This control requires your organization to create and maintain a System Security Plan (SSP) that documents key details about how Controlled Unclassified Information (CUI) is protected. The SSP must be reviewed and updated regularly to reflect changes in systems, operations, or security controls.