NIST 800-171 System Security Plan
Keep your security plan connected with the systems you operate
A system security plan should explain how your organisation protects the environment handling CUI. Its value depends on whether the documented boundary, responsibilities and implementation descriptions reflect current operations.
SecureX7 supports the technical investigation and evidence behind that documentation. Use asset visibility, configuration findings and reassessment results to help your team validate implementation statements and identify where further work is needed.
Establish the purpose and scope of the plan
The plan should describe the system boundary, operating environment and how security requirements are implemented. It should also explain relevant relationships and connections with other systems. Assign responsibility for maintaining and approving the document.
Describe the environment clearly
Identify the business activity supported by the system and the CUI it handles. Describe relevant information flows, locations, system components and connections. Include services used to administer and protect the environment.
Record the people and organisations responsible for implementation. Where a provider supplies part of a security capability, explain the division of responsibility and identify the evidence supporting that arrangement.
SX7 discovery and classification can help your team investigate the technical estate. Compare the findings with the approved boundary and resolve discrepancies before updating the plan.
Explain how requirements are implemented
An implementation description should tell a reviewer what happens, where it happens and who is responsible. Refer to supporting procedures and evidence so that the statement can be assessed.
For a configuration requirement, describe the approved baseline, deployment approach and method used to identify deviations. SX7 assessment results can support the technical part of that description for the systems and settings covered.
Document the current state accurately. If implementation is incomplete, identify the gap and manage the required action through the applicable remediation process.
Use findings to test the accuracy of the plan
The owner investigates whether this reflects an approved variation, an undocumented change or an implementation weakness. That decision determines whether the configuration, supporting records or implementation description needs updating.
After remediation, reassessment supplies fresh technical evidence. The plan owner reviews whether the documentation now reflects the implemented arrangement.
Maintain the plan as the environment changes
Review the plan when applications, providers, system boundaries or protection arrangements change, and at the frequency required by your applicable criteria.
Retain version history, approval records and references to supporting evidence. Store the plan with appropriate access restrictions because it can reveal sensitive details about your environment.
SX7 provides technical information to support maintenance. Its reports do not, by themselves, constitute a complete system security plan or establish that every implementation statement is accurate.
Reduce the investigation behind your next update
Bring a technical implementation statement to an SX7 demonstration. Explore how asset information and configuration findings could help your team validate the statement and identify work still to do.