CMMC Level 2 System Security Plan (SSP) Template for NIST 800-171

Produce the System Security Plan a CMMC Level 2 assessor actually reads — without staring at a blank page.

NIST SP 800-171 requirement 3.12.4 makes the SSP mandatory, and a missing or incomplete one means your assessment can't even be scored. This template gives you the whole document, pre-structured, so you just fill in your environment.

Two files, one download:

System Security Plan (Word) — a fillable, professionally formatted SSP covering everything 3.12.4 requires:

- System identification, CUI handled, and where it's stored / processed / transmitted

- System environment, components, and a network architecture diagram placeholder

- System boundary and all five CMMC Level 2 asset categories (CUI, Security Protection, Contractor Risk Managed, Specialized, Out-of-Scope), with a data-flow diagram placeholder

- Interconnections and External Service Providers (cloud / MSP), with shared-responsibility prompts

- Roles & responsibilities

- All 110 NIST SP 800-171 Rev 2 requirements — exact requirement text, grouped by the 14 families, each with a status, an implementation statement, responsible role, and policy reference

- Non-applicable requirements with justification, and a POA&M section

Control Implementation Matrix (Excel) — the assessor-friendly companion: every control with an implementation-status dropdown, summary, owner, policy reference, and review date, plus a live dashboard that counts your status as you go.

Who it's for: defense contractors and subcontractors handling CUI, MSPs and consultants standing up client SSPs, and anyone preparing for a CMMC Level 2 (C3PAO) assessment or self-assessment.

Built right:

- Exact NIST SP 800-171 Rev 2 requirement text for all 110 controls

- Asset categories aligned to the CMMC Level 2 Scoping Guide and 32 CFR §170.19

- Clear blue placeholders and "how to complete" notes you delete on the way out

- Clean, consistent formatting in Word and Excel

Sources reflected inside: NIST SP 800-171 Rev 2, NIST SP 800-171A, 32 CFR Part 170, CMMC Level 2 Scoping Guide (DoD CIO), DFARS 252.204-7012.

Tool, not legal advice. Completing this template does not by itself establish compliance or certification; CMMC determinations rest with the DoD, DIBCAC, and authorized C3PAOs.

You'll get a .docx (System Security Plan) and an .xlsx (Control Implementation Matrix).