Baselines
This page will continue to evolve as the TFG reaches consensus on the best representation.
There are several draft efforts to produce appropriate OSCAL catalogs and profiles representing the FedRAMP Rules (FRR) and certification classes.
These include (in no particular order):
- https://github.com/C1Secure-Development/OSCAL_20x
- https://github.com/Palladium-Innovations/fedramp-cr26-oscal
- https://github.com/brian-ruf/frr2oscal
There has been some discussion around this mapping document, but it remains a draft work-in-progress.
Suggested Hierarchy for OSCAL Catalog/Profile represeentation of FedRAMP's Consolidated Rules 2026 (CR26), including 20x path KSI and Rev 5 path certification baselines.
- For the Rev 5 certificaiton class baselines, FedRAMP defines a few parameters and provides guidance on a few controls.
- Where the defined parameters and guidance are the same for all certification class, they are represented in the Rev 5 Tailoring" profile.
- Where the defined parameters and guidance vary by certification baseline, they are represented in the appropriate Rev 5 Class profile.
- FedRAMP does not allow Class A certifications for the Rev 5 path, thus a Rev 5 Class A profile is not appropriate.