The System Security Plan documents how required controls are implemented in the actual operating environment. If the SSP describes a theoretical or template state, inconsistencies will surface during assessment.