eTrepid Corporate System Security Plan (SSP) Executive Summary
Governing Standard: NIST SP 800-171 Rev 2 / CMMC Level 2
1. System Identification and Operational Scope
This document provides a public executive summary of the System Security Plan (SSP) for eTrepid Inc.'s internal corporate network, sovereign cloud enclaves, and managed security operations environment.
Restricted Companion Notice: The complete, unredacted System Security Plan (ETP-SSP-2026-v2), including specific boundary network topologies, hardware inventories, IP subnets, and POA&Ms, contains proprietary and security-sensitive information. It is made available exclusively under NDA to authorized client assessors and federal contracting officers via our secure customer assurance review process.
2. NIST SP 800-171 Rev 2 Control Family Summary
The eTrepid environment is architected to satisfy all 110 requirements of NIST SP 800-171 Rev 2 across the 14 security families:
| Control Family | Family Code | Public Implementation Overview |
|---|---|---|
| Access Control | AC | Role-based least-privilege, automated session timeouts, and conditional access policies enforcing trusted devices. |
| Awareness & Training | AT | Mandatory onboarding security awareness, quarterly role-based training, and simulated phishing assessments. |
| Audit & Accountability | AU | Centralized immutable log collection, automated audit log correlation, and 24/7 SOC telemetry analysis. |
| Configuration Mgmt | CM | Enforced CIS Benchmark hardening baselines, automated software restriction policies, and formal change control. |
| Identification & Auth | IA | Mandatory FIDO2 hardware MFA, unique user identification, and prohibition of shared accounts. |
| Incident Response | IR | Codified incident handling procedures, 24/7 on-call containment team, and 72-hour DoD DC3 reporting capability. |
| Maintenance | MA | Multifactor-authenticated remote maintenance with full session recording and automated diagnostic tool vetting. |
| Media Protection | MP | Full-disk AES-256 encryption across all storage, cryptographic sanitization, and strict media transport controls. |
| Personnel Security | PS | Rigorous pre-employment screening, criminal background investigations, and formal offboarding access revocation. |
| Physical Protection | PE | Keycard access control, visitor logs, and physical surveillance at all eTrepid administrative facilities. |
| Risk Assessment | RA | Weekly vulnerability scans, formal risk registers, and threat modeling of all new tool integrations. |
| Security Assessment | CA | Continuous monitoring, periodic self-assessments, and formal mock audits aligned with CMMC Level 2. |
| System & Comms Protection | SC | FIPS 140-validated encryption for all transport, micro-segmentation, and Zero Trust boundary inspection. |
| System & Info Integrity | SI | Next-gen Endpoint Detection and Response (EDR), automated flaw remediation, and real-time malicious code blocking. |
3. SPRS Posture & Assessment Inquiries
eTrepid maintains an active DoD Supplier Performance Risk System (SPRS) score reflection meeting high-assurance thresholds. Prospective defense clients may request our SPRS summary and ESP assessment package via the eTrepid Sovereign Trust Center Intake Form (Select Topic: SPRS / Clearance Enclave Token Review).
🔒 Restricted Technical Companion Available
This document is an executive summary of a restricted operational standard. Qualified defense contractors and certified C3PAO assessment teams subject to CMMC Level 2 or NIST SP 800-171 audits may request unredacted inspection under our mutual non-disclosure agreement.