CMMC SSP Template: What Your System Security Plan Must Include
If you searched for a CMMC SSP template, you have a deadline and a blank document, and you want a file you can start from today. Here is the honest bottom line before you scroll—because the rule that trips up the most contractors is the one almost no template page bothers to tell them.
A free CMMC SSP template exists—NIST publishes one—but treat it as a starting structure, not the finished document. For CMMC (Cybersecurity Maturity Model Certification) Level 2, your System Security Plan—the document that describes your environment and how you meet each security requirement—must cover your system boundary, your operating environment, how each of the 110 NIST SP 800-171 Revision 2 requirements is implemented, your connections to other systems, your CMMC assessment scope, your asset categories, and a defined update cadence.
The catch that catches people: under 32 CFR §170.21, the SSP requirement—cataloged as CA.L2-3.12.4—cannot be deferred on a Plan of Action and Milestones (POA&M). And under 32 CFR §170.24, without an up-to-date SSP at assessment time, the assessment cannot be completed. No up-to-date SSP, no completed assessment.An SSP is required at CMMC Level 2 and Level 3; Level 1’s 15 basic safeguards do not include one.
Below we show you exactly what an assessor checks, walk you through the eight required elements from CA.L2-3.12.4, and help you decide whether to finish it yourself or bring in help.
Get the file first, read the rest second.
The official NIST CUI System Security Plan template is free and ungated—it is the base document the entire CMMC community starts from. Download it from NIST CSRC, then use the completion checklist on this page to add the CMMC Level 2 layer on top.
Get the NIST CUI SSP Template (free, official) →Which CMMC SSP template should you actually start from?
There are five practical paths to an SSP, and they are not interchangeable. The free NIST CUI template is the right base for most small contractors; consultant-built and software-managed SSPs help with complexity and upkeep; a C3PAO reviews the SSP but does not write it. The table below shows what each option is good for and where it stops being enough, so you don’t burn a week on the wrong starting point.
| Option | Best for | Where it stops being enough | Verdict |
|---|---|---|---|
| NIST CUI SSP template (free .docx) | Starting a NIST 800-171 / CMMC Level 2 SSP from an official-style format | It predates the CMMC program—no CMMC scoping, asset categories, 800-171A objective tracking, SPRS metadata, or POA&M rules | Use it as the base, not the whole CMMC answer |
| NIST template + this page’s completion checklist (free) | Contractors who want the NIST structure plus a CMMC-specific completion layer | You still have to implement the requirements truthfully | The strongest free starting point for most readers |
| GRC-generated SSP (compliance software) | Teams that need evidence workflow, owners, tasks, and ongoing updates in one platform | If the underlying answers are wrong or your CUI scope is undefined, the software just organizes the mistake faster | Excellent for maintaining the SSP—not a substitute for scope judgment |
| Consultant-built SSP (RPO / vCISO) | Complex environments, multiple CAGE codes, messy CUI, or a real deadline | You can outsource the writing but not the implementation or the ownership | Strong when paired with internal ownership and real evidence |
| C3PAO review | Organizations that are assessment-ready | The same firm generally cannot both prepare/remediate and assess the same engagement | A late-stage step, with independence rules respected |
The NIST template and the completion checklist on this page are both free and ungated. Start there. The rest of this page is the part the templates leave out.
Is there an official CMMC SSP template?
There is no mandatory, CMMC-branded SSP format you are required to use. NIST publishes a free CUI System Security Plan template as supplemental material to SP 800-171, but NIST itself states there is “no prescribed format or specified level of detail”—what matters is that the plan conveys the information required by requirement 3.12.4. So the honest answer is: download the NIST template if you want an official-style base, but understand that “official-looking” and “assessment-ready for CMMC Level 2” are two different things.
We verified this directly. The NIST Computer Security Resource Center hosts a CUI SSP Template (.docx) and a CUI Plan of Action Template (.docx)alongside NIST SP 800-171 Revision 2, and the publication’s own planning note says plainly that there is no required format as long as the SSP carries the information called for in 3.12.4. That is the federal government telling you, in writing, that the form matters less than the substance.
Verified source snapshot — NIST CSRC, checked
- File:
CUI-SSP-Template-final.docx(supplemental material to NIST SP 800-171 Rev. 2) - Companion file:
CUI-Plan-of-Action-Template-final.docx - NIST planning note: no prescribed SSP format; the plan must convey the information in requirement 3.12.4
- Controlling CMMC baseline confirmed against 32 CFR Part 170 (CMMC maps Level 2 to Rev. 2)
What the NIST template gives you is a clean skeleton: system name, owner, boundary, control implementation. What it does notgive you is the CMMC-specific layer—the assessment scope, the five asset categories, the 800-171A objective coverage, the External Service Provider documentation, and the SPRS reporting fields. That gap is exactly what the completeness crosswalk below addresses.
Get the file first, read the rest second.
The official NIST CUI System Security Plan template is free and ungated—it is the base document the entire CMMC community starts from. Download it from NIST CSRC, then use the completion checklist on this page to add the CMMC Level 2 layer on top.
Get the NIST CUI SSP Template (free, official) →What must a CMMC SSP template include for Level 2?
A CMMC Level 2 SSP must document eight specific things an assessor will check: that a plan exists, the system boundary, the operating environment, any non-applicable requirements, how each requirement is implemented, the relationships and connections to other systems, a defined update frequency, and evidence that the plan is actually updated. Those eight come straight from the assessment objectives for CA.L2-3.12.4 in the official DoD CMMC Level 2 Assessment Guide. Build to them and you have covered what the requirement demands.
We assembled the crosswalk below by mapping the DoD Chief Information Officer’s CMMC Level 2 Assessment Guide, NIST SP 800-171A (the companion that turns each requirement into testable objectives), and the CMMC scoping rules into one SSP-completion table—the work you would otherwise do yourself by reading three documents side by side.
The CMMC SSP Completeness Crosswalk
| Required element (CA.L2-3.12.4) | Plain terms | What the assessor checks | SSP section | Common gap | Primary source |
|---|---|---|---|---|---|
| [a] A plan is developed | An SSP actually exists and is current | A current SSP is present—and this requirement cannot be deferred; version/review history shows it is not a stray draft | Cover page, version control, approval | No SSP, or a draft no one maintains | DoD CMMC L2 Assessment Guide; 32 CFR §170.21 |
| [b] System boundary | Your CUI/assessment scope—every asset that touches CUI | Boundary matches the real network and the scoping rules | Assessment scope & boundary | Too narrow (gaps) or too broad (needless cost) | 32 CFR §170.19; CMMC L2 Scoping Guide |
| [c] Environment of operation | Physical and logical surroundings where CUI lives | The description is specific to you, not generic boilerplate | Environment of operation | Boilerplate that could describe any company | DoD CMMC L2 Assessment Guide; NIST SP 800-18 |
| [d] Non-applicable requirements | Which of the 110 are not applicable, why, and approved | N/A determinations are justified and approved by a designated authority | Applicability & N/A rationale | “N/A” with no auditable reason | DoD CMMC L2 Assessment Guide (objective [d]) |
| [e] Implementation method | How you meet each requirement—across every assessment objective | Each objective addressed with specific tools and configuration | Control implementation (14 families) | Vague narratives that restate the control instead of describing your setup | DoD CMMC L2 Assessment Guide; NIST SP 800-171A |
| [f] Connections to other systems | Cloud services, MSPs, and External Service Providers in your boundary | ESPs and shared responsibilities documented; interconnections mapped | Connections, ESPs & Shared Responsibility Matrix | Cloud treated as a footnote; no shared-responsibility matrix | DoD CMMC L2 Assessment Guide; CMMC L2 Scoping Guide |
| [g] Update frequency defined | How often the SSP is reviewed and updated | A defined cadence is stated in the plan | Maintenance & review cadence | No defined update frequency | DoD CMMC L2 Assessment Guide (objective [g]) |
| [h] Plan is updated | The SSP is actually kept current | Evidence of reviews and updates exists | Maintenance change log | A stale SSP with no review records | DoD CMMC L2 Assessment Guide (objective [h]) |
A few things the crosswalk implies are worth saying out loud. First, those 110 requirements are not 110 checkboxes—NIST SP 800-171A breaks them into 320 individual assessment objectives, and if you miss even one objective within a requirement, the entire requirement is scored NOT MET. (Confirm against the current 800-171A before you rely on the exact number.)Second, your SSP does not have to be one giant file. The Assessment Guide is explicit that an SSP can be a collection of documents and can reference your existing policies and procedures rather than restate them—a relief if you already have a security program on paper.
Should you build your SSP to NIST 800-171 Rev. 2 or Rev. 3?
Build to Revision 2. CMMC Level 2 is anchored to NIST SP 800-171 Revision 2—110 requirements across 14 control families—by 32 CFR Part 170. NIST published Revision 3 in 2024, and Revision 3 points to where federal CUI rules are heading, but it is not the CMMC Level 2 baseline today. Your assessment, your score, and your SPRS posting all run on Rev. 2, so your SSP should too.
Here is the wrinkle that causes the confusion. Within NIST’s own publication catalog, Revision 3 supersedes Revision 2. But the CMMC rulestill maps Level 2 to Revision 2, and that is the reality your assessment runs on. Until DoD changes the rule through formal rulemaking, your SSP, your POA&M strategy, your control implementations, and your SPRS score should all stay aligned to Rev. 2.
You can note where you already meet Rev. 3 conventions for future-proofing, but do not build your assessment package around a standard the assessment does not use. We re-check this against 32 CFR Part 170 and NIST’s CSRC publication pages quarterly, because it is exactly the kind of fact that will change—just not yet.
Do you need one SSP or several?
You need one or multiple SSPs based on your system boundaries, CUI flow, and CAGE-code structure—not your company’s headcount. One coherent CUI environment usually means one SSP; multiple distinct environments, business units, or enclaves often warrant separate SSPs or clearly segmented sections. The deciding factor is whether the systems share a boundary, a security stack, and an evidence owner.
One SSP is usually enough when you have a single legal entity, one CUI enclave, one coherent boundary, the same identity and security tooling, and the same policies and evidence owners across the board.
Lean toward multiple SSPs (or clearly separated sections within one) when different CAGE codes map to different systems, CUI lives in separate business units, one part of the company runs a controlled enclave and another does not, or a subsidiary has materially different controls.
A quick gut check: if you are isolating a clean, defensible scope so your assessment is smaller and simpler, separate documentation often helps. And remember—if an “out-of-scope” system actually touches CUI or protects CUI systems, it is not out of scope, and no amount of paperwork changes that.
Protect your SSP—it is a sensitive document
Your SSP contains a roadmap of your security architecture, access paths, and defenses, so treat it as sensitive: share only what a prime, contract, or authorized reviewer actually needs, and use appropriate channels and terms when you do. This is operational risk guidance, not legal advice—but it is the kind of thing people forget until it matters.
On evidence handling, the CMMC Assessment Process requires artifact integrity and retention: the organization must retain the hashed artifacts used as evidence for six years from the CMMC Status Date (32 CFR §170.17), and proprietary-information return or destruction is governed by your assessment agreement and any non-disclosure agreement—so settle those terms before evidence changes hands.
On the SSP specifically, the Level 2 Scoping Guidance states that the assessor will not retain a copy of your SSP, which is reassuring if you have been nervous about where your architecture details end up. None of that changes the basics: do not publish your SSP, do not email full architecture details casually, keep version history so you always know exactly what was shared, and when a prime requests the full document, loop in contracts or legal and consider a sanitized summary for situations that do not require the complete plan.
Free template, GRC software, RPO, MSP, enclave, or C3PAO—who do you actually need?
Use the free template when your environment is simple and someone qualified can document the truth. Use GRC software to manage evidence and updates, an RPO or vCISO for readiness and scope judgment, an MSP/MSSP when controls are not implemented or operated well, and an enclave provider when shrinking your CUI footprint is the real problem. Bring in a C3PAO only when you are ready for the formal assessment. Matching the help to the actual gap is how you avoid paying for the wrong thing.
| Your situation | Best-fit category | Not the right fit |
|---|---|---|
| You know your scope and need a structured document | Free template + an internal owner | A C3PAO assessment |
| Many owners, evidence files, tasks, and due dates to manage | GRC / compliance software | A blank document alone |
| You are not sure your scope is right | RPO, vCISO, readiness consultant | A C3PAO acting as your implementation advisor for the same future assessment |
| Controls are not implemented or monitored | MSP / MSSP / managed compliance | A documentation-only consultant |
| CUI is scattered across email, file shares, and laptops | CUI enclave / secure collaboration strategy | Writing a bigger SSP around a messy scope |
| Controls are implemented and you need certification | An authorized C3PAO | A readiness provider implying it can certify you |
One independence point worth stating plainly: the firm that helps you get ready generally cannot also be the C3PAO that assesses you for the same effort. The Cyber AB’s Code of Professional Conduct prohibits an assessor from participating in a Level 2 certification assessment for an organization where they served as a consultant preparing that organization for any CMMC assessment within the prior three years, and that prohibition applies to the C3PAO as an organization and to every member of its assessment team. Keep readiness and remediation in one lane and formal assessment in another.
Compare CMMC readiness provider categories
See how RPOs, managed compliance providers, enclave specialists, and GRC platforms differ—what each does, what to ask before you hire, and which fits the gap you actually have.
See provider categories →Common CMMC SSP mistakes that cause assessment findings
The SSP problems that generate findings are predictable: an inaccurate CUI boundary, boilerplate that does not describe your real environment, a mismatch between the SSP and what the assessor observes, missing External Service Provider documentation, building to the wrong NIST revision, and no defined update cadence. Every one of them is avoidable if you map your plan to the eight assessment objectives and keep it honest to your environment.
- Boundary errors. Too narrow leaves gaps; too broad inflates your cost and assessment surface. An incomplete or inaccurate CUI boundary is one of the most common reasons contractors struggle at a Level 2 assessment.
- Boilerplate narratives.A plan that could describe any company describes none. Assessors read for specificity—your tools, your configuration, your owners.
- SSP-versus-reality drift. The assessor compares your written plan to what they observe and test. Daylight between the two is a finding, every time.
- Missing ESP or shared-responsibility documentation. If a cloud or managed provider is in your boundary, you need to document the relationship and who owns which control objective. “The cloud handles it” is not an answer.
- Building to Rev. 3. As covered above, your assessment runs on Rev. 2. Documenting to Rev. 3 means gaps in the version the assessor actually uses.
- No update cadence. Objectives [g] and [h] require a defined review frequency and evidence you follow it. A document last touched two years ago tells the assessor your program is not maintained.
CMMC SSP template FAQ
Is there a free CMMC SSP template?
Yes. NIST publishes a free CUI System Security Plan template as supplemental material to SP 800-171 Rev. 2, and it is a solid base. For CMMC Level 2, add the CMMC-specific layer—assessment scope, the five asset categories, 800-171A objective coverage, External Service Provider documentation, SPRS metadata, and POA&M linkage—which is what the completion crosswalk on this page maps out.
Is the NIST 800-171 SSP template enough for CMMC?
Not by itself. It is a useful starting point, but it predates the CMMC program and does not force you through CMMC scoping, asset categorization, objective-level evidence mapping, or the POA&M rules. Treat it as the skeleton and add the CMMC-specific muscle.
Can the SSP be placed on a CMMC POA&M?
No. For CMMC Level 2, the SSP requirement (CA.L2-3.12.4) is one of six requirements excluded from POA&M eligibility under 32 CFR §170.21. And under 32 CFR §170.24, without an up-to-date SSP at the time of assessment, the assessment cannot be completed.
Does CMMC Level 2 use NIST SP 800-171 Rev. 2 or Rev. 3?
Revision 2. CMMC Level 2 is anchored to NIST SP 800-171 Rev. 2 (110 requirements, 14 families) under 32 CFR Part 170. Rev. 3 exists but is not the CMMC baseline; build your assessment SSP to Rev. 2 unless DoD amends the rule.
What is CA.L2-3.12.4?
It is the CMMC Level 2 security-planning requirement to develop, document, and periodically update your System Security Plan. The CMMC Assessment Guide lists eight objectives for it: that a plan exists and that it documents the boundary, environment, non-applicable requirements, implementation method, connections, update frequency, and actual updates.
Can the SSP be a collection of documents?
Yes. NIST and the CMMC Assessment Guide allow the SSP to be a set of documents and to reference your existing policies, procedures, and design documents. The information just has to be accurate, maintained, and usable for an assessment.
How often should the SSP be updated?
At your defined frequency — typically at least annually — and whenever your scope, controls, assets, or providers change materially. The assessment objectives require both that you define the cadence and that you actually follow it.
Does a C3PAO write my SSP?
No. A C3PAO reviews the SSP as part of the assessment, but under the Cyber AB's Code of Professional Conduct, a firm that consulted to prepare you for a CMMC assessment cannot participate in your Level 2 certification assessment for three years. Use readiness help before the assessment; bring in a C3PAO when you are assessment-ready.
Does having an SSP mean I am compliant?
No. The SSP documents how you meet (or plan to meet) the requirements. Compliance still depends on implemented controls, real evidence, accurate scope, your assessment result, and the required affirmations.
Does CMMC Level 1 require an SSP?
Level 1 covers the 15 basic safeguards from FAR 52.204-21 for FCI and does not include the formal SSP requirement, which lives at Level 2 and Level 3. A lightweight plan can still help you organize responsibilities, but you do not need a full Level 2 SSP unless CUI or your contract makes Level 2 apply. See our CMMC Level 1 self-assessment checklist for the Level 1 requirements.
Why now: where CMMC stands today
CMMC stopped being a “someday” program. The CMMC Program Rule (32 CFR Part 170) took effect , and the implementing acquisition rule that puts DFARS 252.204-7021 into contracts took effect .
We are now in Phase 1 of the phased rollout, which runs from through . During Phase 1, DoD program offices may include CMMC Level 1 or Level 2 self-assessment requirements in applicable solicitations and contracts as a condition of award, and may require a Level 2 C3PAO assessment at their discretion. Phase 2—when Level 2 C3PAO certification becomes the standard requirement at award—begins .
If a prime is already asking for your documentation, that is Phase 1 working exactly as designed—and your SSP is the document everything else hangs on. Your annual affirmation, your SPRS score, your CMMC Level 2 checklist—none of it sits solidly without an SSP that accurately describes the environment underneath.
What we actually verified for this page
We built this page from primary sources, not secondhand summaries. As of , we confirmed:
- CMMC Level 2 maps to NIST SP 800-171 Revision 2 (110 requirements, 14 control families) under 32 CFR Part 170 —checked against eCFR and NIST CSRC.
- The eight assessment objectives and minimum SSP contents for CA.L2-3.12.4, pulled from the DoD CIO CMMC Level 2 Assessment Guide.
- That the SSP requirement is one of six requirements excluded from POA&M eligibility under 32 CFR §170.21, and that §170.24 states an assessment “could not be completed” without an up-to-date SSP.
- The five CMMC asset categories in the CMMC Level 2 Scoping Guide and 32 CFR §170.19.
- The DFARS 252.204-7019/-7020 reporting fields, and that NIST publishes a free CUI SSP template while stating there is no prescribed format.
- The Cyber AB Code of Professional Conduct three-year consulting/assessment conflict rule, and the six-year evidence-artifact retention requirement (32 CFR §170.17).
- The Phase 1 timeline and that DFARS 252.204-7021 took effect , with 32 CFR Part 170 effective .
Your next step
You came for a template. You are leaving with the template, a map of exactly what an assessor checks, and the one rule that decides whether your assessment can even be completed. That is the part most contractors do not find until it is expensive.
If your environment is simple and your team is comfortable with NIST 800-171, take the NIST template and the crosswalk above and go—you have got this. If your CUI is scattered, your scope is murky, or your controls are not really in place yet, the smartest move is not a better document. It is the right help, before you spend money on an assessment you are not ready for.
Need help deciding what type of CMMC provider you need?
Tell us your level, scope, and timeline, and we’ll match you with source-checked CMMC provider options. No guesswork, no pressure—a clear next step toward the right category for your situation.
Get matched →