Every CMMC Level 1 contractor needs a System Security Plan. Not because the rule literally says so, but because every prime, every government program office, and every assessor will ask for one. The SSP is your single source of truth: how your company implements each of the 15 FAR 52.204-21 safeguarding requirements, who is responsible, and where the evidence lives.
What an SSP actually is
An SSP is a short document — for Level 1, typically 3 to 6 pages — that describes how your company implements each control. It is not a policy document. Policies describe what your company requires. The SSP describes what your company does in operational terms.
- A policy says: “All users must authenticate with MFA.”
- An SSP says: “MFA is enforced on M365 via Conditional Access. The IT admin reviews exception requests monthly. Evidence: the Conditional Access policy export saved in /compliance/2026/.”
The required structure
The Custodia template includes:
- Cover page — company name, CAGE/UEI, system owner, affirming official, version, dates.
- System description — what the system does, who uses it, what FCI it handles. Two paragraphs.
- Boundary & scope summary — references your scoping worksheet.
- Control-by-control implementation — one section per requirement. Prompt: How does your organization implement this? Who is responsible? Where is the evidence?
- Attestation block — signature, title, date.
How to fill it out (in 60 minutes)
- Block 60 uninterrupted minutes. Have your scoping worksheet and policy pack open.
- Fill the cover page first. Three minutes.
- For each of the 15 controls, write 2–4 sentences answering: what we do, who's responsible, where the evidence lives.
- Reference your policies and inventory. Don't repeat them — cite the document and the file path.
- Sign and date. Save the PDF in a folder you can find under pressure.
Common mistakes
- Writing aspirational descriptions. The SSP describes what you actually do, not what you wish you did.
- Pasting policy language verbatim. Auditors recognize this immediately. It signals the SSP isn't operational.
- Forgetting evidence pointers. Every control implementation should say where the proof lives.
- Skipping the annual review. A 2-year-old SSP is treated as stale.
Get the free template
The Custodia SSP template is here, free, printable, no email gate: Open the SSP template →
Or follow the full DIY path: The Free DIY CMMC Level 1 Handbook.
FAQ
Is an SSP required for CMMC Level 1?
Yes. While the FAR clause itself doesn't use the word 'SSP,' 32 CFR Part 170 and DoD assessment guidance treat the SSP as the canonical evidence artifact for Level 1. Primes routinely request it as part of subcontract flow-down. Practically: if you don't have an SSP and a prime asks, you fail their gate.
How long does the SSP need to be?
For Level 1, 3–6 pages is normal. Two to four sentences per control, plus a cover page describing your scope. Longer is not better — auditors and primes want to find the answer to 'how do you implement AC.L1-3.1.1?' in 30 seconds.
Who signs the SSP?
The affirming official — the same person who will sign your SPRS attestation. This is the owner, CEO, or formally delegated CIO. Not an external consultant, not your MSP, not a junior staffer.
Does it need to be updated?
Yes — at minimum once a year before your annual affirmation, and whenever scope changes materially (new in-scope cloud app, new office, new joiner with FCI access).