Enter System Name ACF

System Security Plan System Name

Version 1.0 Dated: 6/26/25

Table of Contents

1. Introduction and Purpose The System Security Plan (SSP) outlines a system’s security requirements and the measures being implemented to address them. It specifies all users’ roles and expected actions and aims to ensure effective and cost-efficient protection for the system.

2. System Identification Identify the system using its unique identifiers for definition and reference.

Table 1. System Identification Security Identification

3. System Categorization

3.1 System Categorization

In compliance with Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the system security categorization assessment was made based on the confidentiality, integrity, and availability requirements of the system’s store, processed, and transmitted data.

Table 2. System Security Categorization

Rating

3.2 Information Types

Each information type processed, stored, or transmitted by the system has been identified using NIST SP 800-60 and system documentation. Full details can be found in the Security Categorization document in the ATO package.

Enter link to Security Categorization document

4. System Description

4.1 System Purpose

Include a brief description of the function and purpose of the system.

Enter System Purpose

4.2 System Type & Operational Status

Select a system type.

Table 4. System Type & Operational Status System Type & Operational Status

4.4 Accreditation Boundary

Include an accreditation boundary diagram. Only hardware, software, subsystems, and components relevant to the system’s operation are included within the accreditation boundary. For clarity, the diagram may display other systems or parts the system is connected to but doesn’t control. These include client computers, shared tech resources, support systems, and services provided by the hosting environment.

4.5 Operating Environment

Identify the system’s operating environment.

Table 5. Operating Environment Operating Environment

4.6 Multifactor implementation

Provide details about the multifactor authentication solution(s) in place for each user group.

Enter details

5. Interconnections This section describes the ports, protocols, and services in use within the accreditation boundary and the data or services outside the accreditation boundary.

5.1 Internal System Connections

List connections to other systems or data within ACF. Include systems that are within ACF’s inventory but not included in the accreditation boundary in the SSP.

Table 6. Internal System Connections

5.2 External System Connections

List all external interfaces with data paths crossing the accreditation boundary:

Table 7. Internal System Connections

6. Security Control Implementation Provide the link to the location of the spreadsheet with the complete set of NIST SP 800-53 Rev. 5 control implementations for this system’s level (established in Section 3 above). The spreadsheet should be maintained alongside the SSP as part of the system’s ATO package.

Insert link to spreadsheet

7. Risk Summary The results of the system Risk Assessment, dated Enter date, indicated that the risks to the system resources in the areas of Management, Operational, and Technical controls are as follows:

7.1 Management Controls

List the most significant management control related risks.

Enter management control related risks

7.2 Operational Controls

List the most significant operational controls related risks.

Enter operational control related risks

7.3 Technical Controls

List the most significant technical control related risks.

Enter technical control risks

Risks in areas such as natural, environmental, human intentional, and human unintentional threats were also assessed. The assessment found that identified risks could be fully mitigated through the implementation of relevant security controls. For more information, view the Security Risk Assessment.

Enter link to Security Risk Assessment

8. Continuous Monitoring The System’s security state is monitored to ensure that the information system is being maintained in accordance with policy and the approved baseline configurations.

8.1 Monitoring frequency:

Provide the frequency at which the system is monitored.

Enter monitoring frequency

8.2 Monitory Activities

Describe the specific activities used to monitor the system.

Enter monitoring activities

9. Roles and Responsibilities

9.1 System Owner

Table 4. System Owner Information

Enter Program Office

U.S. Department of Health and Human Services 330 C. Street, SW Washington, DC 20201

9.2 Authorizing Official

Table 5. Authorizing Official Information

9.3 Other Points of Contact

List all individuals who technically and operationally manage and support the system. Add additional rows as needed.

Table 8. Other Points of Contact

10. Approval and Authorization We, the undersigned, approve the content of this System Security Plan for the Administration for Children and Families Enter type of system located at Enter location, including the system boundary, the FIPS 199 Impact Level of Select a level, and the NIST SP 800-53 Rev. 5 security controls as tailored specifically for this system.

Digital Signature – System Owner

Digital Signature – System Security and Privacy Officer

Document Revision History

Version 1.0 System Security Plan 1 image1.png image2.png image3.png