Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  System Security Plan (SSP) to determine if system boundaries and operational environments are defined.

·  SSP security controls that have been implemented, not implemented or planned for implementation.

·  SSP to determine any relationship or dependency with other internal systems, or external systems in the supply chain.

·  Evidence that the SSP is reviewed and accepted by management, and integrated into the organization's risk management framework.

System security plans and plans of actions are critical to the organizations risk management process and the overall security of organizational systems. 

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Security Assessment documentation to determine the frequency and scope of the security assessments.

·  Evidence that Security Assessments are conducted to determine if performed internally or by an independent auditor/consultant.

·  Evidence that Security Assessment results are provided to management.

The assessment of security controls, identified in the SSPs, is necessary to ensure that the controls are implemented as intended and producing expected results in security and risk management.