Topic · oscal

OSCAL

OSCAL — the NIST machine-readable format for controls, assessment plans, and SSPs. Central to FedRAMP 20x and emerging assessment automation.

RSS feed ↗

trade-press
FedRAMP 2026 shifts providers to continuous evidence model
The old FedRAMP habit, pass the assessment and manage the paperwork, is becoming a liability for teams without live operational telemetry.
FedScoop’s commentary says FedRAMP 2026 moves the Federal Risk and Authorization Management Program away from point-in-time assessment toward continuous evidence, real-time vulnerability data and coordinated security operations. Primes, contractors and managed service providers selling into federal cloud environments will need evidence automation, risk triage and cross-functional ownership. The missing piece is operationally important: FedScoop does not state the implementation timeline, enforcement dates or treatment of legacy authorization holders.
JUL 6
trade-press
FedRAMP 20x sets 2027 deadline for cloud providers
The six-month runway is less a grace period than a procurement test for every integrator carrying federal cloud dependencies.
FedRAMP finalized its 2026 consolidated rules, making FedRAMP 20x broadly available with optional adoption starting July 4, 2026, and mandatory adoption Jan. 1, 2027, FedScoop reports. Cloud service providers must move from Low, Moderate and High impact levels to certification classes A, B, C and D, with automated continuous package updates. Primes, subs, ISVs and agency buyers now have six months to verify vendor readiness before contract eligibility becomes the practical enforcement point.
JUN 29
vendor
AWS ships Spring 2026 SOC reports in OSCAL
Machine-readable assurance only helps if customers can trust the mapping, not just admire the JSON package in Artifact.
AWS released its Spring 2026 System and Organization Controls 1 and 2 reports in Open Security Controls Assessment Language format through AWS Artifact, alongside the PDF reports. The package covers 188 services for April 1, 2025 through March 31, 2026. AWS says it is the first major cloud provider to offer key compliance reports to customers in NIST’s machine-readable OSCAL format, a useful claim for automation teams but still vendor-stated.
JUN 18

OSCAL

FedRAMP 2026 shifts providers to continuous evidence model

FedRAMP 20x sets 2027 deadline for cloud providers

AWS ships Spring 2026 SOC reports in OSCAL