What a CMMC system security plan has to do.

The finding for a missing plan reads "an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012." ²

The definition the rule uses

32 CFR 170.4 defines a system security plan as the formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. The plan describes the system components included within the system, the environment in which the system operates, how the security requirements are implemented, and the relationships with or connections to other systems. The section says that wording is as defined in NIST SP 800-53 Revision 5, which the rule incorporates by reference. ¹

What the scoping section says to put in it

For every in-scope Level 2 asset category, 32 CFR 170.19 says to document the asset in the inventory and to document the asset treatment in the system security plan, and to show the asset on the network diagram of the assessment scope. Specialized assets are also shown as managed under the contractor's risk-based security policies, procedures, and practices. ⁴

If the company uses an external service provider, the same section says the use of the provider, the relationship, and the services need to be documented in the system security plan and described in the provider's service description and customer responsibility matrix. ⁴

Contractor risk managed assets and specialized assets are handled by a review of that plan. If the contractor risk managed asset documentation is sufficient, those assets are not assessed against the other CMMC requirements, except as the section notes. Specialized assets are not assessed against the other CMMC requirements. ⁴

How scoring treats the plan

32 CFR 170.24 says evidence for a MET finding has to be in final form. Working papers, drafts, and unofficial or unapproved policies are listed as unacceptable forms of evidence. ²

An enduring exception, when described with any mitigations in the system security plan, is assessed as MET. The definition in 32 CFR 170.4 says an enduring exception is a special circumstance or system where remediation and full compliance is not feasible. Examples in that definition include systems required to replicate the configuration of fielded systems, medical devices, test equipment, operational technology, and Internet of Things devices. No operational plan of action is required, and the circumstance must be documented in the system security plan. Specialized assets and government furnished equipment may be enduring exceptions. ^{2, 1}

If the company previously received a favorable adjudication from the DoD CIO that a security requirement is not applicable, or that an alternative security measure is equally effective, under DFARS 252.204-7008 or DFARS 252.204-7012, that adjudication must be in the system security plan to receive consideration. A requirement whose implemented measures were adjudicated as equally effective is assessed as MET if the environment has not changed. ²

A plan of action and milestones is not a substitute for a completed requirement. Security requirements that are not implemented are assessed as NOT MET whether or not they are described in a plan of action and milestones. ²

The same gap under the DoD assessment methodology

DFARS 252.204-7020 defines a Basic Assessment as the contractor's self-assessment of NIST SP 800-171 implementation that is based on the contractor's review of the system security plan or plans for the covered contractor information systems, is conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology, and results in a confidence level of Low because it is a self-generated score. ⁵

The methodology, Version 1.2.1, June 24, 2020, says the contractor must have a system security plan in place to describe each covered contractor information system. It says the scoring is based on review of that plan, so the assessment cannot be conducted if the information is not available. The absence of a system security plan results in a finding that an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012. ⁷

DoD's Revolutionary FAR Overhaul class deviation tells contracting officers to use a revised DFARS part 240 in place of the codified text. In that revision (Class Deviation 2026-O0025, Revision 3, September 3, 2026), the NIST SP 800-171 DoD assessment clause appears as 252.240-7997, and Medium and High assessments use the scoring methodology in 32 CFR 170.24. The missing-plan consequence is written in both the methodology and the CMMC rule. ⁶

A tool that stores your plan does not write its contents, and it does not complete the assessment.

Compare tools for CMMC Level 2, with each published price and the date it was checked.

Sources checked October 16, 2026. Not legal advice.