CMMC readiness:
SSP preparation checklist

Provider documentation is an input to your SSP

A system security plan (SSP) describes your environment and how applicable security requirements are addressed. A provider can explain the services it operates, but that description does not cover every responsibility inside your organization.

Castilix Secure Enclave includes architecture documentation, control descriptions, and a responsibility matrix. Your team or advisor can use this provider documentation when developing your SSP. A complete customer-specific SSP, tailored policies, and implementation assistance are separate services.

For example, Castilix manages the subscription Cloud PC, while your organization approves who should have access. Physical-device management is separately scoped. The SSP and supporting procedures need to reflect those actual responsibilities.

What to gather before the engagement

Start with what you already have. Mark unknowns and gaps clearly so the engagement can address them. Do not label an unverified setting, unsigned policy, or planned process as implemented.

1. Applicable requirements and intended scope

   Identify the contractual requirements your team is working against, the readiness stage, the target timeline, and any existing assessment or advisory findings. Confirm the applicable requirements with the responsible contracting or assessment parties.

2. Information and data flows

   Describe where controlled unclassified information (CUI) enters, where it is used and stored, and how it leaves. Identify the users, locations, systems, external organizations, and approved transfer methods involved. A general flow description is enough for the initial discussion; do not send CUI through the public form.

3. Systems, applications, and providers

   Prepare an inventory of the cloud environments, computers, networks, applications, and providers involved. Include who owns and manages each part, relevant service agreements, and any existing architecture diagrams.

4. People and operating procedures

   Identify who approves access, handles employee departures, reviews changes, manages incidents, and approves policies. Bring existing procedures, even if they need revision, and identify the people who perform the work.

5. Evidence and known gaps

   List available access reviews, training records, change records, incident exercises, configuration reviews, and other operating evidence. Record the owner, location, review date, and any missing information. Keep evidence references separate from claims that a requirement has been fully validated.

Make shared responsibilities specific

Use a working responsibility list to identify who performs a task, who approves it, and what record demonstrates it happened. The examples below are discussion prompts, not a replacement for your agreed responsibility matrix.

A completed template describes an intended process. Evidence of actual operation, review, and testing supports a different question: whether the process is being carried out as required. Keep both visible in your readiness work.

What Castilix readiness support can include

Castilix CMMC readiness engagements can include scope and responsibility mapping, customer-specific SSP development, tailored policies, implementation coordination, and evidence preparation. Castilix GRC is included during the readiness engagement to organize requirements, actions, documentation, and evidence references.

Castilix GRC is excluded from Standard and Premium subscriptions. Continued governance support and use after a readiness engagement are scoped and quoted separately. Managed IT and cybersecurity services can address ongoing operating responsibilities under a separate agreement.

Use this checklist to prepare for an SSP and readiness engagement. Your organization completes the applicable CMMC assessment process; any required independent assessment is separate from Castilix's readiness services.