About

Scope and System Security Plan are two pages for frameworks that are assessed against a defined boundary, such as NIST 800-171 and CMMC. Scope is where you record which assets, people and vendor products sit inside that boundary. System Security Plan is where you build the plan document these programs ask for, then download it as a Word file.

Both pages only appear for certain frameworks, so you will not see them on every client.

Which frameworks show these pages

Scope appears in the sidebar, under the framework section, only when the selected framework is one of these:

• NIST 800-171r2
• CMMC 2.0
• CMMC 2.13 Level 2
• CMMC 2.13 Level 1

System Security Plan appears on a set of NIST 800-171, CMMC and NIST 800-53 frameworks, including:

• NIST 800-171r2
• CMMC 2.0
• NIST 800-171 R3
• NIST 800-53 Rev. 5 Moderate
• CMMC 2.13 Level 2
• CMMC 2.13 Level 1

On any other framework, such as ISO 27001, SOC 2, CIS Controls, NIST CSF or HIPAA, there is no Scope item. If you select Scope while All Frameworks is chosen, you are asked to pick a framework first.

Scope

Select Scope in the sidebar. The page is titled "Scope" and has three tabs: Assets, People and Vendors. Each tab shows a count and lists only what is already in scope for the selected framework.

Scope is kept for each framework separately. Adding an asset to the scope of one framework does not add it to another framework's scope.

What each tab shows

Each tab has a search box and a Display menu where you can group the list and choose which columns to show:

• Assets: search with "Search scoped assets". Group by None, Asset types or Region. The columns are ID, Name, Ext-ID, Description and Actions. The list keeps loading as you scroll. If nothing is in scope you see "No assets are in scope for this framework. Add assets to define the scope."
• People: search with "Search people". Group by None or Role; people with no job title appear under "Unspecified role". The columns are Person, Email, Employee ID, Status and Actions. If the list is empty you see "No people found."
• Vendors: search with "Search scoped products". Group by None or Vendors; products with no vendor appear under "Unassigned vendor". The columns are Product, Vendor, Description, Status and Actions. Status reads Implemented or Not implemented. If the list is empty you see "No products found."

The rows on the Vendors tab are vendor products, so you choose scope at the level of a vendor's product rather than the whole vendor.

Add assets, people or products to scope

1. In the sidebar, select Scope, then select the Assets, People or Vendors tab.
2. Select the add button: Add assets to scope, Add people to scope or Add products to scope.
3. In the side panel that opens, search the list (the search box reads "Search asset inventory", "Search people" or "Search products or vendors") and tick the rows you want. Items that are already in scope are not offered.
4. Select the button at the bottom of the panel. It reads "Add N asset(s)", "Add N person/people" or "Add N product(s)", with the number you ticked.

The panel closes and the list updates.

Scope only chooses from your existing lists. To create a new asset, person or vendor, add it on the Assets, People or Vendors page under Manage first.

Remove something from scope

• Assets: select Remove from scope on the row.
• People and products: select the trash-can button on the row.

The change happens straight away, with no confirmation box. The item stays in your Assets, People or Vendors list; it is only taken out of this framework's scope.

How Scope relates to objectives

The Scope page does not change any objective or its status. It is a separate control from the In scope and Out of scope setting on an individual objective, which you set on Objectives and which decides whether a requirement applies to the client at all. The Scopes filter on Objectives, used on some frameworks for groupings such as implementation groups, is a third, separate feature.

System Security Plan

Select System Security Plan in the sidebar. The title at the top is the report name. It starts as "SSP Report"; select it to rename it (up to 50 characters, and it cannot be empty). The Download SSP button is at the top right.

The page has two tabs: SSP Content and Recipients & Schedule.

The sections of the plan

The SSP Content tab is a list of eight sections. At the bottom, Previous and Next move you through them, with a counter such as "1 of 8":

1. Organizational Info
2. General System Description
3. System Environment
4. System Boundaries
5. Interconnected Systems list
6. Laws, Regulations, & Policies
7. Controls
8. Other Attachments

Fill in Organizational Info

This section has two tabs.

On the Organization tab, under "Organization Details", you enter:

• Name (required)
• Address
• Phone
• Client Website (Optional)
• Industry (required)
• Number of Employees (required)
• Description
• A logo, which you upload

Select Save when you are done.

On the Information System tab, you describe the system with these fields:

• Name and ID
• Operational Status: Operational, Under Development or Undergoing Modification
• Type: Major Application or General Support System
• Scope: Enterprise, Contracts or Enclave
• Environment of Operation: Standalone or Small Office/Home Office, Managed or Enterprise, or Custom
• Impact on Confidentiality, Integrity and Availability: Low, Moderate or High for each

Each field saves as soon as you change it, and you see a "Successfully updated" message naming the field.

Write the system sections

Sections 2 to 6 work the same way. Each one shows a short description of what to write and a link, here, to the NIST SP 800-18 guide, which opens in a new tab. Each section has two inner tabs:

• Content: a text editor that supports tables and images. Type your text, then select Save section or click outside the editor to save it. If your account has the editor AI feature turned on, an AI helper button also appears in the editor toolbar.
• Embed: choose existing documents, such as policies, procedures and governance documents, to include in the section. Use the search box ("Search and Select a document to embed for the system description") to find them, and the move up and move down controls to set the order. Until you pick one it reads "No document selected yet." The tab label shows how many documents you have embedded, for example "Embed (2 docs)".

You can write text, embed documents, or do both in a section.

Controls and Other Attachments

• Controls: there is nothing to edit here. A message explains that ControlMap automatically includes the in-scope controls and their implementation details, based on the assessment you have performed.
• Other Attachments: use the same document picker to add extra documents to the end of the plan.

Because the controls come from your assessment, keep Objectives up to date before you download.

Name the security contacts

The people named in the plan are not entered on this page. They come from Roles & Responsibilities, on the Roles tab, where you assign roles such as Information Owner, System Security Officer and Management Point Of Contact.

Download the plan

1. Work through the sections with Next.
2. Select Download SSP.

ControlMap saves your entries, builds the plan and downloads a Word (.docx) file. The file name is the report name followed by a date and time. A copy of the file also appears in Reports, with the type SSP, and is emailed to the person who generated it.

The plan includes the system and personnel details, the written sections and any embedded documents, other attachments, the controls and how they are implemented from your assessment, a revision history and the SPRS score data. Only Organizational Info has required fields; you can leave other sections empty and the file still downloads.

Send the plan on a schedule

1. Select the Recipients & Schedule tab.
2. Under "Recipients", add ControlMap users or external email addresses, and write the "Email message".
3. Select Set up SSP generation schedule and choose how often the plan is generated, in the "Configure SSP Schedule" dialog.

Changes to recipients, the message and the schedule save automatically. Each framework has its own SSP settings.