FAQ
SSP software questions
What contractors ask before they switch from Word.
SSP = System Security Plan. NIST SP 800-171 §3.12.4 requires it. The SSP documents your system boundary, the 110 controls and their implementation status, your roles and responsibilities, and your POA&M. It's the primary document the C3PAO reads before walking your environment.
L1: 20 minutes via the Auto-Pilot Wizard. L2: depends on how much of your environment is already documented elsewhere. Most contractors finish their initial L2 SSP in a few weeks, depending on your environment. Re-generation after that is instant: click the button, get a new PDF reflecting current state.
No, and you wouldn't want to. The Word SSP's narrative is often outdated; Readyline builds the SSP from your live control assessments, which forces an audit of current truth. You'll re-write each control's narrative once during onboarding, then it stays in sync automatically.
Yes. The export is bookmarked, has a table of contents, full control narrative per family, evidence index, POA&M appendix, asset inventory, and boundary diagram. We benchmark against the format C3PAOs report seeing most often. Custom branding (logo, header/footer) is configurable.
Yes. The C3PAO assessor mode gives them scoped read-only access for the duration of the assessment (default 14 days, configurable). They read the live SSP, the evidence files, the POA&M, and the audit trail of every control assessment. Every page they view is logged.
