System Security Plan, policy and POA&M for engineering and design firms
An SSP that describes how your drawings actually move.
We write the System Security Plan, the policies behind it and a POA&M for engineering firms, against the vault, workstations and transfer methods you really use. Capital Cyber, based in Leesburg, Virginia, provides System Security Plan, policy and POA&M for engineering and design firms and works on-site across Northern Virginia.
For engineering firms that know their gaps and need the documents written.
Why do template SSPs fail in engineering firms?
Templates describe an office with email and a file server. A design firm has a PDM vault with its own permission model, CAD workstations with local caches, a license server, a plotter with a hard drive and a prime with its own portal. An SSP that leaves those out describes a different company, and that mismatch is what an assessor finds first.
What does the SSP need to say about the vault?
Where it runs, who administers it, how roles map to projects, how controlled files are flagged, how backups are protected, and what happens to checked-out copies when a project closes. Each of those answers lands under a specific control, so the vault appears throughout the plan, not in one paragraph.
Which policies matter most for a design office?
Media protection and marking, because drawings are printed, exported and handed around. Remote work, because engineers take models home. Configuration management, because CAD add-ins and plotter drivers change the workstation. Personnel actions, because an engineer who leaves may have copies on more than one machine.
What goes on the POA&M?
Every control not yet met, with what closing it takes and who owns it. In engineering firms the usual items are marking on exported PDFs, encryption on older workstations, plotter drive handling and remote access. The POA&M turns those from worries into a dated list.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.4
System Security Plan
Describes the boundary around the vault, workstations and transfer channels, how each requirement is met, and the connections to the prime.
MP.L2-3.8.4
Media Markings
Plotted sheets and exported PDFs carry the CUI marking and the distribution statement from the source drawing. Evidence is a sample of printed and exported output.
MP.L1-3.8.3
Media Disposal
The plotter or printer drive is sanitized or destroyed before the device leaves. Evidence is a disposal record tied to the asset inventory.
PS.L2-3.9.2
Personnel Actions
When an engineer leaves, vault access, remote access and local copies are dealt with. Evidence is a completed leaver checklist for a real departure.
What do you receive?
SCOPED PER CLIENTA System Security Plan
Written against your design office as it actually is: vault, workstations, transfer methods and devices.
The policy set
Each policy mapped to the controls it satisfies, written for how your engineers work.
A POA&M
Every open control, what closing it requires, and who owns it.
Documents you keep
Your own team can maintain them as projects, tools and people change.
What does this service not include?
Documentation, not remediation: we write the plan and the policies, we do not implement the controls they describe or collect your evidence under this engagement. We are not an Authorized C3PAO.
The full service, for any industry: System Security Plan, policy and POA&M. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Can an engineering firm use a template SSP?
A template can show structure, but an SSP has to describe your actual PDM vault, CAD workstations, transfer methods and devices. If it names systems you do not run or leaves out the ones you do, it will not match what an assessor sees.
Do you write the SSP before or after a gap assessment?
After. We write from the findings of a recent gap assessment. If an engineering firm does not have one, we start with one, because a plan written before the gaps are known describes an environment nobody has checked.
Do you also fix the controls the SSP describes?
Not under this service. We write the SSP, policies and POA&M. Implementing controls on the vault or the workstations, and collecting evidence, sits in program leadership or with your own IT team.
Who maintains the SSP once it is written?
You do, or a fractional CISO does with you. The documents are yours, written so an engineering firm's own team can update them when a new tool, workstation or engineer arrives.
More for engineering and design firms
System Security Plan, policy and POA&M in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.