System Security Plan — Self-Assessment

System Security Plan (SSP)

Internal gap analysis mapping all 110 NIST SP 800-171 Rev 2 controls to OCSI's current implementation status, describing system boundaries, data flows, and CUI handling procedures.

Document ID: OCSI-SSP-2026-001 Version: 1.1 (Honest Revision) Classification: CUI Date: April 3, 2026 Owner: Sandra O. Floyd, President & CEO Prepared By: OCSI Internal (AI-Assisted) — Not externally validated

1. System Information

1.1 System Name

OCSI Staffing Operations Platform — Web Application & Command Center

1.2 Organization

OUTSOURCE Consulting Services, Inc. (OCSI)
7901 Oakport Street, North Building, Suite 3800, Oakland, CA 94621
Phone: 1.888.252.OCSI (6274) | Email: sales@ocsi.co

1.3 System Description

The OCSI Staffing Operations Platform is a web-based system consisting of: (a) a public-facing corporate website with information about staffing services, government contracting capabilities, and diversity certifications; (b) a Command Center administrative dashboard for managing candidates, job orders, clients, and placements; and (c) supporting security protocol documentation. The system processes, stores, and transmits information related to government staffing contracts, candidate records, and client data that may include Controlled Unclassified Information (CUI).

1.4 System Boundary

Web Server: GoDaddy shared hosting at ocsi.co (107.180.114.184)
Client-Side Storage: Browser localStorage and sessionStorage for Command Center data
External Services: Google Fonts, FontAwesome CDN (style resources only — no data transmission)
FTP Deployment: Secure FTP to production server

1.5 Information Types

Federal Contract Information (FCI): Contract details, job orders for federal agencies
CUI — Personnel Data: Candidate PII (names, emails, phone numbers, clearance levels)
CUI — Business Confidential: Client account details, placement records, pricing

2. Security Control Implementation Summary

ID	Family	Controls	Implemented	Status	Policy
3.1	Access Control (AC)	22	10	Partial — client-side auth, no RBAC	View
3.2	Awareness & Training (AT)	3	0	Not Implemented	View
3.3	Audit & Accountability (AU)	9	2	Partial — localStorage only, no SIEM	View
3.4	Configuration Management (CM)	9	0	Not Implemented	View
3.5	Identification & Authentication (IA)	11	3	Partial — no MFA, password in source	View
3.6	Incident Response (IR)	3	0	Partial — plan exists, not tested	View
3.7	Maintenance (MA)	6	0	Organizational — no evidence	View
3.8	Media Protection (MP)	9	0	Organizational — no evidence	View
3.9	Personnel Security (PS)	2	0	Organizational — no evidence	View
3.10	Physical Protection (PE)	6	0	Organizational — no evidence	View
3.11	Risk Assessment (RA)	3	1	Partial — doc exists, no scanning	View
3.12	Security Assessment (CA)	4	0	Not Implemented — no C3PAO	View
3.13	System & Comms Protection (SC)	16	3	Partial — HTTPS/CSP, no encryption at rest	View
3.14	System & Info Integrity (SI)	7	0	Partial — input sanitization only	View
	TOTAL	110	16 verified + 14 partial	Significant Gaps — 80 controls need action

3. Roles & Responsibilities

Role	Name	Responsibilities
System Owner	Sandra O. Floyd	Overall accountability for system security; approval authority for SSP
Security Officer	Kit E. Floyd, Jr.	Day-to-day security operations; incident response lead; POA&M management
Business Development	Byron Bush	Federal contract compliance; CUI scope identification; client-facing security documentation
Cybersecurity Assessor	TBD — Not yet engaged	Third-party assessment, vulnerability scanning, penetration testing (external MSSP or equivalent MSSP — engagement pending)

4. Continuous Monitoring Strategy (Planned)

Status: No external cybersecurity partner is currently engaged. The monitoring activities below are targets, not current capabilities. Current monitoring is limited to client-side audit logging in the Command Center.

Planned monitoring program (requires MSSP engagement):

Quarterly: Security control assessments and vulnerability scanning — not yet initiated
Semi-Annual: Penetration testing and SSP review — not yet initiated
Annual: Full NIST 800-171 self-assessment and SPRS score update — first assessment pending
Ongoing: Client-side audit log review (localStorage only — see POA&M for limitations)
As Needed: Incident response and POA&M remediation

C3PAO Assessment: A formal CMMC Level 2 C3PAO assessment has not been scheduled. This SSP is prepared as a gap analysis to support future assessment readiness. Significant remediation (see 13 open POA&M items) is required before assessment.