Title Page, Prepared by/for, Approvers

• Title Page
• Prepared By/For
• System Security Plan Approvals

Title Page

The SSP title page follows the Title Pages pattern.

---

Prepared By/For

Prepared By and Prepared For follow the Roles pattern, using the prepared-by and prepared-for roles.

For an SSP:

• prepared-by may identify the cloud service provider or a thrid party advisory organization
• prepared-for always identifes the cloud service provider

Prepared By - CSP or Self‑Prepared

When the SSP is preapred by the CSP the metadata must include:

• a roles entry with an id of prepared-by
• a parties entry that represents the CSP
• a responsible-parties entry with:
  • a role-id of prepared-by
  • a parties-uuid array with one entry:
    • the uuid value of the CSP entry in the parties array above.

metadata:
  roles:
  - id: prepared-by
    title: Prepared By

  parties:
  - uuid: d865602c-9d3b-49d7-8125-ce3f1ca04231
    type: organization
    name: CSP Name

  responsible-parties:
  - role-id: prepared-by
    party-uuids:
    - d865602c-9d3b-49d7-8125-ce3f1ca04231

Prepared By - Third Party

When the SSP is preapred by an advisory firm, the metadata must include:

• a roles entry with an id of prepared-by
• a parties entry that represents the third party firm
• a responsible-parties entry with:
  • a role-id of prepared-by
  • a parties-uuid array with one entry:
    • the uuid value of the third party firm's entry in the parties array above.

metadata:
  roles:
  - id: prepared-by
    title: Prepared By

  parties:
  - uuid: d865602c-9d3b-49d7-8125-ce3f1ca04231
    type: organization
    name: Third Party Firm Name

  responsible-parties:
  - role-id: prepared-by
    party-uuids:
    - d865602c-9d3b-49d7-8125-ce3f1ca04231

Prepared For

The SSP is always prepared for the CSP. The metadata must include:

• a roles entry with an id of prepared-for
• a parties entry that represents the CSP
• a responsible-parties entry with:
  • a role-id of prepared-for
  • a parties-uuid array with one entry:
    • the uuid value of the CSP entry in the parties array above.

metadata:
  roles:
  - id: prepared-for
    title: Prepared For

  parties:
  - uuid: d865602c-9d3b-49d7-8125-ce3f1ca04231
    type: organization
    name: CSP Name

  responsible-parties:
  - role-id: prepared-for
    party-uuids:
    - d865602c-9d3b-49d7-8125-ce3f1ca04231

System Security Plan Approvals

SSP Approvals follow the Roles pattern, using the content-approver role.

---