# Control Implementation Statements

Typically, the controls in the FedRAMP baselines have lettered parts (a., b., etc.). A few only have a top-level statement with no parts. Current FedRAMP templates expect responses at the lettered part level when present and at the top-level otherwise.

OSCAL SSPs cite controls and control requirement statements in responses.

<div class="callout">

  Within the OSCAL FedRAMP baselines, each control statement is assigned an identifier. Any lettered parts are also assigned identifiers. 

Citing statement identifiers correctly is critical to automated processing.  
See [Citing Control Statements](https://patterns.rufrisk.com/books/fedramp-system-security-plan-ssp/page/citing-control-statements) for important information.
  
</div>




### Typical


<img class="page-image" src="https://patterns.rufrisk.com/uploads/images/gallery/2026-04/scaled-1680-/ssp-control-response-3-crop.png" />

Most FedRAMP controls have two or more lettered parts. FedRAMP expects control responses at this level. 

Within the `control-implementation` / `implemented-requirements` array, each entry includes:
- a required `uuid` field
- a required `control-id` field that cites the control [using its id from the baseline](https://patterns.rufrisk.com/books/fedramp-system-security-plan-ssp/page/citing-control-statements).
- a required `statements` array. Each array entry includes:
  - a `statement-id` field that cites the control statement [using its id from the baseline](https://patterns.rufrisk.com/books/fedramp-system-security-plan-ssp/page/citing-control-statements).
  - a `by-components` array
    - See [Responding By Component](https://patterns.rufrisk.com/books/fedramp-system-security-plan-ssp/page/responding-by-component) for more information.



##### Multi-Part Statement Representation
```yaml
system-security-plan:
  control-implementation:
    implemented-requirements:
    - uuid: 11111111-2222-4000-8000-012000010000
      control-id: ac-1
      statements:
      - statement-id: ac-1_smt.a
        uuid: 11111111-2222-4000-8000-012000010100
        by-components:
          [content cut]

```

---
### Non-Typical

If there are no lettered parts in the control definition, such as with
AC-2 (1), there must be exactly one statement assembly.

##### Single-Statement Representation

[![ssp_control_response_1_crop.png](https://patterns.rufrisk.com/uploads/images/gallery/2026-04/scaled-1680-/ssp-control-response-1-crop.png)](https://patterns.rufrisk.com/uploads/images/gallery/2026-04/ssp-control-response-1-crop.png)

A single-statement representation is identical to a typical multi-part statement representation, except for the following:
- there is only one entry in the `statements` array
- the `statement-id` value cites the baseline ID for the `statement` part itself instead of one of its child parts.


```yaml

system-security-plan:
  control-implementation:
    implemented-requirements:
    - uuid: 11111111-2222-4000-8000-012000010000
      control-id: ac-2.1
      statements:
      - statement-id: ac-2.1_smt
        uuid: 11111111-2222-4000-8000-012000010100
        by-components:
          [content cut]


```





---