What is the purpose of a System Security Plan (SSP) in CUI handling?

• A. To establish user branding guidelines.
• B. To compensate for risk assessment without controls.
• C. To document security requirements and implemented controls for systems processing CUI.
• D. To define marketing communications.

Answer: (C)

The System Security Plan is the formal description of how a system handles CUI by detailing the security requirements and the controls that are actually in place to meet them. It lays out what needs to be protected, what controls are implemented, how those controls are wired into the system, who is responsible, and how the organization will monitor and maintain security over time. It also shows the system’s boundary, the environment in which CUI is processed, and the plan for ongoing assessment, authorization, and continuous monitoring. This document is the foundation for proving compliance and for guiding security operations.

Branding guidelines, or marketing communications, aren’t related to protecting CUI. A risk assessment without controls wouldn’t demonstrate how security requirements are being met, which is the whole purpose of documenting controls.