# Prepared By/For

<img class="page-image" src="https://patterns.rufrisk.com/uploads/images/gallery/2026-02/ssp-01-prepared-by-for.png" alt="system security plan prepared by, prepared for page image" />




_Prepared By_ and _Prepared For_ follow the [Roles](https://patterns.rufrisk.com/books/fedramp-common/page/roles) pattern, using the `prepared-by` and `prepared-for` roles.

For an SSP:
- `prepared-by` may identify the cloud service provider or a thrid party advisory organization
- `prepared-for` always identifes the cloud service provider

<div class="callout">

**Defined Identifiers**
Required Role IDs:
- `prepared-by`
- `prepared-for`

</div>


##### Prepared By - CSP or Self‑Prepared

When the SSP is preapred by the CSP the `metadata` must include:
- a `roles` entry with an `id` of `prepared-by`
- a `parties` entry that represents the CSP
- a `responsible-parties` entry with:
  - a `role-id` of `prepared-by`
  - a `parties-uuid` array with one entry:
    - the `uuid` value of the CSP entry in the `parties` array above.


```yaml
metadata:
  roles:
  - id: prepared-by
    title: Prepared By

  parties:
  - uuid: d865602c-9d3b-49d7-8125-ce3f1ca04231
    type: organization
    name: CSP Name

  responsible-parties:
  - role-id: prepared-by
    party-uuids:
    - d865602c-9d3b-49d7-8125-ce3f1ca04231
```


##### Prepared By - Third Party

When the SSP is preapred by an advisory firm, the `metadata` must include:
- a `roles` entry with an `id` of `prepared-by`
- a `parties` entry that represents the third party firm
- a `responsible-parties` entry with:
  - a `role-id` of `prepared-by`
  - a `parties-uuid` array with one entry:
    - the `uuid` value of the third party firm's entry in the `parties` array above.


```yaml
metadata:
  roles:
  - id: prepared-by
    title: Prepared By

  parties:
  - uuid: d865602c-9d3b-49d7-8125-ce3f1ca04231
    type: organization
    name: Third Party Firm Name

  responsible-parties:
  - role-id: prepared-by
    party-uuids:
    - d865602c-9d3b-49d7-8125-ce3f1ca04231

```

##### Prepared For

The SSP is always prepared for the CSP. The `metadata` must include:
- a `roles` entry with an `id` of `prepared-for`
- a `parties` entry that represents the CSP
- a `responsible-parties` entry with:
  - a `role-id` of `prepared-for`
  - a `parties-uuid` array with one entry:
    - the `uuid` value of the CSP entry in the `parties` array above.


```yaml
metadata:
  roles:
  - id: prepared-for
    title: Prepared For

  parties:
  - uuid: d865602c-9d3b-49d7-8125-ce3f1ca04231
    type: organization
    name: CSP Name

  responsible-parties:
  - role-id: prepared-for
    party-uuids:
    - d865602c-9d3b-49d7-8125-ce3f1ca04231
```

<div class="callout">
To include location, log or other details for a Party, see <a href="https://patterns.rufrisk.com/books/fedramp-common/page/parties-and-locations">Parties and Locations</a>.</div>