What this requirement asks
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
This is a CMMC Level 2 requirement in the Security Assessment family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (8)
- 3.12.4[a] — a system security plan is developed
- 3.12.4[b] — the system boundary is described and documented in the system security plan
- 3.12.4[c] — the system environment of operation is described and documented in the system security plan
- 3.12.4[d] — the security requirements identified and approved by the designated authority as non-applicable are identified
- 3.12.4[e] — the method of security requirement implementation is described and documented in the system security plan
- 3.12.4[f] — the relationship with or connection to other systems is described and documented in the system security plan
- 3.12.4[g] — the frequency to update the system security plan is defined
- 3.12.4[h] — system security plan is updated with the defined frequency
What an assessor examines
Examine:
- Security planning policy
- procedures addressing system security plan development and implementation
- procedures addressing system security plan reviews and updates
- enterprise architecture documentation
- system security plan
- records of system security plan reviews and updates
- other relevant documents or records
Interview:
- Personnel with security planning and system security plan implementation responsibilities
- personnel with information security responsibilities
Test:
- Organizational processes for system security plan development, review, update, and approval
- mechanisms supporting the system security plan
Evidence that defends it
Show updates and status changes
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.