Recently Updated Pages
Inventory: Normalized Approach
The normalized approach is prefered. Organizations starting new with no legacy inventory reportin...
Responding By Component
OSCAL SSPs represent control responses in control-implementation / implemented-requirements / st...
Control Implementation Statements
Typically, the controls in the FedRAMP baselines have lettered parts (a., b., etc.). A few only h...
Responding to Control Baselines
OSCAL references controls in baselines and catalogs. The statements are not duplicated into an O...
Retrofit Adoption Path
If you need to convert legacy documentation to OSCAL, follow this path. If you are approaching OS...
SSP Adoption Strategies
The best way to adopt OSCAL for your system depends on your circumstances. The OSCAL Foundation d...
Native Adoption Path
If you are approaching OSCAL to intially create your system security plan and do not have legacy ...
The Tiered Validation Model
Validating OSCAL content is a tiered process that ensures data integrity from basic file structur...
Appendix A: FedRAMP Security Controls
See the FedRAMP Security Controls chapter.
Appendix C: Security Policies and Procedures
See Control Response: Policies and Procedures.
Appendix M: Integrated Inventory Workbook
See Inventory Approaches for guidance.
Control Response: Approaches
OSCAL offers a great deal of flexibility for controls responses. To balance consistency, interope...
Control Response: Normalized Approach
The normalized approach is prefered. Organizations starting new with no legacy SSP content should...
Control Response: Flat Approach
The flat approach to control responses is only intended as a starting point for service providers...
Defining Allowed Values
This page is still under development. The <allowed-values> assembly provides a consistent and una...
Components
OSCAL component are the backbone of an OSCAL System Security Plan (SSP), enabling data normalizat...
Roles
Every FedRAMP assessment package must identify the party (individual, team or organization) respo...
Control Origination
FedRAMP accepts only one of five values for control-origination: sp-corporate, sp-system, custome...
Implementaiton Status
FedRAMP only accepts only one of five values for implementation-status: implemented, partial, pla...
Inheritence and Customer Responsibilities
For systems that may be leveraged, OSCAL enables a robust mechanism for providing both inheritanc...