Skip to main content

Roles

FedRAMP documentation hasestablished several well definedspecific roles for every assessment package where the responsibleparty party(individual, team or organization) must be identifyied.identified.

These

Representing arethis eachinformation in OSCAL requires four important elements:

  • Define roles
  • Deine parties (individuals, teams, organizations)
  • Link roles to parties using responsible-parties
  • Use canonical role ID values for FedRAMP required roles

This is represented the same way in OSCAL metadata.

  • A roles entry must exist that includes:
    • id with an allowed value
    • title with a human-readable name for the role
  • One or more parties entries must exist that includes:
    • uuid with a unique value
    • type with a value of individual or organization
    • name with the name of the person, team or organization.
    • other fields as needed, such as email-addresses, telephone numbers or addresses. (See below)
  • A responsible-parties entry must exist that includes:
    • role-id with the same value as in roles/id above.
    • party-uuids array with one or more UUIDs that reference parties entries above.
  • Optional locations entries that can be linked from party entries
Representation
  metadata:
    roles:
    - id: system-owner
      title: System Owner
    - id: authorizing-official
      title: Authorizing Official

    locations:
    - uuid: 11111111-2222-4000-8000-003000000001
      title: CSP HQ
      address:
        type: work
        addr-lines:
        - Suite 0000
        - 1234 Some Street
        city: Haven
        state: ME
        postal-code: '00000'
        
    parties:
    - uuid: 11111111-2222-4000-8000-004000000003
      type: individual
      name: AnthonyA. OfficialPerson
      email-addresses:
      - a.person@example.com
      location-uuids:
      - 11111111-2222-4000-8000-003000000001
    
    responsible-parties:
    - role-id: authorizing-official
      party-uuids:
      - 11111111-2222-4000-8000-004000000003

Canonical Role ID Values

The following values are canonical for roles and must be used for id in roles and role-id in responsible-parties to ensure consistent tool processing:

    Roles
  • for All FedRAMP Artifacts
    • This role IDidentifies
    prepared-bywho prepared the FedRAMP artifact
    prepared-forfor whom the artifact was prepared
    Roles for System Security Plan (SSP)
    Thethissystem.
  • The
  • system-poc-management:
    • Theprimary management-level point of contact (POC) for the system.
  • system-poc-technical: The primary technical point of contact (POC) for the system.
  • Otherthatisnot the management or technical POC.
  • The
    This role IDidentifies
    cloud-service-providerthe Cloud Service Provider's organization
    system-ownerthe CSP officer legally responsible for system
    system-poc-managementthe system's prmariy management contact
    system-poc-technicalthe system's primary technical contact
    authorizing-official: an Agency's authorizing official for(AO)
    authorizing-official-poc: an authorizing official'Agency's designatedprimary point of contact (POC)on forbehalf this system.
  • system-owner: The executive ultimately accountable forof the system.
    • AO.
    system-poc-other: additional pointpoints of contact (POC) for the system
    information-system-security-officer: the primaryindividual roleresponsible for the the secure operation of the system
    privacy-pocthe individual responsible for ensuring theappropriate organization operates the system securely.
  • privacy-poc: The pointprotection of contact (POC) responsible for identifying privacy information within the system,system
    • Roles for Plan of Action and ensuringMilestones its(POA&M)
    protection if present.

Where use cases require roles that have no canonical value, other values may be used; however, we encourage engagement with the OSCAL Foundation on additional role values to increase consistency of role values across tools.

Roles for Security Assessment Plan (SAP)
XPathRoles Queriesfor Security Assessment Report (SAR)
  • Authorizing Official Details: /*/metadata/party[@id=[/*/metadata/responsible-party[@role-id='authorizing-official']/party-id]]/name

NOTE: Replace "name" with "address/addr-line", "address/city", "address/state", or "address/zip" as needed. There may be more than one addr-line.

Back to top