# DoD Contractors Address SSP Assessment Gaps

Community accounts from organizations that have undergone Level 2 assessments point to evidence alignment and control implementation—not SSP drafting alone—as major sources of assessment effort. Reported weaknesses include unclear system boundaries, outdated component descriptions, incomplete coverage of assessment objectives, and gaps between documented and actual practices. One commenter said a cryptographic validation gap took about a year to remediate. Comments also differ on whether an SSP requires a signature: NIST SP 800-18 describes Authorization Official approval, while commenters note that DoD does not use an AO process for these assessments and that NIST SP 800-171 does not expressly require every SP 800-18 practice.

- Contractors preparing for a Level 2 assessment should compare SSP statements with implemented controls and current system boundaries, and check for stale components and missing assessment-objective coverage.
- The reported year-long remediation illustrates that technical control gaps, including cryptographic validation, may require substantially more lead time than document corrections.
- For procurement teams evaluating suppliers, the discussion highlights the value of assessing evidence quality and implementation status—not relying on the SSP document alone.
- Treat SSP signature expectations as a point requiring clarification for the specific assessment context; the comments describe differing interpretations rather than a single settled requirement.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 19, 2026

### Government Entities
- Department of Defense (DoD)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)
- National Institute of Standards and Technology (NIST)

### Key Quotes
> NIST SP 800-18 says that the Authorization Official approves the SSP, so the AO's signature on the SSP can serve as evidence that the AO has approved. But, AFAIK, 800-171 doesn't mandate following every iota of 800-18 or 800-47.
> — Commenter (username not provided)

> We either see disconnects with what is actually done; old language for retired components; tunnel vision (mostly on only local AD); and IT professionals writing English.
> — IlanAldaw (C3PAO)

> It took us (or rather, our outsourced IT operations) about a year to get everything remediated.
> — Commenter (DIBCAC 800-171 assessment experience)

### Sources
- [For those who've done a Level 2 assessment: where did your SSP actually fall apart?](https://www.reddit.com/r/CMMC/comments/1xabm9i/for_those_whove_done_a_level_2_assessment_where) - reddit-cmmc