OSCAL Requirements

All OSCAL Core Requirements must be met for all OSCAL artifacts.

This chapter contains information about OSCAL SSP requirements that are not explicit FedRAMP SSP requirements.

System Status

System Status

FedRAMP no longer includes System Status in the SSP template; however core OSCAL requires the system status to be identified.

The system statys is represented in system-characteristics.

A status entry that includes:
- state field set to one of the allowed values.
- A remarks field is optional if the state is operational. Otherwise, the remarks field must be present.

OSCAL Representation

system-security-plan:
  system-characteristics:
    status:
      state: operational
      remarks: 'Remarks are optional if status/state is "operational".
        Remarks are required otherwise.'

OSCAL Allowed Values

Valid state values:

operational (remarks optional)
under-major-modification (remarks required)
other (remarks required)

Although core OSCAL also allows under-development and disposition (retired), these values do not make sense in a FedRAMP authorization package.