NIST 800-171 Controls · Security Assessment
CA.2.004 — Develop and Maintain System Security Plans
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
What CA.2.004 means in plain English
Your System Security Plan (SSP) is the master document that describes your entire security setup. It covers what systems you have, how they are connected, where CUI flows, and how you handle each of the 110 security controls. Think of it as the blueprint for your security program. A C3PAO assessor will read your SSP first — it is literally the map they follow. Keep it updated whenever you add a new system, change a network, or modify a security practice.
The assessment question
“Do you have a current System Security Plan (SSP) that accurately describes your system boundaries, network architecture, CUI data flows, and how each NIST SP 800-171 control is implemented, and is it reviewed and updated at least annually?”
How to implement CA.2.004
- Download the NIST SP 800-171 SSP template from NIST or use the DoD-provided template. Fill in each section: system description, system boundary, network diagram, CUI flow description, and control-by-control implementation details.
- Create a network diagram showing all devices that touch CUI: workstations, servers, firewalls, routers, cloud services. Draw.io (free) works well for this. Include IP addresses or subnet ranges.
- For each of the 110 controls, write 2-3 sentences describing exactly how your organization implements it. Be specific — "We use BitLocker on all Windows workstations" not "Encryption is used."
- Set a calendar reminder to review the SSP at least annually and after any significant system change (new server, new cloud service, office move, network redesign).
- Store the SSP in a controlled location with limited access. It contains sensitive details about your security — treat it as CUI itself.
Evidence your assessor will ask for
- Current System Security Plan document covering all 110 NIST SP 800-171 controls
- Network architecture diagram showing system boundaries and CUI data flows
- Evidence the SSP was reviewed and updated within the past 12 months (revision history or review date)
- System inventory referenced in the SSP matching actual deployed systems
- SSP stored in a controlled location with limited access
Does AI prompt monitoring help with this control? Honestly, no.
CA.2.004 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Security Assessment controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.