What is required before developing a System Security Plan (SSP)?

• A. System categorization and control selection.
• B. Immediate system reboot.
• C. Routine external audit.
• D. No planning is needed.

Answer: (A)

Determining how the system is categorized and which security controls will be used is the essential first step before writing an SSP. In the risk management framework, you start by categorizing the system (using the specified criteria to assign impact levels for confidentiality, integrity, and availability). That categorization then guides which baseline controls you select from the control catalog. With those controls chosen, you document in the System Security Plan exactly how each control is implemented, who is responsible, and how it will be assessed and maintained.

Without this upfront categorization and control selection, the SSP would lack a defined scope and the appropriate security controls to describe, making it incomplete or inaccurate. Actions like rebooting the system or conducting routine external audits come later in the lifecycle (assessment/authorization) and aren’t prerequisites for developing the SSP. And claiming that no planning is needed contradicts the need to establish the security controls and their implementation before documenting them.