Skip to main content

Baselines

FedRAMP's baselines are available in OSCAL XML, JSON and YAML formats on the OSCAL Foundation's fedramp-resources GitHub repository.

The OSCAL Foundation is making FedRAMP baselines available both as OSCAL Profiles and as pre-processed "resolved profile" catalogs. Ultimately OSCAL tools should use the OSCAL profiles, but organizations can initially use the "resolved profile" catalogs to reduce complexity and get started more quickly.

See the Concept of Operations below.

Quick Start (MVP/CORE)

Get started quickly by skipping profile resolution processing and instead using "resolved profile" catalogs of the FedRAMP baseliens.

Although OSCAL offers a great deal of flexibility with baselines and overlays, you need to get started quickly and just want a single OSCAL file with the controls for your baseline.

The following OSCAL "resolved profile" catalogs are exactly what you need:

  • FedRAMP HIGH Baseline (OSCAL Catalog) [ XML | JSON | YAML ]
  • FedRAMP MODERATE Baseline (OSCAL Catalog) [ XML | JSON | YAML ]
  • FedRAMP LOW Baseline (OSCAL Catalog) [ XML | JSON | YAML ]
  • FedRAMP LI-SaaS Baseline (OSCAL Catalog) [ XML | JSON | YAML ]

OSCAL Tailoring and Overlays

OSCAL is designed to be referential. It enables tailoring of controls and the ability to overlay controls. The FedRAMP OSCAL profiles are available for these more complex scearios.

The following referential structure is used:

  • A single FedRAMP Rev 5 tailoring profile imports the NIST SP 800-53 Rev 5 catalog. FedRAMP control tailoring that applies to all baselines is performed here.
  • High, Moderate, and Low FedRAMP Rev 5 Profiles each import the FedRAMP Tailoring Profile. Each also identifies the controls for that baseline and include any baseline-speicifc control tailoring.
  • Low-Impact SaaS is a special FedRAMP tailoring of the FedRAMP Low baseline. It imports the FedRAMP Low Profile and tailors it further.

The "resolved profile" catalogs at the top of this page are the result of processing the control selection and tailoring represented here.

Available OSCAL Catalog and Profiles

The following OSCAL catalogs and profiles are available:

  • NIST SP 800-53, Revision 5 (OSCAL Catalog) [ XML | JSON | YAML ]

  • FedRAMP Tailoring Profile (OSCAL Profile) [ XML | JSON | YAML ]

  • FedRAMP HIGH Baseline (OSCAL Profile) [ XML | JSON | YAML ]

  • FedRAMP MODERATE Baseline (OSCAL Profile) [ XML | JSON | YAML ]

  • FedRAMP LOW Baseline (OSCAL Profile) [ XML | JSON | YAML ]

  • FedRAMP LI-SaaS Baseline (OSCAL Profile) [ XML | JSON | YAML ]

Concept of Operations

OSCAL catalogs are used to define controls.

OSCAL profiles are used to establish control baselines, tailor controls, handle control overlays, and aggregate controls from multiple compliance frameworks.

OSCAL tools SHOULD process profiles as the authoritative representation for baselines, tailored controls, overlays, and aggregated controlsframeworks imposed on a specific system.

Pre-Processing and Cacheing

It is possible to pre-process OSCAL profiles and catalogs into a cached result.resolved Theprofile catalog. This result is represented as an OSCAL catalog, referreusing tothe assame a resolved profile catalog.syntax.

This

allows AsThisriskincreases over time and as more frameworks or overlays are applied.

BenefitsTradeoffs
Allows organizations to initially skip profile processing and focus on other aspects of OSCAL adoption.adoption Overlays withand anymultiple caching,frameworks thereare isnot apossible. risk of theThe cached content becommingcan become stale.

Organizations electing to start their OSCAL journey using resolved profilie catalogs are encouraged to add proper profile resolution to your roadmap for future adoption.

Back to top