Baselines

FedRAMP's baselines are available in OSCAL XML, JSON and YAML formats on the OSCAL Foundation's fedramp-resources GitHub repository.

The OSCAL Foundation is making FedRAMP baselines available both as OSCAL Profiles and as pre-processed "resolved profile" catalogs. Ultimately OSCAL tools should use the OSCAL profiles, but organizations can initially use the "resolved profile" catalogs to reduce complexity and get started more quickly.

See the Concept of Operations below.

Quick Start (MVP/CORE)

Get started quickly by skipping profile resolution processing and instead using "resolved profile" catalogs of the FedRAMP baseliens.

Although OSCAL offers a great deal of flexibility with baselines and overlays, you need to get started quickly and just want a single OSCAL file with the controls for your baseline.

The following OSCAL "resolved profile" catalogs are exactly what you need:

• FedRAMP HIGH Baseline (OSCAL Catalog) [ XML | JSON | YAML ]
• FedRAMP MODERATE Baseline (OSCAL Catalog) [ XML | JSON | YAML ]
• FedRAMP LOW Baseline (OSCAL Catalog) [ XML | JSON | YAML ]
• FedRAMP LI-SaaS Baseline (OSCAL Catalog) [ XML | JSON | YAML ]

OSCAL Tailoring and Overlays

OSCAL is designed to be referential. It enables tailoring of controls and the ability to overlay controls. The FedRAMP OSCAL profiles are available for these more complex scearios.

The following referential structure is used:

• A single FedRAMP Rev 5 tailoring profile imports the NIST SP 800-53 Rev 5 catalog. FedRAMP control tailoring that applies to all baselines is performed here.
• High, Moderate, and Low FedRAMP Rev 5 Profiles each import the FedRAMP Tailoring Profile. Each also identifies the controls for that baseline and include any baseline-speicifc control tailoring.
• Low-Impact SaaS is a special FedRAMP tailoring of the FedRAMP Low baseline. It imports the FedRAMP Low Profile and tailors it further.

The "resolved profile" catalogs at the top of this page are the result of processing the control selection and tailoring represented here.

Available OSCAL Catalog and Profiles

The following OSCAL catalogs and profiles are available:

• NIST SP 800-53, Revision 5 (OSCAL Catalog) [ XML | JSON | YAML ]

• FedRAMP Tailoring Profile (OSCAL Profile) [ XML | JSON | YAML ]

• FedRAMP HIGH Baseline (OSCAL Profile) [ XML | JSON | YAML ]

• FedRAMP MODERATE Baseline (OSCAL Profile) [ XML | JSON | YAML ]

• FedRAMP LOW Baseline (OSCAL Profile) [ XML | JSON | YAML ]

• FedRAMP LI-SaaS Baseline (OSCAL Profile) [ XML | JSON | YAML ]

Concept of Operations

OSCAL catalogs are used to define controls. OSCAL profiles are used to establish control baselines, tailor controls, handle control overlays, and aggregate controls from multiple compliance frameworks.

OSCAL tools SHOULD process profiles as the authoritative representation for baselines, tailored controls, overlays, and aggregated frameworks imposed on a specific system.

Pre-ProcessingResolved andProfile CacheingCatalogs

It is possible to pre-process OSCAL profiles and catalogs into a cached resolved profile catalog. This result is represented as an OSCAL catalog, using the same syntax. The OSCAL Foundation has done this for the FedRAMP baselines.