The document describing your system and how it meets each requirement. It is itself a requirement, and it cannot go on a POA&M.
Also called SSP, system security plan.
Official Source Material
System Security Plan (SSP) means the formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. The system security plan describes the system components that are included within the system, the environment in which the system operates, how the security requirements are implemented, and the relationships with or connections to other systems, as defined in NIST SP 800-53 R5 (incorporated by reference, see § 170.2).
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
The plan is the document your whole assessment is run against.
It describes your system, your scope, and how each of the 110 requirements is met. An assessor reads it first and tests what it claims. A plan that describes your environment accurately makes an assessment shorter. A plan that describes an environment you do not have makes one much longer.
CA.L2-3.12.4 requires the plan, and it cannot be deferred.
The plan is a requirement in its own right, and 32 CFR 170.21 names CA.L2-3.12.4 among the requirements that may not appear on a POA&M. You cannot arrive at an assessment with a plan in progress and defer it. Write it before you book anything.
Your asset treatment lives here, and that is what makes scoping real.
Two things belong in the plan that people keep outside it.
An enduring exception is assessed as met when the plan describes it along with any mitigations. A favourable adjudication from the DoD Chief Information Officer counts during an assessment only when the plan includes it. Both are worth points, and both are commonly filed somewhere else.
What falls short
A plan generated from a template with the company name changed. The assessor tests what the plan claims against what exists.
A plan describing the environment you intend to build. It describes the system you have, and planned controls are identified as planned.
A plan with no external service provider described. The rule asks for the provider, the relationship, and the services.
Edge cases
You run more than one system. Each has its own plan, and the SPRS submission names the codes each plan covers.
Your environment changes after the plan is written. Update it, because a material change also affects your scope and your affirmation.
A control is inherited entirely from a provider. Say so, name the provider, and cite the evidence rather than leaving the requirement blank.
Over-engineering
A plan of several hundred pages for a ten-person company. Length is not the measure, and every claim in it must be defensible.
A separate plan per requirement family. One plan describing the system is what the requirement asks for.