Lion Cipher Lab
Write a System Security Plan (SSP) for a system you actually run
- GRC / Compliance
- Intermediate
- ~75 min
- Free · no account required
Why it matters
The System Security Plan is the single document every serious security program — and every federal system, every SOC 2 or FedRAMP effort — is built around. It is the master record that says what a system is, exactly where its edges are, and precisely how each security requirement is met. Auditors read it first; auditors who cannot follow it fail you. GRC job listings ask for it by name, and 'can you write a control implementation statement' is a real interview question. Yet almost nobody gets to practice on a real system before their first job. This lab fixes that: you will produce a genuine…
What you'll learn
- System Security Plan (SSP) authoring
- Defining an authorization boundary
- Writing NIST SP 800-53 control implementation statements
- NIST SP 800-18 documentation practice
- GRC artifact production
Steps in this lab
- What an SSP is, in plain language
- The four words you must own first
- Pick a small, real system you actually understand
- Draw the authorization boundary — the make-or-break step
- Categorize the system in one line (how much protection it needs)
- Select a handful of real 800-53 controls to document
- Write implementation statements — adequate vs. a hollow restatement
- Handle the controls you have NOT actually done yet
- Assemble it using the reusable SSP template
- What you just produced — and why it's rare