FedRAMP Security Controls
Control Response: Approaches
OSCAL offers a great deal of flexibility for controls responses. To balance consistency, interope...
Control Response: Flat Approach
The flat approach to control responses is only intended as a starting point for service providers...
Control Response: Normalized Approach
The normalized approach is prefered. Organizations starting new with no legacy SSP content should...
Responding to Control Baselines
OSCAL references controls in baselines and catalogs. The statements are not duplicated into an O...
Responsible Roles
Every control should have one or more responsible roles identified. In OSCAL, there are three po...
Parameter Assignments
Representation If a FedRAMP control has one or more parameters, add a set-parameters array Withi...
Implementaiton Status
FedRAMP only accepts only one of five values for implementation-status: implemented, partial, pla...
Control Origination
FedRAMP accepts only one of five values for control-origination: sp-corporate, sp-system, custome...
Responding By Component
OSCAL SSPs represent control responses in control-implementation / implemented-requirements / st...
Control Implementation Statements
Typically, the controls in the FedRAMP baselines have lettered parts (a., b., etc.). A few only h...
Control Response: Policies, Procedures, Plans, RoB, and Guides
Most FedRAMP-required attachments derive their requirement from one or more NIST SP 800-53 contro...
Inheritence and Customer Responsibilities
For systems that may be leveraged, OSCAL enables a robust mechanism for providing both inheritanc...
Citing Control Statements
OSCAL SSPs cite OSCAL baseline statement identifiers when representing control implementation res...