System Security Plan, policy and POA&M for defense research and development firms
An SSP that tells the truth about a small lab.
We write the System Security Plan, the policies behind it and a POA&M for defense research firms, describing the instruments, rigs and people you actually have. Capital Cyber, based in Leesburg, Virginia, provides System Security Plan, policy and POA&M for defense research and development firms and works on-site across Northern Virginia.
For R&D firms that know their gaps and need the documents written.
Why does the SSP carry so much weight for a lab?
Because Specialized Assets are assessed by reading it. Under the CMMC scoping rule, test equipment is reviewed through the SSP and not assessed against the other requirements. If the plan does not show how each instrument is managed under your risk-based policies, there is nothing else for an assessor to look at.
How do you write roles when the whole team fits in one room?
Name the people and the roles each holds, including where one person holds several. The SSP explains how duties are separated anyway, for example a second person approving changes to the controlled share, and how privileged work is done from separate accounts. An SSP that invents a security department nobody has will not survive the first interview.
Which policies matter most for a research firm?
Media protection, because data moves on removable drives from isolated rigs. Maintenance, because instruments go out for calibration and repair. Access control, because collaborators come and go between projects. And a short, clear statement of which projects are controlled and which are not, so the policies apply where they should.
What goes on a lab's POA&M?
Every control not yet met, with what closing it takes and who owns it. Typical items in a research firm are older rig workstations that cannot be patched on the normal schedule, removable media control, and partner flow-down that has not been written yet.
Which requirements does this touch?
NIST SP 800-171CA.L2-3.12.4
System Security Plan
Describes the boundary, the instruments and how each is managed as a Specialized Asset, and the connections to partners and the program office.
AC.L2-3.1.4
Separation of Duties
Shows how duties are separated in a team where one person holds several roles. Evidence is the role list and a change record approved by a second person.
MA.L2-3.7.3
Equipment Sanitization
An instrument or machine that leaves for calibration or repair has controlled data removed first. Evidence is a sanitization record for a real piece of equipment.
MA.L2-3.7.4
Media Inspection
Diagnostic and test programs a vendor brings on media are checked for malicious code before they touch a rig. Evidence is the procedure and a scan record.
What do you receive?
SCOPED PER CLIENTA System Security Plan
Written against your lab as it actually is, including how instruments are managed as Specialized Assets.
The policy set
Each policy mapped to the controls it satisfies, written for how your researchers work.
A POA&M
Every open control, what closing it requires, and who owns it.
Documents you keep
Your own team can maintain them as projects, instruments and people change.
What does this service not include?
Documentation, not remediation: we write the plan and the policies, we do not implement the controls they describe or collect your evidence under this engagement. We are not an Authorized C3PAO.
The full service, for any industry: System Security Plan, policy and POA&M. Where most engagements start: the CMMC Level 2 gap assessment.
Questions we hear
How are lab instruments handled in the SSP?
Test equipment such as oscilloscopes and spectrum analyzers can be categorized as Specialized Assets. The SSP shows how each is managed under the research firm's risk-based policies, and that review is how those assets are assessed.
Can one person hold several roles in our SSP?
Yes, as long as the plan says so and explains how duties are still separated and how privileged work is done from separate accounts. An SSP for a small research firm should name real people, not an invented department.
Do you write the SSP before or after a gap assessment?
After. We write from the findings of a recent gap assessment. If a research firm does not have one, we start with one, because a plan written before the gaps are known describes an environment nobody has checked.
Do you also implement the controls in the lab?
Not under this service. We write the SSP, policies and POA&M. Implementing controls on rigs and machines, and collecting evidence, sits in program leadership or with your own team.
More for defense research and development firms
System Security Plan, policy and POA&M in other industries
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.