FedRAMP Common

While each FedRAMP template has a unique purpose, they share common information elements, such as title and publication date. These common elements are expressed using the same OSCAL syntax for the SSP, SAP, SAR, and POA&M. This section provides OSCAL syntax for these common elements.

Roles

Every FedRAMP assessment package must identify the party (individual, team or organization) responsible for pre-defined roles, such as system owner and information system security officer (ISSO).

Representing this information in OSCAL requires four important elements:

This is represented in OSCAL metadata.

Representation
  metadata:
    roles:
    - id: system-owner
      title: System Owner
    - id: authorizing-official
      title: Authorizing Official

    locations:
    - uuid: 11111111-2222-4000-8000-003000000001
      title: CSP HQ
      address:
        type: work
        addr-lines:
        - Suite 0000
        - 1234 Some Street
        city: Haven
        state: ME
        postal-code: '00000'
        
    parties:
    - uuid: 11111111-2222-4000-8000-004000000003
      type: individual
      name: A. Person
      email-addresses:
      - a.person@example.com
      location-uuids:
      - 11111111-2222-4000-8000-003000000001
    
    responsible-parties:
    - role-id: authorizing-official
      party-uuids:
      - 11111111-2222-4000-8000-004000000003

Canonical Role ID Values

The following values are canonical for roles and must be used for id in roles and role-id in responsible-parties to ensure consistent tool processing:

Roles for All FedRAMP Artifacts
This role ID identifies
prepared-by who prepared the FedRAMP artifact
prepared-for for whom the artifact was prepared
content-approver the individual(s) who approve the content in the FedRAMP artifact as accurate and complete.
Roles for System Security Plan (SSP)
This role ID identifies
cloud-service-provider the Cloud Service Provider's organization
system-owner the CSP officer legally responsible for system
system-poc-management the system's prmariy management contact
system-poc-technical the system's primary technical contact
authorizing-official an Agency's authorizing official (AO)
authorizing-official-poc an Agency's primary point of contact on behalf of the AO.
system-poc-other additional points of contact for the system
information-system-security-officer the individual responsible for the the secure operation of the system
privacy-poc the individual responsible for ensuring appropriate protection of privacy information within the system

For Retrofit MVP, start with just cloud-service-provider and information-system-security-officer.

Roles for Plan of Action and Milestones (POA&M)

To be added in Phase 2

Roles for Security Assessment Plan (SAP)

To be added in Phase 3

Roles for Security Assessment Report (SAR)

To be added in Phase 3

Title Pages

system security plan title page image

All FedRAMP artifacts include a title page. The content found on the title page is represented using core OSCAL content in metadata.

The CSP name is represented using thecloud-service-provider role in SSP Roles.

The CSO name is addressed using the SSP System Information, CSO Name

For assessment artifacts, the assessor name is represented using the assessor role in the SAP Roles.

Additional document markings may be added using additional prop entries with name set to marking and value set to the required marking.

All documents in a digital authorization package for FedRAMP should specify the version that identifies which FedRAMP policies, guidance, and technical specifications its authors used during the creation and maintenance of the package.

Representation
system-security-plan:
  metadata:
    title: \[EXAMPLE\] FedRAMP \[Baseline Name\] System Security Plan (SSP)
    published: '2024-12-31T23:59:59Z'
    last-modified: '2025-01-08T04:18:29Z'
    version: fedramp-3.0.0rc1-oscal-1.1.2
    oscal-version: 1.1.3

    props:
    - name: marking
      value: cui
      class: fedramp.gov

Revision History

Document Revision History

The OSCAL revision history requires one FedRAMP extension to meet FedRAMP’s revision history requirements.

The revision history’s author information is derived from FedRAMP’s party-uuid flag, which points to a metadata party UUID value. The published field accepts the NIST OSCAL data type format. For details, see date-time-with-timezone on the NIST website.

Note: FedRAMP OSCAL requires only the publication date, not the time. You may replace the time portion with all zeros. FedRAMP tools should present only the date in a user-friendly format.

The remarks field is a Markup multiline format, which enables formatting of text and requires special handling.

Representation
revisions:
- published: '2025-03-30T00:00:00Z'
  version: '1.0'
  oscal-version: '1.1.3'
  props:
  - name: party-uuid
    ns: http://fedramp.gov/ns/oscal
    value: 9f411fde-00b2-45b4-8043-129da20ce6dd
  remarks: Initial publication.

  roles:
  - id: prepared-by
    title: Prepared By
    description: Cloud Service Provider

  parties:
  - uuid: 9f411fde-00b2-45b4-8043-129da20ce6dd
    type: organization
    name: Cloud Service Provider

  responsible-parties:
  - role-id: cloud-service-provider
    party-uuids:
    - 9f411fde-00b2-45b4-8043-129da20ce6dd
  - role-id: prepared-by
    party-uuids:
    - 9f411fde-00b2-45b4-8043-129da20ce6dd

Attachments

Attachments

All OSCAL models handle attachments the same way. The following is used to attach files to OSCAL-based FedRAMP artifacts, such as when attaching policies and plans to a System Security Plan (SSP) or evidence to a Security Assessment Report (SAR).

Identifying attachments in an OSCAL FedRAMP SSP, POA&M, SAP or SAR requires:

Attachment Representation
system-security-plan
  back-matter:
    resources:

    - uuid: 11111111-2222-4000-8000-001000000001
      title: Attachment Title
      description: Linked attachment.
      props:
      - name: type
        value: policy
      rlinks:
      - href: ./attachments/policy.pdf
        media-type: application/pdf


    - uuid: 11111111-2222-4000-8000-001000000002
      title: Logo
      description: A Base 64 embeded logo.
      props:
      - name: type
        value: logo
      base64:
        filename: logo.png
        media-type: application/png
        value: '00000000'

Allowed Values

The type property value may only have one of the following allowed values: The value must be one of the following:

Parties and Locations

Individuals, teams, corporations and government agencies are represented in OSCAL metadata using the parties array. Location information can be included within a party's information or defined separately for sharing.

Locations

Define a common location to be associated with multiple parties, or as stand-alone information. In metadata include:

root-model-name
  metadata:

    locations:
    - uuid: 11111111-2222-4000-8000-003000000001
      title: CSP HQ
      address:
        type: work
        addr-lines:
        - Suite 0000
        - 1234 Some Street
        city: Haven
        state: ME
        postal-code: '00000'
Locations for Stand-Alone Information

For locations such as Data Centers that may be expressed in an SSP, POA&M, AP or AR:

root-model-name
  metadata:

    locations:
    - uuid: 11111111-2222-4000-8000-003000000002
      title: Primary Data Center
      address:
        addr-lines:
        - 2222 Main Street
        city: Anywhere
        state: --
        postal-code: 00000-0000
        country: US
      props:
      - name: type
        value: data-center
        class: primary

Parties

In metadata include:

root-model-name
  metadata:

    parties:
    - uuid: 11111111-2222-4000-8000-004000000001
      type: organization
      name: Cloud Service Provider (CSP) Name
      short-name: CSP Acronym/Short Name
      email-addresses:
      - name@example.com
      telephone-numbers:
      - number: '2020000001':
      location-uuids:
      - 11111111-2222-4000-8000-003000000001

Alternatively use addresses instead of location-uuids:


      addresses:
      - type: work
        addr-lines:
        - 1800 F St. NW
        city: Washington
        state: DC
        postal-code: '20006'
        country: US
Logos and Web Sties

To associate a logo or web site with a party:

To identify a web site:

To identify a logo:

root-model-name
  metadata:

    parties:
    - uuid: d865602c-9d3b-49d7-8125-ce3f1ca04231
      type: organization
      name: CSP
  
      links:
      - href: https://csp.example.com
        rel: homepage
      - href: #891263fb-a5d6-44db-8d73-51bb8a9a3610
        rel: logo

  back-matter:
    resources:
    - uuid: 891263fb-a5d6-44db-8d73-51bb8a9a3610
      title: CSP Logo
      description: Logo of the organization that prepared the document.
      props:
      - name: type
        value: logo
      rlinks:
      - href: ./attachments/img/logo.png
      base64:
        filename: logo.png
        media-type: image/png
        value: 00000000

Note: For the logo, use rlink with a relative path or embed the logo as base64.