FedRAMP System Security Plan (SSP)
Adopting OSCAL for SSP Representation
Adoption Strategies
The best way to adopt OSCAL for your system depends on your circumstances. The OSCAL Foundation d...
Retrofit Adoption Path
If you need to convert legacy documentation to OSCAL, follow this path. If you are approaching OS...
New Adoption Path
If you are approaching OSCAL to intially create your system security plan and do not have legacy ...
OSCAL Requirements
All OSCAL Core Requirements must be met for all OSCAL artifacts. This chapter contains informat...
Title Page, Prepared by/for, Approvers
Title Page
The SSP title page follows the Title Pages pattern.
Prepared By/For
"Prepared by" and "Prepared for" follow the Roles pattern, using the prepared-by and prepared-fo...
System Security Plan Approvals
SSP Approvals follow the Roles pattern, using the content-approver role. Defined Identifiers Re...
Sections 1 - 11
1. Introduction
This entire chapter is FedRAMP PMO boilerplate and does not need to be represented in OSCAL conte...
2. Purpose
This entire chapter is FedRAMP PMO boilerplate and does not need to be represented in OSCAL conte...
3. System Information
System Information CSP Name The cloud service provider (CSP) name and abbreviation are represent...
4. System Owner
System Owner follows the Roles pattern, using the system-owner role. Defined Identifiers Requir...
5. Assignment of Security Responsibility
Information System Security Officer (ISSO) follows the Roles pattern, using the information-syst...
6. Leveraged FedRAMP-Authorized Services
The leveraged FedRAMP-Authorized services table is used to list both underlying leveraged authori...
7. External Systems and Services Not Having FedRAMP Authorization
FedRAMP authorized services should be used, whenever possible, since their risk is defined. Howe...
8. Illustratred Architecture and Narratives
The Architecture, Network and Data Flow Diagramss are each represented using the same OSCAL patte...
9. Services, Ports and Protocols
Entries in the services, ports, and protocols table are represented as component assemblies, with...
10. Cryptographic Modules Implemented for DAR and DIT
This is address in Appendix Q: Cryptographic Modules.
11. Seperation of Duties Matrix
Appendices A - Q
Appendicies Overview
Most attachments required by FedRAMP are called out in the NIST SP 800-53 controls appearning in ...
Appendix A: FedRAMP Security Controls
See [Controls citation and link]
Appendix B: Related Acronyms
There is no OSCAL construct for representing an acronyms list. Attach a document (e.g., Word, Exc...
Appendix C: Security Policies and Procedures
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix D: User Guide
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix E: Digital Identity Level (DIL) Determination
The Digital Identity Level (DIL) is represented on the page below. Within system-characteristics...
Appendix F: Rules of Behavior (RoB)
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix G: Information System Contingency Plan (ISCP)
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix H: Configuration Management Plan (CMP)
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix I: Incident Response Plan (IRP)
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix J: CIS and CRM Workbook
The FedRAMP Control Information Summary (CIS) and Customer Responsibility Matrix (CRM) are derive...
Appendix K: FIPS-199 Worksheet
The system's overall FIPS-199 impact level is determined primarily by the sensitivity of the info...
Appendix L: CSO-Specific Required Laws and Regulations
Needs Work Content cleanup YAML Example For MVP: attach a Word or PDF document enumerating t...
Appendix M: Integrated Inventory Workbook
See Inventory Approaches for guidance.
Appendix N: Continuous Monitoring Plan
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix O: POA&M
See the FedRAMP POA&M book.
Appendix P: Supply Chain Risk Management Plan (SCRMP)
This needs work that may have been completed elsewhere and nees to be moved into here. This ...
Appendix Q: Cryptographic Modules
Cryptographic Modules Implemented for Data-in-Transit (DIT) This page needs work: The examples ...
System Components and Inventory
Inventory Approaches
OSCAL makes two approaches available for depicting the system inventory: Flat Approach: Aligns ...
Inventory: Flat Approach
The flat approach to inventory is only intended as a starting point for service providers convert...
Inventory: Normalized Approach
The normalized approach is prefered. Organizations starting new with no legacy inventory reportin...
FedRAMP Security Controls
Control Response: Approaches
OSCAL offers a great deal of flexibility for controls responses. To balance consistency, interope...
Control Response: Flat Approach
The flat approach to control responses is only intended as a starting point for service providers...
Control Response: Normalized Approach
The normalized approach is prefered. Organizations starting new with no legacy SSP content should...
Control Definitions
Conrol definitions are imported by an OSCAL SSP and referenced as needed. Importing a Baseline I...
Responsible Roles
Every control should have one or more responsible roles identified. In OSCAL, there are three op...
Parameter Assignments
Need rework and to cover aggregated parameters Every applicable control must have at least one re...
Implementaiton Status
FedRAMP only accepts only one of five values for implementation-status: implemented, partial, pla...
Control Origination
FedRAMP accepts only one of five values for control-origination: sp-corporate, sp-system, custome...
Control Response Overview
Within the OSCAL-based FedRAMP baselines, control statements and control objectives are tagged w...
Control Responses
Implementation Statements: General Organization: Multi-Part Statements There must be one statemen...
Control Response: Policies and Procedures
The first control in each NIST SP 800-53 control family is a policy and procedure control. These ...
Inheritence and Customer Responsibilities
For systems that may be leveraged, OSCAL enables a robust mechanism for providing both inheritanc...
Example
Within each of the statement assemblies, all responses appear in one or more by-component assembl...