Top 10 SSP Mistakes That Will Derail Your CMMC Assessment

If your SSP only addresses one of these, it fails to meet the full objective. 

Leaving Shared Responsibilities Undefined

Many organizations rely on third-party vendors, managed service providers, or cloud platforms to help implement security controls. That is common and expected. The problem arises when the SSP does not clearly explain who is responsible for what. 

CMMC assessors will not assume your MSSP, or cloud provider is handling a control unless it is documented. If your SSP says, “Handled by our MSSP,” but does not explain what actions they perform and what your internal team is responsible for, it will likely result in a finding. 

This is especially important for hybrid controls where responsibilities are shared. For example, MAD Security might provide 24/7 log monitoring, but your internal team still handles onboarding users and configuring access control. 

What to do instead: Use a Shared Responsibility Matrix to define each party’s role. For each hybrid or inherited control, describe: 

This clarity helps the assessor, strengthens accountability, and ensures your SSP reflects your actual security operations. 

Failing to Define the System Boundary

One of the first things an assessor will look for in your SSP is a clearly defined system boundary. This tells them what is in scope for CUI protection, which systems and users are covered, and where that boundary ends. 

Too many SSPs skip this entirely or describe it in vague terms like “corporate network” or “production environment.” That’s not enough. Without a defined boundary, assessors cannot determine which assets, controls, or processes apply to the CMMC assessment. 

This leads to confusion, wasted time, and documentation revisions during or after the assessment. 

What to do instead: Your SSP should include:

Even a simple visual showing how your organization segments its environment helps establish scope and supports many of the access control, system monitoring, and  assessment requirements in NIST SP 800-171. 

MAD Security provides boundary templates and architecture review as part of our SSP support process to ensure no gaps exist before you face an assessor. 

Using Outdated or Inconsistent Information 

An SSP that includes outdated information is a red flag during any CMMC assessment. Assessors frequently encounter mismatched tool names, references to old policies, and control descriptions that no longer reflect how the organization operates. 

This inconsistency signals a larger issue. If your documentation doesn’t match your environment, it’s unclear whether your controls are being implemented correctly. Even if your technical team is doing the right work, a stale or inaccurate SSP can cause delays or findings during your assessment. 

Common signs of outdated SSPs include: 

What to do instead: Your SSP should be treated as a living document. Update it whenever: 

Include a change log in the SSP to document when updates occur and who approved them. This shows assessors that your documentation is maintained and aligned with real-world operations. 

Missing Evidence References 

Even when an SSP includes accurate control descriptions, many fail to show how those statements are supported by evidence. If an assessor reads that a process exists but cannot verify it through logs, documents, or system output, the implementation may be considered unproven. Your SSP should do more than describe what you do. It should point directly to the artifacts that prove it. 

For example, saying “user access is reviewed quarterly” is not enough. An assessor will expect to see: 

What to do instead: Include clear references in each control implementation to the source of evidence. This can include: 

By linking each control to the right evidence, you eliminate guesswork and show that your SSP reflects real operational practices. MAD Security helps clients organize this evidence and map it directly to each control using our documentation framework. 

Misusing “Not Applicable” Without Formal Justification

Some organizations attempt to mark NIST SP 800-171 controls as “Not Applicable” in their System Security Plan to simplify compliance. While there are rare cases where this may be appropriate, you cannot make that determination independently. 

Under DFARS 252.204-7012, a control may only be marked “Not Applicable” if your organization receives written approval from the DoD CIO. Without this official authorization, assessors will treat the control as required and expect a full implementation or approved alternative. 

Common mistakes to avoid: 

What to do instead: If a control does not apply to your environment: 

Example of valid documentation: “This control is not applicable per written approval from the DoD CIO dated June 14, 2024. The decision is based on the absence of mobile device access to CUI in our environment.” 

Controls cannot be marked “Not Applicable” without formal approval. Treat this process with the same rigor as you would any other compliance requirement. 

Incomplete Status Tags for Each Control 

CMMC assessments require that every control in your SSP has a status label indicating whether it is implemented, planned, hybrid, or inherited. Leaving this out or using it inconsistently creates confusion and undermines the credibility of your documentation. 

When status tags are missing or inaccurate, assessors cannot determine which controls are in place today, which are pending, and which are covered by third parties. This leads to findings and follow-up requests that delay your assessment. 

Common issues include: 

What to do instead: For every control in your SSP, include a status label and define it clearly. Use only the recommended options:  

If a control is hybrid or inherited, it also specifies who is responsible for what is required. This builds trust with assessors and shows that you’ve done the work to document real accountability. 

No Update or Change History 

An SSP that looks static or untouched raises questions for assessors. If your plan was last updated two years ago or if there’s no indication of when it was reviewed or modified, it will likely be flagged during your CMMC assessment. 

Assessors want to know if your SSP reflects the current state of your environment. Without a change of log or documented review of history, they have no way to tell if what they’re reading is accurate. 

This problem is common in organizations that treat the SSP as a one-time deliverable. But compliance is not a project. It’s a continuous process. 

What to do instead: Include a change log in your SSP. For each update, note: 

This not only satisfies the assessor's expectations but also helps your internal teams track how your documentation evolves alongside your environment. 

No External Review Before Assessment 

Even organizations with a complete and well-written SSP often fail to have it externally reviewed before a formal CMMC assessment. This is a missed opportunity to catch errors, close documentation gaps, and ensure the SSP aligns with how your security controls are implemented. 

Without an outside perspective, it’s easy to overlook assumptions, reuse outdated language, or misrepresent shared responsibilities. In some cases, internal teams are too close to the environment to see where the documentation may fall short. 

CMMC assessments are high stakes. One preventable documentation issue can lead to a delay in your contract eligibility or trigger corrective action. 

What to do instead: Have your SSP reviewed by: 

At MAD Security, we perform SSP reviews as part of our compliance readiness services. We evaluate the structure, control responses, shared responsibilities, and evidence mapping against both NIST 800-171A and CMMC Level 2 expectations. 

A third-party review can give you the confidence that your SSP is not only complete but also dependable.   

How to Fix These Issues and Strengthen Your SSP 

The good news is that most SSP problems are fixable. Whether your documentation is incomplete, inconsistent, or outdated, there are practical steps you can take to bring it in line with CMMC Level 2 expectations. Start with a self-assessment. Review your SSP against the top 10 mistakes outlined above. For each control, ask: 

Next, build a plan to close gaps. This may include: