Module 4 Implementing and Documenting Controls
What you will be able to do
- Describe the sections of a system security plan and what each must contain.
- Write an implementation statement that names who, what mechanism, how often, and where the evidence lives.
- Split a hybrid control into inherited and system-owned parts, using a customer responsibility matrix.
- Review a boundary and data-flow diagram and identify what is missing.
- Recognize when a statement merely restates the control.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. Anatomy of the System Security Plan · 35 min Completed
- 2. Writing Implementation Statements · 50 min Completed
- 3. Documenting Inherited and Hybrid Controls · 45 min Completed
- 4. Boundary and Data Flow Diagrams · 35 min Completed
- 5. Keeping the Plan True · 35 min Completed
Practice and quiz
- Practical exercise: Three Implementation Statements for TreasuryFlow
- Module quiz (10 questions, pass mark 80 percent)
Overview
Module 3 produced a tailored set of controls for TreasuryFlow. This module writes them up. It covers the Implement step of the Risk Management Framework from the point of view of the person who documents it: the system security plan, the implementation statements inside it, the diagrams, and the discipline of keeping all of it accurate.
Writing is the core skill here. An Information System Security Officer (ISSO) who can turn "we do that" into a paragraph an assessor can test in ten minutes is worth a great deal to any program.
Builds on
- Module 3, Lesson 1: reading a control for its separate requirements. Each one needs an answer in the statement.
- Module 3, Lesson 4: the tailoring record, which the plan must match.
- Module 3, Lesson 5: designations. Here they become written entries with the split stated.
- Module 2, Lesson 2: the boundary. Here it becomes a diagram that can be checked.
- Module 0, Lesson 6: reading diagrams, tickets, and logs as evidence.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | Anatomy of the System Security Plan | 35 min | New |
| 2 | Writing Implementation Statements | 50 min | Adapted from existing material |
| 3 | Documenting Inherited and Hybrid Controls | 45 min | Adapted |
| 4 | Boundary and Data Flow Diagrams | 35 min | New |
| 5 | Keeping the Plan True | 35 min | Adapted |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| OMB Circular A-130 | Binding policy | Requires security and privacy plans for systems |
| FIPS 200 | Binding standard | Planning is one of its minimum requirement areas |
| NIST SP 800-53, controls PL-2, PL-8, CM-8, CA-3 | Guidance, required in practice | Selected controls become commitments once in the approved plan |
| NIST SP 800-18 | Guidance | Describes plan content; agencies set their own templates |
| NIST SP 800-37 (Implement step) | Guidance, required in practice | Applied through Circular A-130 |
| NIST SP 800-53A | Guidance | Supplies the determination statements used to check a statement is complete |
| NIST SP 800-218 | Guidance | Secure development practices; some uses are required by OMB policy for software suppliers |
| A cloud provider's customer responsibility matrix | Authoritative for that service | Part of the provider's authorization package; it defines the customer's obligations |
| The agency's security plan template and GRC tool | Agency practice | Binding within the agency |
| The approved security plan itself | Binding on the system's team | It records what the authorizing official approved |
| STRIDE and other threat modeling methods | Not federal authority | Useful techniques |
Module summary
- The plan is the claim, the configuration is the fact, and the assessment is the comparison.
- Every implementation statement answers four questions: who, what mechanism, how often, where the evidence is. Strike the proper nouns; if the control text is all that remains, rewrite it.
- Describe configuration, not intention. Use present tense only for what exists.
- Map the customer responsibility matrix line by line. "The provider offers it" is not "it is on."
- Write hybrid statements in labeled parts. State absences explicitly. Record inherited risk.
- Check diagrams against an independent list of what exists, and make sure they agree with the text.
- Sample your own plan before the assessor does, and keep an evidence index with a refresh cadence.
What comes next
Module 5 turns the tables. You have written the claims; now you learn how an assessor tests them, and how to prepare for and support that test.
Last reviewed 2026-11-11. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.