When small defense contractors first meet CMMC, the System Security Plan and the Plan of Action and Milestones (POA&M) can feel like brand-new paperwork. They aren't. I've been writing them for DoD work for almost 20 years, under four different sets of rules.

Four generations, same core documents

DITSCAP: on the Ground-Based Midcourse Defense program, I wrote System Security Authorization Agreements and SSPs for the Missile Defense Agency.

DIACAP: supporting DISA customers, I prepared system security plans and tracked open findings in POA&M reports.

RMF: on defense training systems, I wrote SSPs under NIST SP 800-53 and backed them with STIG hardening and ACAS scans.

CMMC: today, Level 2 asks contractors to document how they meet the 110 requirements in NIST SP 800-171, in an SSP, with a POA&M for allowed gaps.

The acronyms changed. The core idea didn't: write down how your system is protected, prove it, and track what's still open.

What carried over every time

The SSP has to match reality.…