System Status

FedRAMP no longer includes System Status in the SSP template; however core OSCAL requires the system status to be identified.

The system statys is represented in system-characteristics.

A status entry that includes:
- state field set to one of the allowed values.
- A remarks field is optional if the state is operational. Otherwise, the remarks field must be present.

OSCAL Representation

system-security-plan:
  system-characteristics:
    status:
      state: operational
      remarks: 'Remarks are optional if status/state is "operational".
        Remarks are required otherwise.'

OSCAL Allowed Values

Valid state values:

operational (remarks optional)
under-major-modification (remarks required)
other (remarks required)

Although core OSCAL also allows under-development and disposition (retired), these values do not make sense in a FedRAMP authorization package.

Revision #1
Created 2026-03-11 20:23:57 UTC by Brian Ruf
Updated 2026-03-11 21:06:01 UTC by Brian Ruf