Draft the backup section of your System Security Plan
You need SSP language for NIST SP 800-171 requirement 3.8.9 and don't want to start from a blank page.
- You get
- A 150 to 250 word implementation statement, the gaps an assessor would flag, and the evidence to have ready.
- Works in
- ChatGPT
- Claude
- Copilot
- Gemini
Fill in the blanks
A few words each is enough. Leave a blank empty and the assistant will ask you or assume.
Describe, don't paste: no CUI, personal data, hostnames, IP addresses or credentials. What you type stays on this page until you copy it or open it in an assistant.
Your prompt0 of 6 filled
Act as an experienced CMMC Level 2 assessor. Draft our System Security Plan implementation statement for NIST SP 800-171 Rev. 2 requirement 3.8.9, "Protect the confidentiality of backup CUI at storage locations."
Our environment:
- Backup software: [Product and version]
- Where backups are stored: [On-prem / Cloud / GovCloud / Tape]
- Encryption at rest: [Algorithm and who holds the keys, or "none"]
- FIPS-validated encryption: [Yes / No / Not sure]
- Who can access backups: [Roles, and whether MFA is required]
- Restore testing: [How often, e.g. quarterly]
Write 150 to 250 words in the first person plural ("We..."), covering what we do, how, and who is responsible, so it meets the NIST SP 800-171A assessment objective for 3.8.9. Then list:
1. Gaps an assessor would likely flag, including any knock-on effect on 3.13.11 (FIPS-validated cryptography) and 3.13.16 (CUI at rest).
2. The evidence to have ready for each claim in the statement: documents, screenshots or configuration exports.
Only state what I've told you. Mark anything you had to assume with "(assumed)".
Some details above are still in square brackets. Ask me for them before you answer, rather than guessing.Before you paste
Describe your setup, not your data. Never paste CUI, hostnames or credentials into a public AI tool.
Then check the answer
Cyber Resilience Checklist
Check the gaps it finds against the full list
More compliance prompts
All 28 prompts- Find gaps against the 800-171 recovery requirementsBefore a CMMC assessment, you want a quick read on which backup and recovery requirements you can't yet show evidence for.
- Write a POA&M entry for a backup gapYou've found a gap and need a Plan of Action and Milestones entry an assessor will accept.
- Check whether your cloud backup provider can hold CUIYour backups include CUI and go to a cloud service, and you need to know whether that service meets DFARS 7012.
- Prepare for your cyber insurance renewalYour renewal questionnaire asks about backups, and a weak answer can raise your premium or put a claim at risk.
- Answer a customer's security questionnaire about backupsA customer or prime sent a security questionnaire and the backup and recovery section is yours to fill in.
Want a person to check the answer?
AI gets you a first draft. A KELYN engineer can tell you whether it would hold up in an assessment or a real recovery.