Level 1 and the SSP
FAR 52.204-21 does not itself require an SSP. But documenting how each of the 15 Level 1 requirements is met makes the annual affirmation defensible, and gives you a record to show if asked.
SSP template outline
- System identification and owner — system name, owner, and points of contact.
- Boundary and diagram — the authorization boundary and a network diagram.
- CUI flow — where CUI enters, is processed, stored and leaves.
- Asset inventory by category — CUI, Security Protection, Contractor Risk Managed, Specialized and Out-of-Scope assets.
- External service providers and inherited requirements — who provides what, and which requirements you inherit.
- Requirement-by-requirement implementation statements — for all 110 requirements.
- Related policies and procedures — referenced by name and version.
- Revision history — dates, changes and approvers.
Where the SSP fits
The SSP is step 2 of the CMMC compliance checklist. Gaps it reveals feed the POA&M, except 3.12.4 itself, which must be met.