/ssp-section-generate

description: Generate System Security Plan (SSP) sections for NIST 800-53 controls

NIST 800-53 SSP Section Generator

Generates production-ready System Security Plan (SSP) sections for NIST 800-53 controls, including control statements, implementation details, responsible roles, and evidence references in compliance with FedRAMP and NIST templates.

Usage

/nist:ssp-section-generate <control-id> [template] [options]

Arguments

• `$1` - Control ID (e.g., "AC-2", "AU-2") or family (e.g., "AC", "AU")
• `$2` - Template (optional): "fedramp", "nist", "dod", "custom" (default: "fedramp")
• `$3` - Options (optional): `--format=docx|markdown|yaml`, `--include-evidence`

Examples

# Generate single control SSP section
/nist:ssp-section-generate AC-2 fedramp

# Generate entire family
/nist:ssp-section-generate AC fedramp

# Export as Word document
/nist:ssp-section-generate AC-2 fedramp --format=docx

# Include evidence references
/nist:ssp-section-generate AC-2 fedramp --include-evidence

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SSP SECTION: AC-2 - ACCOUNT MANAGEMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Template: FedRAMP Rev 5 Moderate
System: Your Company Cloud Platform
Date: 2025-01-28

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CONTROL SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Control Identifier: AC-2
Control Name: Account Management
Control Family: Access Control (AC)
Baseline: Moderate
Implementation Status: Implemented
Responsible Role: Information Security, IT Operations
Implementation Date: January 2024

Control Enhancements:
  ✓ AC-2(1) - Automated System Account Management
  ✓ AC-2(2) - Removal of Temporary / Emergency Accounts
  ✓ AC-2(3) - Disable Inactive Accounts
  ✓ AC-2(4) - Automated Audit Actions
  ✓ AC-2(9) - Restrictions on Use of Shared Groups / Accounts
  ✓ AC-2(12) - Account Monitoring / Atypical Usage (FedRAMP)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PART A: CONTROL REQUIREMENT (FEDRAMP)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

AC-2: Account Management

The organization:

a. Identifies and selects the following types of information system accounts
   to support organizational missions/business functions: [Assignment:
   organization-defined information system account types];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role
   membership, and access authorizations (i.e., privileges) and other
   attributes (as required) for each account;

e. Requires approvals by [Assignment: organization-defined personnel or roles]
   for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system
   accounts in accordance with [Assignment: organization-defined procedures
   or conditions];

g. Monitors the use of information system accounts;

h. Notifies account managers:
    1. When accounts are no longer required;
    2. When users are terminated or transferred; and
    3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:
    1. A valid access authorization;
    2. Intended system usage; and
    3. Other attributes as required by the organization or associated missions/
       business functions;

j. Reviews accounts for compliance with account management requirements
   [Assignment: organization-defined frequency]; and

k. Establishes a process for reissuing shared/group account credentials
   (if deployed) when individuals are removed from the group.

Control Enhancements:

AC-2(1): The organization employs automated mechanisms to support the management
         of information system accounts.

AC-2(2): The information system automatically [Selection: removes; disables]
         temporary and emergency accounts after [Assignment: organization-
         defined time period for each type of account].

AC-2(3): The information system automatically disables inactive accounts after
         [Assignment: organization-defined time period].

AC-2(4): The information system automatically audits account creation,
         modification, enabling, disabling, and removal actions, and notifies
         [Assignment: organization-defined personnel or roles].

AC-2(9): The organization only permits the use of shared/group accounts that
         meet [Assignment: organization-defined conditions for establishing
         shared/group accounts].

AC-2(12): The organization: (a) Monitors information system accounts for
          [Assignment: organization-defined atypical use]; and (b) Reports
          atypical usage of information system accounts to [Assignment:
          organization-defined personnel or roles].

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PART B: CONTROL IMPLEMENTATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

AC-2: Account Management

Your Company manages information system accounts for the [System Name] through
automated provisioning integrated with our authoritative HR system (BambooHR)
and enterprise identity provider (Okta). This control ensures that access to
organizational information systems is appropriately authorized, monitored, and
reviewed.

AC-2(a) - Account Types

Your Company maintains the following account types to support organizational
missions and business functions:

  1. Workforce Accounts (Individual User Accounts)
     - Purpose: Daily operational access for employees and contractors
     - Authentication: Federated via Okta SSO to AWS IAM Identity Center
     - Lifecycle: Created upon hire, disabled upon termination
     - Count: Approximately 142 active users (as of December 2024)
     - Naming Convention: firstname.lastname@company.com

  2. Service Accounts (Application Accounts)
     - Purpose: Automated system-to-system communication