菜单
Develop a system security plan that: Defines the constituent system components; Identifies the information types processed, stored, and transmitted by
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill system-security-plan-03-15-02-system-security-plan命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | System Security Plan (03.15.02)_system-security-plan |
| description | Develop a system security plan that: Defines the constituent system components; Identifies the information types processed, stored, and transmitted by |
| category | configuration |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","system security plan (03-15-02)","family-03.15","cui-protection","cmmc"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Family: Planning Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI
Develop a system security plan that: Defines the constituent system components; Identifies the information types processed, stored, and transmitted by the system; Describes specific threats to the system that are of concern to the organization; Describes the operational environment for the system and any dependencies on or connections to other systems or system components; Provides an overview of the security requirements for the system; Describes the safeguards in place or planned for meeting the security requirements; Identifies individuals that fulfill system roles and responsibilities; and Includes other relevant information necessary for the protection of CUI. Review and update the system security plan [organization-defined]. Protect the system security plan from unauthorized disclosure.
Examine the SSP for System Security Plan (03.15.02) implementation description and responsible parties.
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
| Tool | Purpose | Usage |
|---|---|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Develop a system security plan that: Defines the constituent system components; Identifies the information types processed, stored, and transmitted by the system; Describes specific threats to the system that are of concern to the organization; Describes the operational environment for the system and any dependencies on or connections to other systems or system components; Provides an overview of the security requirements for the system; Describes the safeguards in place or planned for meeting the security requirements; Identifies individuals that fulfill system roles and responsibilities; and Includes other relevant information necessary for the protection of CUI. Review and update the system security plan [organization-defined]. Protect the system security plan from unauthorized disclosure.
System security plans provide key characteristics of the system that is processing, storing, and transmitting CUI and how the system and information are protected. System security plans contain sufficient information to enable a design and implementation that are unambiguously compliant with the intent of the plans and the subsequent determinations of risk if the plan is implemented as intended. System security plans can be a collection of documents, including documents that already exist. Effective system security plans reference policies, procedures, and documents (e.g., design specifications) that provide additional detailed information. This reduces the documentation requirements associated with security programs and maintains security information in other established management or operational areas related to enterprise architecture, the system development life cycle, systems engineering, and acquisition.
| Finding | Severity | Impact |
|---|---|---|
| System Security Plan (03.15.02) System Security Plan not implemented | Medium | CUI Protection - Planning |
| System Security Plan (03.15.02) partially implemented (POA&M) | Low | CMMC certification risk |
| CWE ID | Title |
|---|---|
| N/A | No direct CWE mapping |