System Security Plan, policy and POA&M for defense construction contractors
An SSP that covers sites that do not exist yet.
A construction contractor's SSP has to describe an office that stays put and jobsites that come and go. We write the plan, the policies and the POA&M for both, against how your projects actually run. Capital Cyber, based in Leesburg, Virginia, provides System Security Plan, policy and POA&M for defense construction contractors and works on-site across Northern Virginia.
For construction contractors who need an SSP and policy set that reach the jobsite, not just the office.
How does an SSP describe a temporary jobsite?
As a standard pattern rather than a one-off. The plan describes what every jobsite looks like when it handles CUI: the network connection, the approved devices, where printed sets are stored, who can enter the trailer, and how the site is closed out. Each active project is then listed against that pattern.
This keeps the SSP accurate without rewriting it every time a project starts. When a site does not fit the pattern, that difference is recorded and, if needed, goes on the POA&M.
Which policies matter most in construction?
Media protection, mobile devices and physical access carry more weight here than in most industries. The media policy has to cover printed plan sets, plotter storage, transport between sites and destruction. The mobile device policy has to cover the tablets and phones field staff actually use. The physical access policy has to cover a trailer as well as an office.
A template written for an office building misses all three. An assessor who reads a media policy that never mentions paper, at a company whose work runs on drawings, will notice.
What goes in the POA&M?
Every requirement not yet met, what closing it takes and who owns it. Common entries for construction contractors include enrolling field devices, replacing shared trailer logins with individual accounts, confirming the plan-sharing platform's FedRAMP Moderate equivalence, and setting up marking and destruction for printed sets.
Some requirements cannot sit on a POA&M at all under 32 CFR 170.21 and must be met before an assessment. The POA&M should be clear about which ones those are.
How does the SSP handle the plan-sharing platform?
It names the platform, states whether marked drawings are stored there, and records what you confirmed about the provider: its FedRAMP Moderate equivalence and its incident reporting obligations. It also says which controls you rely on the provider for and which remain yours, such as who gets accounts and how they are removed when a trade finishes.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.4
System Security Plan
A plan that describes the office, the standard jobsite pattern, each active site, and the platforms where drawings live. Evidence is a current plan that matches the asset inventory and the sites actually running.
MP.L2-3.8.4
Media Markings
Printed sets and derived documents such as shop drawings carry the CUI markings of the source. Evidence is the marking procedure and sample printed sheets showing it followed.
MP.L2-3.8.1
Media Protection
Printed marked sets and drives are physically controlled and securely stored, in the office plan room and on site. Evidence is the storage location, who has the key, and a walk-through that matches the policy.
CA.L2-3.12.2
Plan of Action
A POA&M that names each open requirement, including jobsite-specific gaps, with an owner and a date. Assessors check that items move toward closure over time.
What do you receive?
SCOPED PER CLIENTA System Security Plan written against your environment
The office, a standard jobsite pattern, and each active project listed against it.
The policy set behind it
Each policy mapped to the controls it satisfies, written for printed sets, field devices and trailers.
A POA&M naming every open control
What closing each one requires and who owns it.
Documents you keep
Written so your own team can maintain them as projects start and close.
What does this service not include?
Documentation, not remediation: we write the plan and the policies, we do not implement the controls they describe or collect your evidence under this engagement. We are not an Authorized C3PAO.
The full service, for any industry: System Security Plan, policy and POA&M. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Do we need a separate SSP for every jobsite?
Usually not. One SSP can describe a standard jobsite pattern and list active sites against it. A site that differs from the pattern is recorded as a difference, and anything not yet met goes on the POA&M.
Can you write our SSP without a gap assessment?
We write from a recent gap assessment if you have one. If not, we start with one, because a plan written before the gaps are known describes an environment nobody has checked.
Do policies have to cover paper plan sets?
Yes. DFARS 252.204-7012 includes printouts in its definition of media, and the media protection requirements apply to marked paper as well as files. The policy should cover storage, transport, marking and destruction.
Do you set up the controls the SSP describes?
Not under this engagement. We write the plan, the policies and the POA&M. Implementing the controls and collecting evidence is separate work for your team or another engagement.
More for defense construction contractors
System Security Plan, policy and POA&M in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.