render

OSCAL → human-readable

Deterministic transformation of OSCAL into a view an auditor can read. No AI in this path.

OSCAL source

system-security-plan · paste or upload json / xml / yaml

system-security-plan

{
  "system-security-plan": {
    "uuid": "11111111-2222-3333-4444-555555555555",
    "metadata": {
      "title": "Acme Federal System — System Security Plan",
      "last-modified": "2026-06-01T00:00:00Z",
      "version": "1.0.0",
      "oscal-version": "1.1.2",
      "parties": [
        {
          "uuid": "p-1",
          "type": "organization",
          "name": "Acme Federal, Inc."
        }
      ]
    },
    "import-profile": {
      "href": "#fedramp-moderate-baseline"
    },
    "system-characteristics": {
      "system-ids": [
        {
          "id": "ACME-FED-001",
          "identifier-type": "https://fedramp.gov"
        }
      ],
      "system-name": "Acme Federal System",
      "description": "Multi-tenant SaaS providing case-management workflows to federal agencies.",
      "security-sensitivity-level": "moderate",
      "system-information": {
        "information-types": [
          {
            "uuid": "it-1",
            "title": "Case records",
            "description": "PII case management records."
          }
        ]
      },
      "security-impact-level": {
        "security-objective-confidentiality": "moderate",
        "security-objective-integrity": "moderate",
        "security-objective-availability": "low"
      },
      "status": {
        "state": "operational"
      },
      "authorization-boundary": {
        "description": "All Acme-managed components in AWS GovCloud (us-gov-west-1)."
      }
    },
    "system-implementation": {
      "users": [],
      "components": [
        {
          "uuid": "c-1",
          "type": "software",
          "title": "Acme API Gateway",
          "description": "Edge API gateway terminating TLS and enforcing authn/authz.",
          "status": {
            "state": "operational"
          }
        },
        {
          "uuid": "c-2",
          "type": "service",
          "title": "AWS RDS (PostgreSQL)",
          "description": "Encrypted-at-rest managed PostgreSQL instance for case data.",
          "status": {
            "state": "operational"
          }
        }
      ]
    },
    "control-implementation": {
      "description": "Implementation narratives for the FedRAMP Moderate baseline.",
      "implemented-requirements": [
        {
          "uuid": "ir-ac-2",
          "control-id": "ac-2",
          "statements": [
            {
              "statement-id": "ac-2_smt.a",
              "uuid": "ir-ac-2-a",
              "by-components": [
                {
                  "component-uuid": "c-1",
                  "uuid": "ir-ac-2-a-c1",
                  "description": "Account types (privileged, service, end-user) are defined in the IAM policy and enforced at the API gateway."
                }
              ]
            }
          ]
        }
      ]
    }
  }
}

Rendered view

deterministic transformation

no AI

System Security Plan

Acme Federal System — System Security Plan

oscal 1.1.2 · uuid 11111111-2222-3333-4444-555555555555

System Characteristics

system-name: Acme Federal System
sensitivity: moderate
status: operational
system-id: ACME-FED-001

Multi-tenant SaaS providing case-management workflows to federal agencies.

Authorization boundary

All Acme-managed components in AWS GovCloud (us-gov-west-1).

Components (2)

Acme API Gatewaysoftware

c-1

Edge API gateway terminating TLS and enforcing authn/authz.

AWS RDS (PostgreSQL)service

c-2

Encrypted-at-rest managed PostgreSQL instance for case data.

Implemented Requirements (1)

ac-2ir-ac-2

ac-2_smt.a

component c-1

Account types (privileged, service, end-user) are defined in the IAM policy and enforced at the API gateway.