Building Your CMMC System Security Plan Without Producing a Doorstop

The system security plan is the document that describes your environment and says, control by control, what you do about each of the 110 requirements in NIST SP 800-171. It is the backbone of everything else, and most of the ones we see are unusable.

The usual failure is length. A consultant produces two hundred pages, it is filed, and it is never updated. A system security plan that does not match your environment is worse than none, because it is a written record of things you claimed and did not do.

What it actually has to cover

The boundary. Which systems, which people, which locations handle controlled unclassified information. Getting the boundary small is the single highest leverage decision available to you. Everything inside it inherits every requirement. Firms that segment properly do a fraction of the work of firms that treat the whole company as in scope.

A system description. What the environment is, in enough detail that a stranger could follow it.

Each of the 110 controls, addressed individually. Implemented, how, and by what. Not implemented, and what the plan is. This is the part people try to shortcut with templates, and it is the part that has to be specific to you.

Roles. Who is responsible for what, by name.

Connections to other systems. Cloud services, your IT provider, anything with a route in.

The plan of action that goes with it

Controls you have not met belong in a plan of action and milestones, with dates. That is a legitimate document, not an admission of failure. What is not legitimate is a system security plan claiming full implementation while the underlying reality is different, because that document becomes the evidence in any later dispute about what you asserted.

How to keep it alive

Write it shorter than you think you should. Put a review date on it. Update it when you change a system rather than annually, because annually means never.

Under the September 2026 class deviation you are self attesting rather than being assessed, which makes the plan more important rather than less. It is now the primary record of your own position, written by you, with nobody else signature on it.