Which item is NOT typically part of a System Security Plan (SSP)?

• A. System description, architecture, boundary, roles, controls, procedures, and assessment results.
• B. Security requirements traceability matrix and control mapping.
• C. Financial budgeting and procurement history.
• D. Incident response procedures and testing results.

Answer: (C)

In an SSP, the focus is documenting how the system is secured and operated. The description of the system—its architecture, boundaries, roles, the security controls in place, the procedures to follow, and the results of assessments—provides a clear, auditable picture of the system’s security posture. A security requirements traceability matrix and control mapping show exactly how each requirement is addressed by specific controls, ensuring there’s traceable coverage. Incident response procedures and testing results demonstrate how the organization detects, responds to, and tests incidents, which is essential for ongoing security operations and risk management.

Financial budgeting and procurement history, on the other hand, cover cost and acquisition activities rather than the security controls and their implementation. While budgets can influence security resources, they don’t describe the security architecture or the system’s protective measures, so they aren’t typically part of an SSP.