Skip to main content

Overview

The OSCAL Foundation's FedRAMP TFG is currently focused on three active CR26 workstreams:

  • FedRAMP Published Artifacts: Representation of the FedRAPM Rules (FRRs), Key Security Indicator (KSI) definitions, and Rev 5 Baselines in OSCAL Format. Intended to include code for converting FedRAMP-published JSON to OSCAL. See Mapping: FedRAMP Rules → OSCAL for more information.

  • FedRAMP Certification Deliverables: Representaiton of the Certification Package Overview (CPO) and Security Decision Records (SDRs) in OSCAL Format. IntendedPossibly toincluding include codecapabilities for converting OSCAL to the FedRAMP-published schema files for these artifacts.

DRAFT - PLEASE PROVIDE INPUT

  • The following is a DRAFT depiction of how FedRAMP CR26 native artifacts overlay with OSCAL artifacts.

    • KSI Automation: Representaiton, process support and recommended practices for KSI source definitions, KSI automated collection tooling, KSI telemetry representation in OSCAL, and KSI-driven compliance/risk reporting in OSCAL.

      See Key Security Indicators (KSIs) for more information.
    DRAFT - PLEASE PROVIDE INPUT

    The following is a DRAFT depiction of how FedRAMP CR26 native artifacts overlay with OSCAL artifacts.

    CR26-Artifacts_Native_and_OSCAL.png

    • Back to top