Skip to main content

University of Houston System

  1. UH System
  2. Offices
  3. Information Security
  4. Cybersecurity Resources and Support
  5. Secure Research
  6. System Security Plan (SSP) and Plan of Action and Milestones (POAM)

Offices

System Security Plan (SSP) and Plan of Action and Milestones (POAM)

A System Security Plan (SSP) describes the 110 controls from NIST 800-171 in place in systems containing controlled unclassified information (CUI). The SSP documents the following characteristics of the system.

  • Purpose and operational function of the system.
  • Classification of sensitivity of data that will be stored, processed, or transmitted via the system.
  • Point of contact, roles, and responsibilities for the system and its security controls.
  • Current state of security controls (non-existent, planned, partially implemented, or fully implemented).
  • Detailed description of the implementation of security controls, including technical, administrative, or physical requirements.
  • Identification and description of dependencies and connections between the system containing CUI and other systems.

A Plan of Action and Milestones (POAM) documents the planned remediation actions to correct weaknesses or deficiencies identified in systems containing CUI . Contracts may be awarded with a limited time Plan of Actions and Milestones (POA&M) in place to ensure compliance with NIST 800-171.