FedRAMP Security Controls
Control Response: Approaches
OSCAL offers a great deal of flexibility for controls responses. To balance consistency, interope...
Control Response: Flat Approach
The flat approach to control responses is only intended as a starting point for service providers...
Control Response: Normalized Approach
The normalized approach is prefered. Organizations starting new with no legacy SSP content should...
Control Definitions
Conrol definitions are imported by an OSCAL SSP and referenced as needed. Importing a Baseline I...
Responsible Roles
Every control should have one or more responsible roles identified. In OSCAL, there are three op...
Parameter Assignments
Need rework and to cover aggregated parameters Every applicable control must have at least one re...
Implementaiton Status
FedRAMP only accepts only one of five values for implementation-status: implemented, partial, pla...
Control Origination
FedRAMP accepts only one of five values for control-origination: sp-corporate, sp-system, custome...
Control Response Overview
Within the OSCAL-based FedRAMP baselines, control statements and control objectives are tagged w...
Control Responses
Implementation Statements: General Organization: Multi-Part Statements There must be one statemen...
Control Response: Policies and Procedures
The first control in each NIST SP 800-53 control family is a policy and procedure control. These ...
Inheritence and Customer Responsibilities
For systems that may be leveraged, OSCAL enables a robust mechanism for providing both inheritanc...
Example
Within each of the statement assemblies, all responses appear in one or more by-component assembl...