Skip to main content

System Status

FedRAMP no longer includes System Status in the SSP template; however core OSCAL requires the system status to be identified.

The system statys is represented in system-characteristics.

  • A status entry that includes:
    • state field set to one of the allowed values.
    • A remarks field is optional if the state is operational. Otherwise, the remarks field must be present.

OSCAL Representation

system-security-plan:
  system-characteristics:
    status:
      state: operational
      remarks: 'Remarks are optional if status/state is "operational".
        Remarks are required otherwise.'

OSCAL Allowed Values

Valid state values:

  • operational (remarks optional)
  • under-major-modification (remarks required)
  • other (remarks required)

Although core OSCAL also allows under-development and disposition (retired), these values do not make sense in a FedRAMP authorization package.

No comments to display

Back to top