Build a strong, certifiable security plan

We develop or review System Security Plans (SSPs) aligned with NZISM, ensuring your system’s security posture is clearly defined and properly documented.

Talk to an expert

System Security Plan

Assurance and clarity for every stakeholder

Whether you're certifying a new system or updating your documentation, a robust SSP is essential. We engage with project teams, system owners, certifiers, accreditors and other stakeholders to define appropriate controls and ensure your plan reflects your security responsibilities in full.

Aligns to NZISM controls and risk environment
Provides structured input from business and technical owners
Covers stakeholder roles, key security measures and rationale

Service detail

What to expect from a compliant SSP

Every SSP must reflect the system’s scope, classification, risk profile and technical functionality. We work with your team to identify applicable NZISM controls Incorporate any additional controls from your SRMP Address cryptographic controls and key management. Ensure implementation and effectiveness can be assessed. Provide assurance-ready documentation for certification

Control selection and rationale

Tailored to your system, aligned with NZISM

We use the latest NZISM baseline and threat intelligence to guide SSP development. Our consultants identify the relevant controls for your system and provide justification and guidance on how each control is applied.

Based on functionality, classification and threat profile
Includes control rationale and stakeholder responsibilities
Meets NZISM expectations for assessment and accreditation

‍

Our delivery process

Structured development, step by step

From requirements gathering to accreditation, we partner with you every step of the way.

Define system scope and context

We work with project teams, system owners and other stakeholders to understand the business.

Map and justify controls

Using NZISM, we identify mandatory and relevant discretionary controls.

Write and review the SSP

We prepare the SSP document for stakeholder review, audit readiness and certification. Our team can support responses to certifiers or update plans as your system evolves.

Benefits

Proven experience in certified government environments

From complex cloud platforms to legacy systems, we’ve helped New Zealand agencies develop NZISM-compliant SSPs that support accreditation and reduce cyber risk.

NZISM expertise

Our team has deep understanding of NZISM and the latest control baselines —-helping you implement what matters and document it clearly.

Cross-stakeholder alignment

We engage with security, IT, governance and project teams to ensure your SSP reflects the system in practice - not just on paper.

Accelerated certification

By combining strategic guidance with technical insight, we streamline the pathway to certification and reduce rework or delay.

What comes next

Extend your documentation maturity

We can help you move from a single SSP to a full suite of supporting documentation including SRMPs, cryptographic plans, and incident response procedures.

Maintain certification across system changes
Support reaccreditation and stakeholder assurance
Deliver fully integrated documentation for your system

‍

Talk to an expert

Executive and Board Security Governance Training

We train executives and boards on their cybersecurity oversight role — focusing on risk framing, accountability, and key governance responsibilities.

Instructor Led ISO27001 Training

This instructor-led course equips participants with the knowledge and skills needed to become certified to lead, plan, and conduct ISO 27001 audits.

Frequently asked questions

From risk assessment to rapid response - we’re with you every step of the way.

What is a System Security Plan (SSP)?

An SSP outlines the information security controls and responsibilities for a system. It’s used to demonstrate compliance with NZISM and support certification and accreditation.

Who is responsible for contributing to an SSP?

Multiple stakeholders are involved - including system owners, project teams, security leads, IT operations and certification authorities.

What should an NZISM-compliant SSP include?

It should identify relevant controls based on classification, describe how they’re implemented, include key management where applicable, and reflect all stakeholder inputs.

How often should an SSP be reviewed?

SSPs should be reviewed during system change, reaccreditation, or if NZISM is updated. Agencies are encouraged to use the latest baseline version at all times.