Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.15.02System security planITSP.10.171Planning

Official Requirement

A. Develop a system security and privacy plan that: 1. defines the constituent system components 2. identifies the information types processed, stored, and transmitted by the system 3. describes specific threats to the system that are of concern to the organization 4. describes the operational environment for the system and any dependencies on or connections to other systems or system components 5. provides an overview of the security requirements for the system 6. describes the safeguards in place or planned for meeting the security requirements 7. identifies individuals that fulfill system roles and responsibilities 8. includes other relevant information necessary for the protection of specified information. B. Review and update the system security plan [Assignment: organization-defined frequency]. C. Protect the system security plan from unauthorized disclosure.

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

You need a system security plan (SSP) that describes your system's components, the types of information it handles, threats, the operating environment, security requirements, implemented safeguards, and responsible personnel. The SSP must be reviewed and updated regularly, and it must be protected from unauthorized disclosure since it contains sensitive details about your security posture.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

System security plan development and maintenance

Implementation steps

  1. Create a comprehensive SSP covering all required elements: system architecture, data types, threat environment, security requirements, safeguards, and personnel
  2. Ensure the SSP is consistent with the organization's enterprise architecture and includes supply chain threat analysis
  3. Protect the SSP from unauthorized disclosure by storing it in a secured location with access restricted to authorized individuals
  4. Schedule and conduct SSP reviews at the defined frequency; update when system components, threats, or requirements change

Tools / systems

Evidence artifacts

Evidence frequency: Annual SSP review and update (or at defined frequency); per-event updates for significant system changes