Schema validation

1{
2  "system-security-plan": {
3    "uuid": "11111111-2222-3333-4444-555555555555",
4    "metadata": {
5      "title": "Acme Federal System — System Security Plan",
6      "last-modified": "2026-06-01T00:00:00Z",
7      "version": "1.0.0",
8      "oscal-version": "1.1.2",
9      "parties": [
10        {
11          "uuid": "p-1",
12          "type": "organization",
13          "name": "Acme Federal, Inc."
14        }
15      ]
16    },
17    "import-profile": {
18      "href": "#fedramp-moderate-baseline"
19    },
20    "system-characteristics": {
21      "system-ids": [
22        {
23          "id": "ACME-FED-001",
24          "identifier-type": "https://fedramp.gov"
25        }
26      ],
27      "description": "Multi-tenant SaaS providing case-management workflows to federal agencies.",
28      "security-sensitivity-level": "moderate",
29      "system-information": {
30        "information-types": [
31          {
32            "uuid": "it-1",
33            "title": "Case records",
34            "description": "PII case management records."
35          }
36        ]
37      },
38      "security-impact-level": {
39        "security-objective-confidentiality": "moderate",
40        "security-objective-integrity": "moderate",
41        "security-objective-availability": "low"
42      },
43      "status": {
44        "state": "operational"
45      },
46      "authorization-boundary": {
47        "description": "All Acme-managed components in AWS GovCloud (us-gov-west-1)."
48      }
49    },
50    "system-implementation": {
51      "users": [],
52      "components": [
53        {
54          "uuid": "c-1",
55          "type": "software",
56          "title": "Acme API Gateway",
57          "description": "Edge API gateway terminating TLS and enforcing authn/authz.",
58          "status": {
59            "state": "operational"
60          }
61        },
62        {
63          "uuid": "c-2",
64          "type": "service",
65          "title": "AWS RDS (PostgreSQL)",
66          "description": "Encrypted-at-rest managed PostgreSQL instance for case data.",
67          "status": {
68            "state": "operational"
69          }
70        }
71      ]
72    },
73    "control-implementation": {
74      "description": "Implementation narratives for the FedRAMP Moderate baseline.",
75      "implemented-requirements": [
76        {
77          "uuid": "ir-ac-2",
78          "control-id": "ac-2",
79          "statements": [
80            {
81              "statement-id": "ac-2_smt.a",
82              "uuid": "ir-ac-2-a",
83              "by-components": [
84                {
85                  "component-uuid": "c-1",
86                  "uuid": "ir-ac-2-a-c1",
87                  "description": "Account types (privileged, service, end-user) are defined in the IAM policy and enforced at the API gateway."
88                }
89              ]
90            }
91          ]
92        }
93      ]
94    }
95  }
96}