What is the System Security Plan (SSP) and what does it include?

• A. A checklist of vulnerabilities and risk scores.
• B. A formal risk acceptance document approved by senior management.
• C. The central document describing the system, its boundary, the selected controls, responsibilities, and implementation status.
• D. A catalog of all user accounts and access permissions.

Answer: (C)

The main idea being tested is what the System Security Plan is and what it contains. An SSP is the master, formal document that lays out the security framework for a system. It describes what the system is and where its boundaries lie, which security controls have been selected to protect it, who is responsible for implementing and maintaining those controls, and the current status of their implementation. It’s the blueprint used for obtaining authorization to operate and for ongoing security management, including updates as the system evolves.

This isn’t just a vulnerability checklist or a risk-scoring document, nor is it a roster of every user account. A vulnerability list focuses on weaknesses, a risk acceptance document records management’s decision to tolerate risk at a given level, and a catalog of user accounts inventories access permissions. The SSP brings all of the security planning together in one formal plan that guides how the system is protected and how its security posture is maintained over time.