# Control Origination

FedRAMP accepts only one of five values for `control-origination`:
sp-corporate, sp-system, customer-configured, customer-provided, and
inherited. Hybrid choices are expressed by identifying more than one
`control-origination`, each in a separate prop field.\
For controls with a control-id ending in \"-1\", FedRAMP only accepts
sp-corporate and sp-system.

**If the control origination is inherited,** there must also be a
FedRAMP extension (prop name=\"leveraged-authorization-uuid\"
ns=\"http://fedramp.gov/ns/oscal\") field containing the UUID of the
leveraged authorization as it appears in the
/\*/system-implementation/leveraged-authorization assembly.

[![SSP Template Security Control Origination](https://patterns.rufrisk.com/uploads/images/gallery/2026-02/scaled-1680-/ssp-figure-34.png)](https://patterns.rufrisk.com/uploads/images/gallery/2026-02/ssp-figure-34.png)

##### Representation
```yaml
<system-implementation>
    <!-- status -->
    <leveraged-authorization uuid="uuid-of-leveraged-authorization"> 
        <!-- details cut - see Leveraged Authorizations Section -->
    </leveraged-authorization>
</system-implmentation>

<control-implementation>
    <implemented-requirement uuid="uuid-value" control-id="ac-2">
        <prop name="leveraged-authorization-uuid" 
            value="uuid-of-leveraged-authorization"/>
        <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" 
            value="sp-corporate" />
        <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" 
            value="sp-system" />
        <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" 
            value="customer-configured" />
        <prop ns="http://fedramp.gov/ns/oscal" name="control-origination" 
            value="inherited" />
        <!-- responsible-role -->
    </implemented-requirement>
</control-implementation>
<!-- back-matter -->
```


---