Implementation of Security and Privacy Controls
The implementation domain tests whether you can turn an approved control set into documented, operating practice - and prove it. The core artifact is the System Security Plan (SSP), which must be accurate enough that an independent assessor can test against it.
What implementation requires
- An implementation statement answering how, where, by whom, and with what artifacts - not a restatement of the control text.
- A status for every control: implemented, partially implemented, planned, not applicable, or alternative (compensating).
- Clear separation of inherited/common controls, naming the provider and referencing evidence, from system-specific controls.
- Configuration baselines under CM-2/CM-6 and change control so the SSP tracks reality.
- Integration into the SDLC so new features are assessed before deployment rather than retrofitted.
Worked example
For AU-2 and AU-12, a weak statement says "audit logging is enabled." A defensible one states which event types are logged per the approved parameter, that application and database logs flow to the enterprise SIEM operated by the SOC as a common control, that retention is twelve months, that the ISSO reviews exceptions weekly, and cites the configuration baseline plus a sample SIEM dashboard as evidence. The SCA can now examine, interview, and test against something concrete.
Common control providers
A common control is implemented once and inherited by many systems. The provider must document its implementation and make assessment results available; the inheriting system owner records the inheritance in the SSP and confirms the control is in place. Inheritance is evidence-based, never assumed.
Traps that cost marks
- Marking a control "implemented" when only a policy exists and no mechanism operates.
- Describing vendor capability instead of the agency's actual configuration.
- Inheriting a common control with no evidence anyone assessed it.
- Letting the SSP drift after configuration changes, so assessment findings are really documentation failures.