FedRAMP Deliverables
Representing the FedRAMP Certification Package Overview (CPO) and Security Decision Record (SDO) in OSCAL and translating between OSCAL and the FedRAMP-published bespoke schema. Although also FedRAMP Artifacts, KSIs are receiving separate focus.

CR26 Deliverables Overview
DRAFT - PLEASE PROVIDE INPUT 
 The following is an overview of how the FedRAMP CR26 Deliverables are represented using OSCAL models. 
 
 
 
 
 Certification Package Overview (CPO): 
 
 System details are very similar to legacy SSP front-matter. 
 Requires summary of assessment details found in SDR. This summary is generated from that data. 
 
 Security Decision Record (SDR): 
 
 CSP responds to all applicable FedRAMP Rules (FRRs) for both 20X and Rev 5 paths. 
 20X Path: CSP also defines KSIs Rev 5 Path: CSP also responds to controls. 
 Assessor validates all CSP responses (FRR and either KSI definitions or Rev 5 controls).