Written and maintained by CASRAI Editorial Board
Last updated
A system security plan (SSP) is the document in which a system owner records what the system is, what it must protect, which security controls are in place or planned, and who is responsible for them. There is no single universal SSP template: which template you use depends on the rule that requires the plan. This guide sets out what the current NIST guidance says, how FedRAMP’s SSP expectations differ, and where university research systems handling controlled information fit. Facts below are as described on the official NIST and FedRAMP pages listed under Sources, checked on 2026-10-29.
What a system security plan is and which rules require one
NIST describes the plan as an overview of the security requirements of the system that describes the controls in place or planned and the responsibilities of the people who access it. Under the withdrawn NIST SP 800-18 Revision 1, federal systems must document their protection in a system security plan, citing OMB Circular A-130 and FISMA. For the compliance background, see the CASRAI guide to FISMA compliance.
Currency note. NIST SP 800-18 Revision 1 (February 2006) was withdrawn on June 30, 2026 and superseded by Revision 2, titled “Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems.” Many templates and articles still cite the 2006 document.
Which template applies: NIST 800-18, FedRAMP or an agency SSP
The table compares the formats described on the official pages.
| Source | What it says about format | Where it applies |
|---|---|---|
| NIST SP 800-18 Rev. 2 | Identifies the essential elements of system plans and ships a “Security Plan Example Outline” as a downloadable document, alongside privacy and C-SCRM plan outlines and a roles-and-responsibilities document. | Security, privacy and cybersecurity supply chain risk management plans for systems |
| NIST SP 800-18 Rev. 1 (withdrawn) | Agencies may structure and format the plan provided the major sections are adequately covered and readily identifiable. | Historical reference for federal system plans |
| FedRAMP legacy SSP page | A single SSP template that must be used for each baseline: Li-SaaS, Low, Moderate and High. Cloud service providers must use the template that matches the offering’s impact level. | Cloud service providers seeking FedRAMP authorization under the legacy process |
| FedRAMP agency SSP page | Create one SSP for the agency information system. The page names no template or format. | Agencies using a FedRAMP Certified cloud service |
The FedRAMP legacy page states that FedRAMP is actively transitioning away from those processes and materials, so treat the legacy template description as legacy content as described on 2026-10-29.
What the plan must contain
NIST system plans
NIST’s Revision 2 page says the plans describe the purpose of the system, the operational status of the selected controls, and the responsibilities of the people who manage, support or access the system. Revision 1 added that the plan should reflect input from the information owners, the system owner and the senior agency information security officer.
FedRAMP legacy template
The legacy template has an Appendix A control template for each impact level and Appendices A through Q, of which seven (A, F, G, J, M, O and Q) must be submitted in the FedRAMP-provided template. Attachment filenames are listed in SSP Table 12.1, and external documents are uploaded to a secure repository with the SSP package. Sensitive documents can be provided upon request for audits and assessments.
Agency SSP under FedRAMP’s 2026 page
The plan must identify the authorized use, users, information and system boundary; the certified offering and features used; selected and tailored controls including organization-defined parameters; agency configuration, integrations, training and procedures; the provider capabilities relied on; and agency common controls and outside dependencies. It must include every control selected for the agency system. For each control, record whether the agency implements it, uses a provider capability, relies on a provider capability without configuring it, inherits an agency common control, or has tailored it out. The agency should explain how it uses the certified service and should not repeat the provider’s evidence.
Steps to build the plan
- Decide which requirement drives the plan (federal system, FedRAMP, or a contract clause) and take the template that rule names. If none is named, start from the NIST Rev. 2 example outline.
- Describe the system’s purpose and draw its boundary, including the information it handles and who uses it.
- Select the controls and record each one’s status. For cloud-based systems under the FedRAMP agency page, record whether it is implemented by the agency, uses a provider capability, relies on one without configuring it, is inherited from an agency common control, or is tailored out.
- Assign responsibilities to the people who manage, support and access the system.
- Gather input from the system owner, information owners and the security officer, as Revision 1 describes.
Typical timeline phases
The sources give no durations, so no calendar estimates are made here. The phases that follow from the sources are: scoping the system and its boundary; selecting and tailoring controls; documenting control status and responsibilities; review by the owners named above; and updating the plan as the system and controls change.
Common mistakes
- Citing the withdrawn guide. Using SP 800-18 Rev. 1 as the current reference after its June 30, 2026 withdrawal.
- Using the wrong FedRAMP template. The legacy page requires the template that corresponds to the offering’s impact level.
- Repeating provider evidence. The agency SSP page says to explain the use of the certified service, not to restate the provider’s evidence.
- Leaving controls unaccounted for. The agency page asks for every selected control, each with a recorded status.
Related plans
| Plan | What the NIST Rev. 2 page says |
|---|---|
| Security plan | One of the plans collectively referred to as system plans; a Security Plan Example Outline is supplied. |
| Privacy plan | One of the system plans; an outline is supplied. |
| Cybersecurity supply chain risk management (C-SCRM) plan | One of the system plans; an outline is supplied. |
For related CASRAI guides, see NIST SP 800-53 Rev. 5 and authority to operate. Research universities handling controlled unclassified information can start with NIST 800-171 for university research and the CMMC Level 2 assessment. A different kind of plan, for research data, is covered in data management plan template and structure.
FAQ
Is there one official system security plan template?
No. NIST supplies an example outline and said in Revision 1 that agencies may format the plan provided the major sections are covered. FedRAMP’s legacy process mandates its own template per baseline, while its 2026 agency page names no format.
Is NIST SP 800-18 still current?
Revision 1 was withdrawn on June 30, 2026. Revision 2, covering security, privacy and C-SCRM plans, replaces it.
Does an agency need a separate SSP when using a FedRAMP-certified cloud service?
The FedRAMP agency page says to create one SSP for the agency information system and to explain how the certified service is used.
Sources
- NIST SP 800-18 Rev. 2, csrc.nist.gov/pubs/sp/800/18/r2/final, checked 2026-10-29.
- NIST SP 800-18 Rev. 1 (withdrawn), csrc.nist.gov/pubs/sp/800/18/r1/final, checked 2026-10-29.
- FedRAMP legacy SSP page, fedramp.gov/legacy/playbook/csp/authorization/ssp, checked 2026-10-29.
- FedRAMP agency SSP page, fedramp.gov/2026/agencies/use/initial/ssp, checked 2026-10-29.
