Overview
The SSP Annex Template is designed to complement a System Security Plan by documenting how security controls are applied to specific systems, environments, and operational contexts. Its purpose is to provide transparency and assurance to accrediting authorities, demonstrating that an organization has implemented appropriate safeguards aligned with government cyber security standards. The template is primarily intended for ICT service providers, government agencies, and organizations seeking accreditation under frameworks such as Right Fit for Risk (RFFR).
This annex is applicable across sectors that manage sensitive or official information, including defense, critical infrastructure, and contracted service providers. It ensures that system-specific risks are identified, controls are mapped to the Australian Information Security Manual (ISM), and any deviations or compensating measures are clearly justified. By using the SSP Annex Template, organizations strengthen their accreditation submissions, improve accountability, and enhance confidence in their overall cyber security posture.