Search Results

The FedRAMP PMO no longer uses traditional SSP, Assessment Plans, Assessment Reports, or POA&Ms. This information remains for reference as it serves as an example for modeling of similar tools. For information related to the use of OSCAL for the revised FedRAM...

Patterns for expressing information in OSCAL that are universal across frameworks. All content is considered to be in the public domain and free for all to use without constraint unless otherwise marked. [A specific open source license will be identified by t...

Unless otherwise marked, this content is released as Creative Commons Zero (CC0). It may be used freely and without attribution.

Analysis, guidance and OSCAL patterns in support of the FedRAMP Consolidated Rules published June 2026. CR26 became effective July 4, 2026. See the Overview page for information about our CR26 work streams.