System Security Plan, policy and POA&M for government IT and services contractors
An SSP that knows whose system is whose.
The hardest paragraph in a services firm's SSP is the one that explains which systems are yours, which are the government's, and which you operate for it. We write that paragraph, and the rest of the plan, against your environment as it actually is. Capital Cyber, based in Leesburg, Virginia, provides System Security Plan, policy and POA&M for government IT and services contractors and works on-site across Northern Virginia.
For IT and services contractors who need an SSP, policies and POA&M that match how their people really work.
What does the SSP have to say about government systems?
It has to describe the boundary, and in a services firm the boundary has three kinds of system near it: your own, the government's that your staff use, and any you operate on behalf of the government. The SSP should name each one and say where it sits, so an assessor reading it can see why a government network your consultants log into is not in your scope and why your Outlook is.
Government Furnished Equipment goes in the plan too, listed as a Specialized Asset with a description of how you manage it under your own policies. Leaving it out is a common way for the asset inventory and the SSP to disagree.
Why do template policies fail in services firms?
Most templates are written for a company with an office, a server room and staff at desks. A services firm may have consultants at three customer sites, a remote help desk and no server room at all. A policy that talks about a data center you do not have, or a badge reader nobody installed, reads to an assessor like a policy nobody here wrote or follows.
We write the policy set for the way your people actually work: remote access, alternate work sites, mobile devices, guest access for teaming partners, and how a marked document from a customer is handled from the moment it arrives.
What goes in the POA&M for a firm like this?
Every open requirement, what closing it takes, and who owns it. In services firms the common entries are mobile device enrollment, data loss prevention rules for marked files, external sharing settings, audit log retention and review, and encryption on laptops that travel.
The POA&M also needs to be honest about what cannot sit on it. Some requirements are not eligible for a POA&M under 32 CFR 170.21, and the plan should be clear about which items have to be met before an assessment rather than after.
How does the SSP handle the Microsoft 365 decision?
Whatever you decide about where CUI lives, commercial tenant, GCC High, or a separate environment for a smaller group, the SSP records it, the reasoning behind it, and the cloud provider's responsibilities versus yours. If CUI lives with a cloud provider, the plan should show that the service meets security requirements equivalent to FedRAMP Moderate and which controls you inherit from it.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.4
System Security Plan
The plan itself: boundary, environment, how each requirement is implemented, and connections to other systems, including government systems your staff reach and teaming partner workspaces. Evidence is a current plan that matches the asset inventory and the network diagram.
CA.L2-3.12.2
Plan of Action
A POA&M with each open requirement, the work to close it, an owner and a date. Assessors check that items close over time, so a POA&M that has not changed in months tells its own story.
PE.L2-3.10.6
Alternative Work Sites
Written safeguards for consultants working from home and customer sites: where CUI may be opened, screen privacy, no printing at home unless approved, and what happens to a lost device. Evidence is the policy plus acknowledgment records from the people it applies to.
AC.L2-3.1.18
Mobile Device Connection
A written rule on which phones and tablets may reach email and Teams, and how they are enrolled. Evidence is the policy and a device management report showing only enrolled devices connect.
What do you receive?
SCOPED PER CLIENTA System Security Plan written against your environment
Including which systems are yours, which are the government's, and which you operate for it.
The policy set behind it
Each policy mapped to the controls it satisfies, written for remote staff, mobile devices and teaming partner access.
A POA&M naming every open control
What closing each one requires and who owns it.
Documents you keep
Written so your own team can maintain them as task orders come and go.
What does this service not include?
Documentation, not remediation: we write the plan and the policies, we do not implement the controls they describe or collect your evidence under this engagement. We are not an Authorized C3PAO.
The full service, for any industry: System Security Plan, policy and POA&M. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
Do government systems our staff use go in our SSP?
They should be named where they touch your boundary, so the plan explains why they are outside your scope. Government Furnished Equipment you hold is listed as a Specialized Asset. Systems the government owns and operates are not yours to assess, but the connection between them and your systems should be described.
Can you start writing our SSP without a gap assessment?
We start from a recent gap assessment if you have one. If you do not, we start with one, because a plan written before the gaps are known describes an environment nobody has checked.
Do you implement the controls the SSP describes?
Not under this engagement. We write the plan, the policies and the POA&M. Implementing the controls and collecting evidence is separate work, and your own team or another engagement can carry it.
Our firm is all remote. Does the SSP need a physical security section?
Yes, though it looks different. Physical protection requirements still apply to wherever CUI is accessed, which for a remote firm means home offices, customer sites and the devices themselves. The plan says how each is handled.
More for government IT and services contractors
System Security Plan, policy and POA&M in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.