oscal-ssp

OSCAL System Security Plan (SSP) Model

The SSP model documents how an information system implements security controls from a specific baseline (profile). It's the core artifact for system authorization.

Related skills:

• oscal-profile - Baselines that define required controls
• oscal-component-definition - Reusable component implementations
• oscal-assessment-plan - Planning assessments of SSPs

Purpose

A System Security Plan:

• Documents the system boundary, components, and architecture
• Describes control implementations for each required control
• Identifies responsible parties for security functions
• Supports authorization (e.g., FedRAMP ATO)

Document Structure

system-security-plan:
  uuid: <unique-identifier>
  metadata:
    title: "System Name SSP"
    version: "1.0.0"
    oscal-version: "1.1.2"
  import-profile:
    href: "profile.json"
  system-characteristics: {}
  system-implementation: {}
  control-implementation: {}
  back-matter:
    resources: []

Import Profile

Reference the baseline the system implements:

import-profile:
  href: "https://example.com/fedramp-moderate-baseline.json"

System Characteristics

Basic Information

system-characteristics:
  system-ids:
    - identifier-type: https://fedramp.gov
      id: "F1234567890"
  system-name: "Enterprise Management System"
  system-name-short: "EMS"
  description: "Cloud-based enterprise management platform"
  props:
    - name: cloud-service-model
      value: "saas"
    - name: cloud-deployment-model
      value: "public-cloud"
  security-sensitivity-level: moderate
  system-information:
    information-types:
      - uuid: info-type-uuid
        title: "Administrative Information"
        categorizations:
          - system: https://doi.org/10.6028/NIST.SP.800-60v2r1
            information-type-ids:
              - C.2.8.12
        confidentiality-impact:
          base: moderate
        integrity-impact:
          base: moderate
        availability-impact:
          base: low