How Do I Write a System Security Plan for DFARS?

Your Defense Department contract includes the cyber clause. Now you must prove your systems are protected. That proof is the System Security Plan, or SSP.

What the rule requires

This clause is DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. It requires covered systems to meet the security requirements in NIST SP 800-171. (DFARS 252.204-7012)

NIST SP 800-171 is the standard for protecting Controlled Unclassified Information, or CUI, in nonfederal systems. Requirement 3.12.4 calls for a documented system security plan. (NIST SP 800-171 Rev. 2)

The plan must describe system boundaries and the environment of operation. It must explain how each security requirement is implemented. It must show connections to other systems. (NIST SP 800-171 Rev. 2)

NIST says there is no prescribed format for the plan. Content matters more than the template. (NIST SP 800-171 Rev. 2)

Under the CMMC rule, a missing or out-of-date SSP means the assessment cannot be completed. CMMC stands for Cybersecurity Maturity Model Certification. (32 CFR 170.24)

What goes inside the plan

NIST SP 800-18 Rev. 2 is the current guide for writing security plans. It says a plan describes the purpose of the system. It describes the status of the controls chosen to manage risk. It names the responsibilities of everyone who uses the system. (NIST SP 800-18 Rev. 2)

For a DFARS plan, build these parts.

Start with the system description. Name the system and draw its boundary. List every server, laptop, and cloud service that touches CUI.

Next, the environment of operation. Say where the system runs and who uses it. State what data it holds.

Then build the requirement table. Work through all 110 requirements in NIST SP 800-171 Rev. 2. Record the status of each one. Explain how each one is implemented. (DFARS 252.204-7020)

Add roles and contacts. Name the system owner. List who runs each security task.

Document every connection. Name every system the plan depends on. Include cloud providers and subcontractor systems.

Finish with the remediation plan. Link every unmet requirement to a dated fix. POA&M stands for Plan of Action and Milestones.

How to write a requirement response

Assessors read the requirement table first. Each row must answer three questions: what the requirement asks, how you meet it, and where the proof lives.

Here is a weak example. Requirement: protect CUI with encryption. Response: encryption is enabled. This fails because it names no tool, no setting, and no owner.

Here is a strong example. Requirement 3.5.3 calls for multifactor authentication on network access. MFA stands for multifactor authentication. Response: MFA is enforced for all remote access. The VPN gateway blocks logins without a second factor. VPN stands for virtual private network. The system administrator reviews enrollments each month. (NIST SP 800-171 Rev. 2)

One more example. Requirement 3.13.11 calls for FIPS-validated cryptography to protect CUI. FIPS stands for Federal Information Processing Standard. Response: laptops use BitLocker with AES-256 encryption. AES stands for Advanced Encryption Standard. The module is FIPS 140 validated. Recovery keys are stored in the company safe. (NIST SP 800-171 Rev. 2)

Notice the pattern. Name the tool. Name the setting. Name the person. Point to the proof.

How to document inherited controls

Many small contractors run email and file storage in the cloud. Some controls are then met by the provider. Mark these as inherited in the plan.

The DFARS clause allows an external cloud provider for CUI work. The provider must meet requirements equal to the FedRAMP Moderate baseline. FedRAMP is the Federal Risk and Authorization Management Program. (DFARS 252.204-7012)

Example: your company email runs in Microsoft 365. Microsoft handles the data center locks and cameras. You handle account setup, password rules, and file sharing settings.

For each inherited control, name the provider and describe what it does. Keep the provider's security documentation on file. State clearly what you configured yourself. Assessors look for a clean split of responsibility.

The order of work

Write the plan in this order.

Find your CUI. Walk every file share, laptop, inbox, and cloud app. List where CUI lives.

Draw the boundary. Put everything that touches CUI inside the line. Leave everything else out.

Fill the requirement table. Work through every requirement. Record how each one is met or not met.

Write the POA&M. Every gap gets an entry. Each entry gets an owner and a date.

Assemble the document. Description first. Then the requirement table. Then the remediation plan.

Sign it. Review the plan with the system owner. A plan with no owner is still a draft.

Keep the plan alive

A SAR is a Security Assessment Report. PolicyCortex collects evidence from live Azure configuration and generates SSP, SAR, and POA&M output at https://policycortex.com.

Sources

• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024). Defense Federal Acquisition Regulation Supplement, Acquisition.gov. https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.
• DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements. Defense Federal Acquisition Regulation Supplement, Acquisition.gov. https://www.acquisition.gov/dfars/252.204-7020-nist-sp-800-171dod-assessment-requirements.
• NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (February 2020, includes updates as of January 28, 2021). National Institute of Standards and Technology. https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
• NIST SP 800-18 Rev. 2, Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems (June 2026). National Institute of Standards and Technology. https://csrc.nist.gov/pubs/sp/800/18/r2/final
• 32 CFR 170.24, CMMC scoring methodology. https://www.govregs.com/regulations/title32_chapterI_part170_subpartD_section170.24