Note: A Class Deviation is in effect as of May 2, 2024 (DEVIATION 2024O0013). The deviation clause requires contractors, who are subject to 252.204-7012, to comply with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2, instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer. Click Here

3.12.4: Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

Control Family: Security Assessment

Control Type: Basic

SPRS Value: N/A

SPRS Supplemental Guidance: N/A

CMMC Level(s):

  • CA.L2-3.12.4

Top Ten Failed Requirement:

No

Referenced in:

DFARS 252.204-7012

Derived From: NIST SP 800-53r4

  • CA-2

  • CA-5

  • CA-7

  • PL-2

NIST Supplemental Guidance:

[SP 800-18]

Discussion:

System security plans relate security requirements to a set of security controls. System security plans also describe, at a high level, how the security controls meet those security requirements, but do not provide detailed, technical descriptions of the design or implementation of the controls.

System security plans contain sufficient information to enable a design and implementation that is unambiguously compliant with the intent of the plans and subsequent determinations of risk if the plan is implemented as intended. Security plans need not be single documents; the plans can be a collection of various documents including documents that already exist. Effective security plans make extensive use of references to policies, procedures, and additional documents (e.g., design and implementation specifications) where more detailed information can be obtained. This reduces the documentation requirements associated with security programs and maintains security-related information in other established management/operational areas related to enterprise architecture, system development life cycle, systems engineering, and acquisition.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-171r2

Federal agencies may consider the submitted system security plans and plans of action as critical inputs to an overall risk management decision to process, store, or transmit CUI on a system hosted by a nonfederal organization and whether it is advisable to pursue an agreement or contract with the nonfederal organization.

[SP 800-18] provides guidance on developing security plans. [NIST CUI] provides supplemental material for Special Publication 800-171 including templates for system security plans.

Upon assessment, assessors must determine if- 

3.12.4[a] a system security plan is developed.
3.12.4[b] the system boundary is described and documented in the system security plan.
3.12.4[c] the system environment of operation is described and documented in the system security plan.
3.12.4[d] the security requirements identified and approved by the designated authority as non-applicable are identified.
3.12.4[e] the method of security requirement implementation is described and documented in the system security plan.
3.12.4[f] the relationship with or connection to other systems is described and documented in the system security plan.
3.12.4[g] the frequency to update the system security plan is defined.
3.12.4[h] system security plan is updated with the defined frequency.

Assessors are instructed to-

Examine: [SELECT FROM: Security planning policy; procedures addressing system security plan development and implementation; procedures addressing system security plan reviews and updates; enterprise architecture documentation; system security plan; records of system security plan reviews and updates; other relevant documents or records].

Interview: [SELECT FROM: Personnel with security planning and system security plan implementation responsibilities; personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for system security plan development, review, update, and approval; mechanisms supporting the system security plan].

FURTHER DISCUSSION

A system security plan (SSP) is a document that outlines how an organization implements its security requirements. OSAs must have an SSP in place at the time of assessment to describe each information system within the CMMC Assessment Scope. The absence of an up-to-date SSP at the time of the assessment would result in a finding that an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012. OSAs are free to choose the format of their SSP. At a minimum, an SSP must include:

  • Description of the CMMC Assessment Scope;

  • CMMC Assessment Scope Description: high-level description of the assets within the assessment scope186;

  • Description of the Environment of Operation: physical surroundings in which an information system processes, stores, and transmits information;

  • Identified and Approved Security Requirements: requirements levied on an information system that are derived from applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, procedures, or organizational mission/business case needs to ensure the confidentiality, integrity, and availability of the information being processed, stored, or transmitted;

  • Implementation Method for Security Requirements: description of how the identified and approved security requirements are implemented with the system or environment;

  • Connections and Relationships to Other Systems and Networks: description of related, dependent, and interconnected systems; and

  • Defined Frequency of Updates: at least annually. In addition to the requirements above, an SSP often includes:

  • general information system description: technical and functional description;

  • design philosophies: defense-in-depth strategies and allowed interfaces and network protocols; and

  • roles and responsibilities: description of the roles and responsibilities for key personnel, which may include the system owner, system custodian, authorizing officials, and other stakeholders

This requirement, CA.L2-3.12.4, which requires developing, documenting, and updating system security plans, promotes effective information security within organizational systems required by SC.L2-3.13.2, as well as other system and communications protection requirements.

Example

You are in charge of system security. You develop an SSP and have senior leadership formally approve the document [a]. The SSP explains how your organization handles CUI and defines how that data is stored, transmitted, and protected [d,e]. The criteria outlined in the SSP is used to guide configuration of the network and other information resources to meet your company’s goals. Knowing that it is important to keep the SSP current, you establish a policy that requires a formal review and update of the SSP each year [g,h].

Potential Assessment Considerations

  • Do mechanisms exist to develop and periodically update an SSP [a,g]?

  • Are security requirements identified and approved by the designated authority as non-applicable documented [d]?