Control Implementation Statements

Typically, the controls in the FedRAMP baselines have lettered parts (a., b., etc.). A few only have a top-level statement with no parts. Current FedRAMP templates expect responses at the lettered part level when present and at the top-level otherwise.

OSCAL SSPs cite controls and control requirement statements in responses.

Typical

Most FedRAMP controls have two or more lettered parts. FedRAMP expects control responses at this level.

Within the control-implementation / implemented-requirements array, each entry includes:

• a required uuid field
• a required control-id field that cites the control using its id from the baseline.
• a required statements array. Each array entry includes:
  • a statement-id field that cites the control statement using its id from the baseline.
  • a by-components array
    • See Responding By Component for more information.

Multi-Part Statement Representation

system-security-plan:
  control-implementation:
    implemented-requirements:
    - uuid: 11111111-2222-4000-8000-012000010000
      control-id: ac-1
      statements:
      - statement-id: ac-1_smt.a
        uuid: 11111111-2222-4000-8000-012000010100
        by-components:
          [content cut]

Non-Typical

If there are no lettered parts in the control definition, such as with AC-2 (1), there must be exactly one statement assembly.

Single-Statement Representation

A single-statement representation is identical to a typical multi-part statement representation, except for the following:

• there is only one entry in the statements array
• the statement-id value cites the baseline ID for the statement part itself instead of one of its child parts.

system-security-plan:
  control-implementation:
    implemented-requirements:
    - uuid: 11111111-2222-4000-8000-012000010000
      control-id: ac-2.1
      statements:
      - statement-id: ac-2.1_smt
        uuid: 11111111-2222-4000-8000-012000010100
        by-components:
          [content cut]