Your SSP, asset inventory, network diagram, and evidence should describe the same assessed environment. Review them together whenever the environment or scope changes.
Review the environment across four views
The System Security Plan (SSP) explains the environment and implementation. An inventory identifies assets. A network diagram shows relationships and boundaries. Evidence supports conclusions about what is implemented and operating. Problems arise when each view is maintained by a different owner without a shared change process.
Run a four-way reconciliation
| Comparison | Question to resolve |
|---|---|
| Inventory to diagram | Can the reviewer locate each relevant asset or asset group? |
| Diagram to SSP | Does the narrative explain the boundaries and connections shown? |
| SSP to evidence | Do artifacts support the described implementation? |
| Evidence to inventory | Do records cover the actual scoped assets? |
Use the exercise to identify questions, not to make unsupported conclusions about an assessment result. Some assets are represented as groups; confirm that the grouping is understandable and appropriate for the scope.
Give assets stable names
Choose a naming convention that works across the documents. If the inventory calls a service “DOC-01,” use that reference in the diagram and relevant narrative. A service can keep a business-friendly display name while retaining a stable identifier. This makes it easier to distinguish a renamed asset from a new one.
Document the services around the boundary
Discuss identity, administration, backups, remote support, and outside service providers. A diagram showing only laptops and a cloud icon may leave the operating model unexplained. Record who manages the service, what information it handles, and how it relates to the assessed environment.
Level 2 scoping rules establish asset categories and associated documentation and assessment treatment. Apply those rules to your environment rather than assuming every asset is handled identically. A well-drawn graphic cannot resolve a missing classification decision.
Use AI diagrams as a draft that needs validation
An AI-assisted diagram can make an early workshop easier, but it can also invent connections or overlook a system. Ask the actual administrator and business owner to validate every boundary, service, and data flow. Keep a record of unresolved assumptions until someone can support the decision.
CMMC Pulsar’s public product information describes SSP documentation and AI network-diagram workflows. Evaluate those workflows using a sanitized example and your own review criteria. Product assistance does not establish that the resulting documentation is accurate for your organization.
Make updates part of the change process
When approving a significant system or service change, ask whether the inventory, diagram, SSP, evidence references, and provider responsibilities need updating. Assign the document owner before closing the change. Federal Bid Partners (FBP) can help frame readiness questions; your implementation team must confirm the technical facts.
Common questions
Is a network diagram alone enough?
No. It should align with the inventory, scope decisions, SSP, and applicable assessment evidence.
Can an AI diagram be used without review?
Validate its systems, boundaries, connections, and assumptions against the actual environment before relying on it.
Sources and further reading
- Level 2 asset categories and documentation
- CMMC model and incorporated requirements
- CMMC Pulsar product workflows
Check the current source, applicable contract, and official process before relying on a requirement. Suggested workflows are practical working methods and do not replace official instructions.