System Security Plan R3 (SSP)

The System Security Plan (SSP) is a foundational document for safeguarding Controlled Unclassified Information (CUI).  It details the system's environment, security controls implemented, and operational procedures. This plan aims to mitigate risks and ensure confidentiality, integrity, and availability of data. The SSP documents how organizations comply with relevant security standards and regulations, providing a roadmap for maintaining a robust security framework. It serves as a living document, requiring regular review and updates to reflect evolving threats and system changes. Effective SSPs are crucial for safeguarding sensitive information and maintaining operational resilience.

1. Has the company defined what kinds of CUI it is capable of handling? Where and how do these CUI originate? Where do we keep CUI once they are in our control?

2. Have we defined the levels of responsibility and accountability throughout the process of handling a CUI?

3. Do we know of all the possible risks that exist for the current locations where CUI is stored?  Have we put processes in place to mitigate these risks?  How do we monitor the effectiveness of these processes?

4. Have we fully identified those that are permitted to access CUI?  If so, how do we maintain this information?

5. Can we prove that there has been no compromise in CUI? How?  What do we do in the event there has been a compromise?

1. "Has the company defined what kinds of CUI it is capable of handling? Where and how do these CUI originate? Where do we keep CUI once they are in our control?"

   • ITAR:
     • This is critical for ITAR compliance. Companies must identify if they handle technical data on the United States Munitions List (USML). This involves classifying information accurately.
     • Knowing the origin (e.g., customer specifications, internal R&D) helps establish the scope of ITAR controls.
     • Storage locations (servers, cloud environments, physical media) must be secured according to ITAR's stringent requirements.
        
   • NIST SP 800-171 Rev. 3:
     • NIST SP 800-171 requires organizations to document the types of CUI they handle. This aligns with the "identify" function of the NIST Cybersecurity Framework.
     • Understanding the flow of CUI (origin to storage) is essential for implementing appropriate security controls.
     • The SSP must detail where CUI is stored, processed, and transmitted, and how those locations meet the security requirements of the publication.
        
   • References:
     • ITAR: 22 CFR Parts 120-130 (specifically, definitions of "technical data" and the USML).
     • NIST SP 800-171 Rev. 3: Section 3.1 "System Security Plan" and the requirement to define the scope of CUI.

2. "Have we defined the levels of responsibility and accountability throughout the process of handling a CUI?"

   • ITAR:
     • ITAR mandates clear roles and responsibilities for export control. This includes Empowered Officials who have the authority to oversee compliance.
     • Accountability is crucial for demonstrating due diligence and preventing unauthorized disclosures.
        
   • NIST SP 800-171 Rev. 3:
     • NIST SP 800-171 emphasizes assigning roles and responsibilities for security controls.
     • Accountability ensures that individuals are responsible for protecting CUI.
     • Rev 3 has increased the importance of organizational governance, and therefore accountability.
        
   • References:
     • ITAR: 22 CFR 120.25 (Empowered Official).
     • NIST SP 800-171 Rev. 3: Section 3.1 and the security requirements related to access control and personnel security.

3. "Do we know of all the possible risks that exist for the current locations where CUI is stored? Have we put processes in place to mitigate these risks? How do we monitor the effectiveness of these processes?"

   • ITAR:
     • ITAR requires a robust risk assessment to identify vulnerabilities that could lead to unauthorized exports.
     • Mitigation involves implementing security controls (e.g., access controls, encryption, physical security).
     • Monitoring is essential for detecting and responding to security incidents.
        
   • NIST SP 800-171 Rev. 3:
     • Risk assessments are a fundamental requirement of NIST SP 800-171.
     • Organizations must implement security controls to mitigate identified risks.
     • Continuous monitoring is crucial for ensuring the effectiveness of security controls.
     • Rev 3 has increased the detail and requirements around risk assessments.
        
   • References:
     • ITAR: Risk management principles within export control compliance programs.
     • NIST SP 800-171 Rev. 3: Section 3.1, security requirement 3.12.1 "Risk Assessment," and 3.12.4 "Security Monitoring."

4. "Have we fully identified those that are permitted to access CUI? If so, how do we maintain this information?"

   • ITAR:
     • ITAR mandates strict access controls to prevent unauthorized access to technical data.
     • Organizations must maintain records of authorized personnel and their access privileges.
     • "US persons" requirements are extremely important within ITAR.
        
   • NIST SP 800-171 Rev. 3:
     • Access control is a core requirement of NIST SP 800-171.
     • Organizations must implement least privilege principles and maintain access control lists.
     • Rev 3 strengthens multi factor authentication requirements.
        
   • References:
     • ITAR: 22 CFR 126.18 (Access by foreign persons).
     • NIST SP 800-171 Rev. 3: Section 3.1, security requirements related to access control (e.g., 3.5.1, 3.5.2, 3.5.3).

5. "Can we prove that there has been no compromise in CUI? How? What do we do in the event there has been a compromise?"

   • ITAR:
     • ITAR requires organizations to report unauthorized disclosures of technical data.
     • Incident response plans are essential for containing and mitigating the impact of compromises.
     • Auditing and logging are very important.
        
   • NIST SP 800-171 Rev. 3:
     • Incident response is a key requirement of NIST SP 800-171.
     • Organizations must have the ability to detect, respond to, and recover from security incidents.
     • Rev 3 has increased requirements around incident response, and supply chain incident reporting.
        
   • References:
     • ITAR: 22 CFR 127.12 (Voluntary disclosures).
     • NIST SP 800-171 Rev. 3: Section 3.1, security requirements related to incident response (e.g., 3.6.1, 3.6.2).