CR26 Deliverables Overview

The following is an overview of how the FedRAMP CR26 Deliverables are represented using OSCAL models.

Certification Package Overview (CPO):

• System details are very similar to legacy SSP front-matter.
• Requires summary of assessment details found in SDR. This summary is generated from that data.

Security Decision Record (SDR):

• CSP responds to all applicable FedRAMP Rules (FRRs) for both 20X and Rev 5 paths.
• 20X Path: CSP also defines KSIs Rev 5 Path: CSP also responds to controls.
• Assessor validates all CSP responses (FRR and either KSI definitions or Rev 5 controls).