Required Attachments
Most attachments required by FedRAMP are called out in the NIST SP 800-53 controls appearning in FedRAMP baselines.
Where a legacy FedRAMP attachment is handled as machine-readable content, you have the option of attaching the legacy attachment or representing the content as machine-readable content.
FedRAMP SSP attachments include a mix of items. Some lend well to machine-readable format, while others do not.
Machine-readable content is typically addressed within the OSCAL-based FedRAMP SSP syntax, while policies, procedures, plans, guidance, and the rules of behavior documents are still treated as attachments within an OSCAL SSP.
See the Document Attachments section for general attachment patterns as OSCAL resources.
For reqluired FedRAMP SSP attachments, the resource title and description must provide a human-readable indicator the attachment being referenced. OSCAL extensions are also used to identify required FedRAMP attachments, which aids automated completeness checks and workflows.
The following table describes how each attachment is handled:
| Appendix Name | Machine Readable | How to Handle in OSCAL |
|---|---|---|
| Appendix A: FedRAMP Security Controls | Yes | This is generated from the content in the Security Controls section and is not maintained as a separate attachment in an OSCAL SSP. |
| Appendix B: Related Acronyms | No | Attach using the back-matter, resource syntax.For Acronyms, resource must include a prop with @ns="http://fedramp.gov/ns/oscal", @name="type", and @value="fedramp-acronyms". |
| Appendix C: Security Policies and Procedures | No | -1 control (i.e. AC-1, IA-1) use links to identify the |
| Appendix D: User Guide | No | id=sa-5) use |
| Appendix E: Digital Identity Worksheet | Yes | See the Digital Identity Determination section. |
| Appendix F: Rules of Behavior | No | id=pl-4) use |
| Appendix G: Information System Contingency Plan (ISCP) | No | id=cp-2) use |
| Appendix H: Configuration Management Plan (CMP) | No | id=cm-9) use |
| Appendix I: Incident Response Plan (IRP) | No | id=ir-8) use |
| Appendix J: CIS and CRM Workbook | Yes | This can be generated from the content in the Security Controls section and does not need to be maintained separately or attached. |
| Appendix K: FIPS 199 Worksheet | Yes | See the System Sensitivity Level (FIPS-199) section. |
| Appendix L: CSO-Specific Required Laws and Regulations | No | Attach using the back-matter, resource syntax.For CSO-Specific Required Laws and Regulations, resource must include a prop with @name=”type” and @value=”law”. |
| Appendix M: Integrated Inventory Workbook | Yes | See the System Inventory section. |
| Appendix N: Continuous Monitoring Plan | No | id=ca-7) use |
| Appendix O: POA&M | Yes | This is maintained separately in an OSCAL POA&M but can be attached using the back-matter, resource syntax.For POA&M, resource must include a prop with @name=”type”, @value="plan", and @class="poam". |
| Appendix P: Supply Chain Risk Management Plan (SCRMP) | No | id=sr-2) use |
| Appendix Q: Cryptographic Module Table | Yes | See the Cryptographic Modules section dealing with components. |