Moreover, the System Security Plan also delineates responsibilities and expected behavior of all individuals who access the system. The System Security Plan should be viewed as documentation of the structured process of planning adequate, cost-effective security protection for a system. Additionally, it should reflect input from various managers with responsibilities concerning the system, including information owners, the system operator, and the system security manager. Additional information may be included in the basic plan and the structure and format organized according to agency needs, so long as the major sections described in the System Security Plan are adequately covered and readily identifiable.

The System Owner is responsible for ensuring that the System Security Plan is prepared and for implementing the plan and monitoring its effectiveness. System Security plans should reflect input from various individuals with responsibilities concerning the system, including functional “end users,” Information Owners, the System Administrator, and the System Security Manager, and all other applicable personnel.