Score your SSP in 15 minutes.

Authorized users/devices

Authorized transactions and functions

Control CUI flow

Separation of duties

Least privilege

Use non-privileged accounts

Prevent non-privileged execution of privileged functions

Limit unsuccessful logon attempts

Privacy and security notices

Session lock

Automatic session termination

Monitor and control remote access sessions

Cryptographic protection for remote access

Route remote access through managed access control points

Authorize remote privileged commands and access

Authorize wireless access

Protect wireless access

Control connection of mobile devices

Encrypt CUI on mobile devices

Verify and control external connections

Limit use of portable storage on external systems

Control publicly accessible CUI

Security awareness for managers/admins/users

Role-based security training

Insider threat awareness training

Create and retain audit logs

Audit record content

Review and update auditable events

Alert on audit logging failure

Correlate audit review/analysis/reporting

Audit reduction and report generation

Time synchronization for audit records

Protect audit information and tools

Limit audit management to privileged users

Baseline configurations and inventories

Enforce security configuration settings

Change control

Security impact analysis for changes

Access restrictions for changes

Least functionality

Restrict nonessential programs/services/ports/protocols

Allow-by-exception or deny-by-exception software control

Control user-installed software

Identify users, processes, and devices

Authenticate identities

Multi-factor authentication

Partial (deduct 3): Multifactor authentication covers remote and privileged users but not general users.

Replay-resistant authentication

Prevent reuse of identifiers

Disable identifiers after inactivity

Password complexity

Password reuse limits

Temporary passwords for immediate change

Cryptographically protected passwords

Obscure authentication feedback

Incident handling capability

Track, document, and report incidents

Test incident response

Perform maintenance

Control maintenance tools, techniques, personnel

Sanitize equipment removed for off-site maintenance

Check maintenance media for malicious code

MFA for nonlocal maintenance sessions

Supervise maintenance personnel without authorization

Protect system media

Limit access to media

Sanitize or destroy media before disposal/reuse

Mark media with CUI markings

Protect media during transport

Cryptographic protection for digital media in transport

Control removable media

Prohibit portable storage with no identifiable owner

Protect backup CUI at storage locations

Screen individuals before authorizing access

Protect CUI during personnel actions

Limit physical access to systems/facilities

Protect and monitor physical access

Escort visitors and monitor visitor activity

Maintain physical access audit logs

Manage and protect physical access devices

Protect transmission lines and output devices

Periodic risk assessments

Vulnerability scanning

Remediate vulnerabilities

Periodic security assessments

Develop and implement POA&Ms

Continuous monitoring

System Security Plan (SSP)

Without an SSP there is no assessable system description, so no valid score can be produced at all.

Boundary protection

Secure architecture and engineering principles

Separate user and system management functionality

Prevent transfer via shared system resources

Public system separation/subnetworks

Deny network traffic by default; allow by exception

Prevent split tunneling

Protect CUI in transit

Terminate network connections

Cryptographic key management

FIPS-validated cryptography

Partial (deduct 3): Cryptography is used to protect CUI but the modules are not FIPS validated.

Collaborative computing device control

Control and monitor mobile code

Control and monitor VoIP

Protect communications session authenticity

Protect CUI at rest

Identify, report, and correct flaws

Malicious code protection

Security alerts and advisories

Update malicious code protection

Perform periodic and real-time scans

Monitor inbound/outbound traffic and detect attacks

Identify unauthorized system use