About SSP
List of system security plans supported
Purpose
A system security plan comprises the implementable controls based on system characteristics. The current types of systems include:
Low-Risk Cloud
Low-Risk On-Premises
Medium-Risk Cloud
High-Risk Cloud CII
Digital Services (Others)
Digital Services (High Impact)
Sandbox
Agencies and their industry partners are required to assess the risks and threats for each of their systems, to determine the controls required to mitigate the risks.
Control Levels
Profile Level 0
These are Cardinal and Mandatory requirements.
Profile Level 1
These are basic hygiene process and technical control requirements, including toolings with alternatives. Agencies and industry partners are to assess and apply the controls in accordance with its risk impacts.
Profile Level 2
These are best practices for Agencies to consider and adopt where required.
The SSPs were last updated on 16 September 2025.
