AO coverage. Claims objectives [a], [b], [c], [e], [f], [g], and [h]. Out of scope for this example: [d] (identifying requirements approved as non-applicable) — this OSC's authorizing official has not designated any Level 2 requirement non-applicable, so there is nothing to document and the objective cannot honestly be demonstrated by this pattern. An organization with an approved non-applicable determination should cover [d] with a separate narrative and the approval record.

The plan exists and is owned. The SSP is a set of Markdown files under version control, owned by the ISSO, with pull requests required for changes. Rendering to a PDF for customers is a build step, so the document a customer receives and the document we maintain cannot drift apart.

Boundary. A dedicated section states what is inside the assessment boundary and — just as importantly — what is outside and why: corporate IT that cannot reach the enclave, the guest network, and the separately scoped manufacturing cell. Assets inside the boundary are enumerated by category with counts that reconcile to the asset inventory.

Environment of operation. Describes the physical sites, the hosting model, the identity architecture, network segmentation, the user populations and their roles, and the data flows for CUI from receipt through storage, processing, and transmittal back to the customer. Diagrams are generated from a text source so a diagram change is a reviewable diff.

How each requirement is implemented. Every practice has a narrative describing the actual mechanism, the responsible role, and where the evidence lives — written to be understood by an assessor who has never seen our environment. Practices implemented by an external service provider say so explicitly and name the shared-responsibility split.

Connections to other systems. A table lists every external system with a connection to the boundary: the customer file exchange portal, the provider's remote management platform, the payroll integration, and the backup destination. Each entry names the interface, the data crossing it, the authorization document, and the security requirements imposed.

Update frequency [g] and practice [h]. Policy sets a quarterly review and an immediate update on material change — new system, new connection, changed provider, or a practice implemented differently. Each quarterly review closes with a signed change log entry, even when the conclusion is that nothing changed.

Accepted gap. The manufacturing cell narrative is thinner than the enclave narrative because that scope is still being formalized. Its current state is described honestly rather than aspirationally, and the completion is a plan-of-action item.

• SSP document set with commit history showing quarterly reviews and change reasons
• Boundary section and generated diagram, reconciled to the asset inventory count
• External connections table with the authorization reference for each entry
• Two practice narratives showing mechanism, responsible role, and evidence location
• Signed change log entry from the most recent quarterly review