NeQter Labs How to Guides
Converting SSPs Guide
The Convert SSP tool can be found on the compliance homepage once at least one System Security Plan has been generated. The Convert SSP button allows users to generate an ssp with controls filled in with data grabbed from another already created SSP. This is useful for users who wish to have a older ssp update to a newer version or to create a copy of a ssp onto a different framework (going from NIST to CMMC for example). In this guide we will be looking at a step by step example as to how users should utilize our Convert SSP tool.
To begin, you will first need to click on the Convert SSP button found on the Compliance homepage.
Next, click Continue and fill in the following:
Existing SSP: Put in the SSP you’d like to have the data copied from. For example, if you have a NIST SSP called Example used for the Existing SSP, that will mean all control descriptions, tasks and so on will be cloned into the new SSP you generate. The only thing not cloned is Artifacts which will need to be re-inserted Manually.
Name: Give the new SSP you plan to generate a name.
Owner: Assign a owner to the SSP.
Framework: Select what framework you’ll be generating the new ssp as. Depending on the source SSP (which is the ssp found under Existing SSP) you may have a few options available. NIST v1 can be cloned to NIST v2 or CMMC v2, CMMC v1 can do the same. Meanwhile CMMC v2 can only go to NIST v2 and vice versa for NIST v2. CMMC v2 to NIST v2 or CMMC v1 to CMMC v2 / NIST v2 are One to One Copies. Meanwhile NIST v1 to either CMMC v2 or NIST v2 is not one to one due to major differences in controls.
Maturity Level: If using CMMC v2 for the Framework this option will appear. This is where you can select what Level you’d like the SSP plan to be put under.
Once everything is filled out click the Convert button on the bottom of the window.
After completing the conversion process there should now be a new SSP with the name you gave it in your list of SSPs. If you open the SSP you will notice all the controls and descriptions you gave them now copied over to their respective areas as well as each task given a Needs Review tag.
This tag is applied to all controls when converting in order to help users keep track of which controls they’ve reviewed. This is done due to the fact that some controls, especially between revision 1 and revision 2 SSPs, are not always 1 to 1 meaning some controls might be placed into odd locations due to not having an equivalent control. Please make sure to check and see if what is written to each control is exactly what you want / need.
