FedRAMP SSP Generator

Infracast automatically generates System Security Plans (SSPs) following FedRAMP and NIST 800-171 templates, pulling data directly from live infrastructure discovery and compliance assessments.

Overview

Writing an SSP is one of the most time-consuming parts of a FedRAMP authorization. Infracast eliminates manual narrative writing by generating implementation statements for each control family using real infrastructure data — then packaging everything into a ready-to-submit compliance bundle.

What Gets Generated

System Security Plan Document

• Cover page and metadata — System name, system owner, ISSO, authorization boundary
• Authorization boundary figure — Generated from discovered configuration, showing what is inside the boundary, what is external, and every crossing (details below)
• Table of contents — Clickable entries with page numbers, computed automatically when the .docx is opened in Word or LibreOffice (no manual "Update Field" step)
• Named responsible parties — System Owner, ISSO, ISSM, Authorizing Official and AO Designated Representative are pulled from your workspace contacts registry (Settings → Contacts), along with Business and Technical POC on the cover page. Roles you have not designated render as "Not designated" rather than a placeholder, so a gap is visible before an assessor finds it.
• System description — Auto-populated from discovered assets and topology
• 18 NIST 800-53 Control Families — Per-control implementation narratives based on your actual configuration
• Control origination — Inherited, system-specific, hybrid (mapped from cloud provider shared responsibility)
• Information types and categorization — FIPS 199 impact levels

Authorization Boundary Figure

FedRAMP SSP §9 and §10 require a diagram showing what is inside the authorization boundary, what is outside it, and every connection that crosses it. Infracast generates this figure directly from discovered configuration — it is not a template you fill in.

The figure renders three groups:

• Inside the boundary — resources resolved into a discovered network zone, drawn grouped by zone.
• External dependencies — SaaS, identity providers and partner services, grouped by provider. These sit outside the boundary line.
• Undetermined — resources that could not be placed, grouped by provider and drawn explicitly.

Every edge crossing the boundary line is rendered as a boundary crossing, which is the list an assessor works through.

It tells you what it does not know

The undetermined group is the point, not a defect. An earlier revision counted unplaced resources in the caption and drew them nowhere — a reviewer could see that 58 resources were unplaced but had no way to find out which ones. Anything not placed is now drawn and labelled.

The figure also distinguishes two situations that look identical if you render them the same way:

• No network zone by nature — an identity plane or an application-layer service that legitimately has no subnet. Labelled so it does not read as a discovery failure.
• Zone not discovered — a resource that should have a network placement where discovery did not find one. This one is a real gap worth chasing.

If a whole provider appears as unzoned, that usually means its scanner is emitting inventory without relationships. That is worth raising with us — it also affects attack-path analysis, which depends on those relationships.

Provenance

The figure carries a provenance strip rendered inside the image, recording that it was generated from discovered configuration and when the scan ran. It is drawn inside the image deliberately, so the statement survives the figure being cropped into a slide deck or pasted into another document — a diagram that has been separated from its caption should still be able to say where it came from.

tip

Generate this figure early, before an assessment rather than during one. It is the fastest way to find out that part of your estate is not being discovered the way you assumed — while there is still time to fix it.

Per-Control Implementation Narratives

Infracast generates implementation statements for all 18 NIST 800-53 control families:

Family	Code	Examples
Access Control	AC	IAM policies, role assignments, least privilege posture
Audit & Accountability	AU	CloudTrail, log retention, monitoring
Configuration Management	CM	Baseline configs, drift detection, change control
Identification & Authentication	IA	MFA enforcement, password policy, service accounts
Incident Response	IR	Alert integrations, SIEM connectivity
Risk Assessment	RA	Vulnerability scanning, threat intel correlation
System & Communications Protection	SC	Encryption in transit/at rest, network segmentation, DNS security
System & Information Integrity	SI	Patch status, malware protection, vulnerability remediation
(and 10 more families)

Narratives reference specific assets, configurations, and evidence artifacts found during discovery — not generic boilerplate.

Compliance Package Export (ZIP)

The exported ZIP contains:

• SSP.docx — Full System Security Plan
• asset-inventory.xlsx — Complete node inventory with asset types, IPs, and owner tags
• POA&M.xlsx — Open findings with remediation milestones
• architecture-diagrams/ — Authorization boundary, system boundary, network zone, and data flow diagrams (PNG, with SVG alongside)
• evidence-bundle/ — Ed25519-signed evidence artifacts for each control

Generating an SSP

1. Navigate to Compliance → SSP Generator
2. Select your authorization baseline (FedRAMP Low / Moderate / High or NIST 800-171)
3. Review pre-populated system metadata (edit any fields as needed)
4. Click Generate SSP
5. Download the compliance package ZIP when complete (typically 2–5 minutes)

Via API

# Trigger SSP / compliance package generation
POST /api/v1/tenants/{tenantID}/documents/generate-package
Authorization: Bearer <token>
Content-Type: application/json

{
  "baseline": "fedramp-moderate",
  "system_name": "My Cloud System",
  "system_owner": "Jane Smith",
  "isso": "John Doe"
}

# Response includes a job_id for polling
{
  "job_id": "job-abc123",
  "status": "pending",
  "estimated_seconds": 120
}

# Poll for completion
GET /api/v1/tenants/{tenantID}/jobs/{jobID}

# Stream job log output
GET /api/v1/tenants/{tenantID}/jobs/{jobID}/stream

# Once complete, download the document
GET /api/v1/tenants/{tenantID}/documents/{documentID}/download

API paths corrected 2026-09-14

The previously documented /api/v1/ssp/ paths do not exist. SSP generation goes through the document generation pipeline at /api/v1/tenants/{tenantID}/documents/generate-package, with job status at /api/v1/tenants/{tenantID}/jobs/{jobID}.

Supported Baselines

Baseline	Controls	Use Case
FedRAMP Low	125 controls	Low-impact cloud systems
FedRAMP Moderate	325 controls	Most federal cloud systems
FedRAMP High	421 controls	High-impact / sensitive data
NIST 800-171	110 practices	CUI / CMMC compliance

Compliance Mapping

The SSP Generator is particularly relevant for:

Framework	Benefit
FedRAMP	ATO package accelerator — SSP is a core authorization artifact
CMMC	NIST 800-171 practice implementation statements
DISA RMF	System description and control implementation docs
NIST 800-53	Per-control implementation evidence

Tips for Better SSPs

• Run a full discovery first — The more assets Infracast knows about, the richer the narratives
• Resolve critical findings — Open findings appear in the POA&M section; fewer findings = stronger SSP
• Tag your assets — Owner, environment, and data classification tags improve the asset inventory output
• Review narratives before submitting — AI-generated text is a starting point; review with your ISSO before submission to a 3PAO