Attachment 8 - NIST SP 800-171 System Security Plan Template.docx
DOCX document 20 KB Posted
- Solicitation number
- SPE2DX-24-R-0001_SOLICITATION
About this file
This document contains a system security plan template for a federal contractor to document how it will meet NIST SP 800-171 security requirements for protecting controlled unclassified information. The template requires the contractor to provide key details about covered IT systems such as system names and purposes, hardware and software components, numbers of users and administrators, and plans for how all 110 NIST security requirements will be met. The contractor must also include an assessment summary spreadsheet and a cyber incident response plan.
The related federal contract opportunity is a solicitation from the Defense Logistics Agency Troop Support Medical for pharmaceutical products under the Pharmaceutical Prime Vendor Generation V program. Offerors should review the attachments for details on product and service requirements.
View the file
Other files
Show all 27
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SYSTEM SECURITY PLAN - company name
DATE: XX/XX/XX
1. INFORMATION TECHNOLOGY INFRASTRUCTURE
1.1. Covered System(s) Name: [Provide a list of covered systems. Spell out acronyms.]
1.2. Vendor System Owner (assignment of security responsibility):
Name:
Title:
Office Address:
Work Phone:
e-Mail Address:
1.3. General Description/Purpose of System(s):
1.4. List all vendor Information Technology systems required to perform the requirements of the contract and their purpose [Provide a short, high-level description of the function/purpose of the system(s). Add rows or tables as needed if there are multiple systems]
1.4.1. Number of end users and privileged users: [In the table below, provide the approximate number of users and administrators of the system. Include all those with privileged access such as system administrators, database administrators, application administrators, etc. Add rows to define different roles as needed.]
Roles of Users and Number of Each Type:
| Number of Users |
| Number of Administrators/ |
Privileged Users
1.5. For each system, include a high-level listing of all hardware and software (system software and application software) components, including make/OEM, model, version, service packs, and person or role responsible for the component. This does not require identifying every workstation or device, but including the types/model each kind of hardware, operating system in use, an type/model of portable components (if applicable), all virtual and physical servers (e.g., file, print, web, database, application), as well as any networked workstations (e.g., Unix, Windows, Mac, Linux), firewalls, routers, switches, copiers, printers, lab equipment, handhelds. [If providing as an attachment, insert the reference or note that the hardware component list is attached. A system topology graphic can be used but would require a narrative consistent with the graphic that clearly lists and describes each system component.]
1.6. Hardware and Software Maintenance and Ownership - Is all hardware and software maintained and owned by the organization? [Yes/No - If no, explain:]
2. NIST REQUIREMENTS
Provide a thorough description of how all 110 NIST SP 800-171 requirements are being met or are planned to be met in the future using the NIST SP 800-171 Assessment Summary spreadsheet.
[Ensure that the Assessment Summary is fully completed and attached along with the System Security Plan.]
3. CYBER INCIDENT RESPONSE AND REPORTING
Provide a plan for responding to Cyber incidents and reporting such incidents.
File details come from the government source that posted it. Updated .