Evidence first
Control implementation, parameter values, responsibility allocation and findings come from observed configuration, identity, logging and change data, not from memory.
OSCAL automation for FedRAMP
OSCAL Automation for FedRAMP 20x and Rev5
Key takeaway: There is no September 2026 OSCAL deadline. RFC-0024 proposed machine-readable packages for Rev5 providers by September 2026, and FedRAMP's final Consolidated Rules 2026 (CR26) replaced that date with a schedule by ruleset. Under CR26, Certification Data Sharing calls for human-readable and machine-readable JSON data with programmatic access, and OSCAL is a FedRAMP-identified format. For Rev5 providers it is required to obtain certification from January 1, 2027 and to maintain it from August 1, 2027. Hand-authoring OSCAL does not scale, and NISTcompliance.ai generates it from control evidence.
This page covers what the rules require, how OSCAL is generated from evidence, what a package contains, where automation applies and how Quzara supports it. For the OSCAL models themselves, see the OSCAL for FedRAMP hub. Related: AI SSP and POA&M generation, Auditor Co-Pilot and inheritable controls.
Dec 7, 2026VDR and VER take effect
Jan 1, 2027CR26 mandatory for new Rev5 applications
Aug 1, 2027Certification Data Sharing required to maintain, Rev5
800+NIST SP 800-53 Rev 5 controls mapped
Dates checked against fedramp.gov on October 14, 2026.
Why automate
Generate OSCAL from evidence, do not type it
OSCAL, the Open Security Controls Assessment Language, is NIST's standard for expressing controls, system descriptions, assessment plans, results and plans of action as structured data in JSON, XML or YAML. Writing valid OSCAL is a tooling problem. Knowing what belongs in it is an evidence problem, and that is where most of the effort goes.
A Moderate baseline system security plan in OSCAL JSON runs thousands of lines with exact cross-references between documents, and the schema is validated strictly. The practical answer is to generate the package from the evidence that already describes how your environment runs, and to review it, instead of typing it.
Validated output
Every document is checked against the current OSCAL schema before export, so reference and format errors surface before a reviewer sees them.
Stays current
Findings, changes and notices keep arriving. Generation from live evidence keeps the package consistent without a documentation catch-up project.
One source, many outputs
The same approved content exports as OSCAL and as a DOCX document, and maps to CMMC Level 2 and FISMA Moderate.
What the rules require
What CR26 requires, and when
FedRAMP's dates are the only dates. Highlighted rows start December 7, 2026.
Machine-readable data is not one deadline. It runs through the Certification Data Sharing and Collaborative Continuous Monitoring rulesets, which carry their own dates, and it feeds the vulnerability reporting that begins on December 7, 2026. Certification Data Sharing calls for human-readable data and machine-readable JSON data with programmatic access. FedRAMP identifies OSCAL and JSON as formats, expects human-readable materials to be generated from the machine-readable data, and has said it will not build the tooling, leaving that to industry (Notice NTC-0009).
Rev5 deadlines by ruleset
Dates for providers on the Rev5 path. For 20x certifications, Certification Data Sharing applies from July 4, 2026 to obtain and from January 1, 2027 to maintain.
| Ruleset | Obtain | Maintain | Grace period ends |
|---|---|---|---|
| Vulnerability Detection and Response (VDR) | Dec 7, 2026 | Dec 7, 2026 | Mar 7, 2027 |
| Vulnerability Evaluation and Reporting (VER) | Dec 7, 2026 | Dec 7, 2026 | Mar 7, 2027 |
| Significant Change Notification (SCN) | Jan 1, 2027 | Jan 1, 2027 | Jun 1, 2027 |
| Collaborative Continuous Monitoring (CCM) | Jan 1, 2027 | Apr 2, 2027 | Oct 1, 2027 |
| Certification Data Sharing (CDS) | Jan 1, 2027 | Aug 1, 2027 | Feb 1, 2028 |
No September 2026 OSCAL date
What happened to the September 2026 date
RFC-0024, issued January 13, 2026, proposed machine-readable packages for Rev5 providers with a September 2026 date. FedRAMP published the initial outcome in Notice NTC-0009 on March 25, 2026 and the final rules in CR26 on June 24, 2026. The CR26 schedule replaced the September date. Plan against the dates in the table.
Primary sources CR26 Rev5 deadlines, Notice NTC-0009, Notice NTC-0014, RFC-0024.
How it works
From control evidence to an OSCAL package
OSCAL automation is the operating model from day one, not a translation step at the end.
Connect your environment
NISTcompliance.ai connects to Azure Government, AWS GovCloud and Microsoft 365 GCC High through API integrations, using read-only service accounts scoped to the boundary you define. Operations are U.S. citizen only.
Map evidence to controls
Platform telemetry, configuration state and audit logs map to NIST SP 800-53 Rev 5 controls across an 800-plus control set, with CMMC Level 2 and FISMA Moderate cross-references from the same evidence.
Draft control responses
Fine-tuned models draft implementation descriptions, parameter values, responsibility allocations and inheritance relationships from the actual configuration state. Your team reviews and approves each one.
Assemble the package
Approved content assembles into linked machine-readable documents with cross-references intact, and each document validates against the current OSCAL schema.
Export
OSCAL exports as JSON, and the same approved content exports as a DOCX document for reviewers who still need the Word format.
AI drafts and compares. Your ISSO approves what goes into the package, and your independent assessor and the authorizing official make every determination.
What it produces
What an OSCAL package contains
These are the NIST OSCAL models FedRAMP packages have been built from. Each has its own schema and cross-references the others by identifier, so a package is a linked set of documents, not one file.
| OSCAL model | What it carries | How it connects |
|---|---|---|
| System Security Plan | The cloud system's boundary, components and control implementations, with parameter values and responsibility allocations. | References the profile, the component definitions of inherited platforms and the evidence. |
| Component Definition | A reusable component, such as a managed detection service, and the controls it satisfies. | A platform publishes it. A customer's plan references it, which turns inheritance into data instead of prose. |
| Assessment Plan | The independent assessor's methodology, the controls and parameters in scope and the test procedures. | References the system security plan for the controls in scope. |
| Assessment Results | The assessor's findings for each test, with evidence. | References the assessment plan and the plan's controls. Open findings feed the plan of action. |
| Plan of Action and Milestones | Identified gaps tracked through remediation, with owners and milestones. | Fed by assessment results and by continuous findings. |
Package names change under CR26. The evidence behind them does not.
FedRAMP's notice says the Certification Package Overview, Security Decision Record and Secure Configuration Guide replace the System Security Plan, Security Assessment Report and Customer Responsibility Matrix in most respects, in simplified JSON or optionally OSCAL, and that plans of action and milestones are replaced by a list of Accepted Weaknesses. Control implementation, parameter values, responsibility allocation and findings still come from how your environment actually runs. Quzara maps that evidence to the package form your path requires.
Primary sources What's Changing, Notice NTC-0013, NIST OSCAL layers.
Where it applies
Six places OSCAL automation earns its keep
The pipeline serves the first package and every update after it.
Certification packages
Packages are generated from the start of the engagement, so the team works from evidence and reviews drafts instead of authoring in Word and converting at the end.
Ongoing certification
Collaborative Continuous Monitoring is required to maintain certification from April 2, 2027 for Rev5 providers. The same evidence pipeline keeps the package current between reviews.
Significant change notification
The SCN ruleset applies from January 1, 2027. The same record that updates the package should produce the notice. See the SCN guide.
Multi-framework reuse
One evidence base supports FedRAMP, CMMC Level 2 and FISMA Moderate packages with the control mapping intact, which helps contractors and providers serving both civilian and DoD missions.
Vulnerability reporting
Vulnerability data that feeds VDR and VER reporting from December 7, 2026 belongs in the same structured pipeline. See VDR and VER.
Assessor review
Auditor Co-Pilot lets independent assessors query the package and its evidence in the platform, with answers that cite their sources. See Auditor Co-Pilot.
Date history
From RFC-0024 to the CR26 schedule
These are FedRAMP's dates, not Quzara's estimates. Quzara does not promise a certification date, and neither does FedRAMP.
| Date | Event | What it means | Status |
|---|---|---|---|
| Jan 13, 2026 | RFC-0024 issued | Proposed machine-readable packages for Rev5 providers with a September 2026 date. | Superseded |
| Mar 25, 2026 | Notice NTC-0009 | Initial outcome. FedRAMP said it would not build machine-readable tooling and would leave that to industry. | Passed |
| Jun 24, 2026 | CR26 published | Final Consolidated Rules 2026, with a schedule by ruleset in place of the proposed September date. | Passed |
| Jul 4, 2026 | Optional adoption opens | CR26 rulesets can be adopted early. For 20x, Certification Data Sharing applies to obtain certification. | Passed |
| Dec 7, 2026 | VDR and VER take effect | Vulnerability detection, evaluation and reporting. Grace runs to March 7, 2027. | Next |
| Jan 1, 2027 | CR26 mandatory | New Rev5 applications follow all applicable rules. Certification Data Sharing applies to obtain (Rev5) and to maintain (20x). | Planned |
| Apr 2, 2027 | CCM required to maintain | Rev5 providers. Grace period ends October 1, 2027. | Planned |
| Aug 1, 2027 | CDS required to maintain | Rev5 providers. Grace period ends February 1, 2028. | Planned |
| Feb 1, 2028 | All CR26 grace periods expire | FedRAMP says there are no extensions past the grace period. | Planned |
Primary sources CR26 Rev5 deadlines, Notice NTC-0009, RFC-0024, Important Deadlines.
Quzara
Evidence, generation and review inside one boundary
Cybertorch produces the evidence. NISTcompliance.ai structures it into the package. Humans decide.
Evidence from Cybertorch
Cybertorch is a FedRAMP Certified Class D (High) MXDR and SOC-as-a-Service on Azure Government with U.S. citizen analysts. Detections, incidents and vulnerability data become evidence.
OSCAL generation
With NISTcompliance.ai you can generate JSON and OSCAL packages and DOCX output from control evidence across 800-plus NIST SP 800-53 Rev 5 controls, with mapping to CMMC Level 2 and FISMA Moderate.
Review and approval
Drafted sections are reviewed in the platform editor, and the audit trail records who approved what and when.
Assessor workflow
Auditor Co-Pilot gives independent assessors scoped, time-bound access to the package and evidence repository.
NISTcompliance.ai operates inside the Cybertorch FedRAMP boundary on Azure Government. AI drafts and compares, and ISSOs, assessors and authorizing officials make every determination. Quzara has supported commercial cloud providers through FedRAMP certification work, and client details stay under NDA.
- FedRAMP Certified Class D
- Azure Government
- Marketplace ID FR2214150164
- DoD IL-4
Common questions about OSCAL automation
What is OSCAL automation?
Generating OSCAL documents from observed control evidence and validating them against the NIST schema, instead of hand-authoring thousands of lines of JSON. Your team reviews and approves the content that goes in.
Is there a September 2026 OSCAL deadline?
No. RFC-0024 proposed one for Rev5 providers on January 13, 2026. Notice NTC-0009 and CR26 replaced it. For Rev5, Certification Data Sharing applies from January 1, 2027 to obtain and August 1, 2027 to maintain, with a grace period to February 1, 2028.
Does this apply to Rev5 providers or only 20x?
CR26 applies to both, with different dates by path. The table above shows Rev5. For 20x, Certification Data Sharing applies from July 4, 2026 to obtain and January 1, 2027 to maintain.
Is OSCAL required?
CR26 requires machine-readable data through the Certification Data Sharing and Collaborative Continuous Monitoring rulesets, and FedRAMP identifies OSCAL and JSON as formats. Confirm the format your path requires with FedRAMP or your assessor.
Can we hand-author OSCAL?
Technically yes. In practice a Moderate baseline system security plan runs thousands of lines with cross-references between documents, and schema or reference errors take longer to debug than the document took to write.
How does NISTcompliance.ai generate OSCAL?
It maps platform telemetry, configuration state and audit logs to NIST SP 800-53 Rev 5 controls, drafts implementation descriptions and parameter values from the actual state, and assembles linked documents. Your team reviews and approves before export.
How is OSCAL validated?
NISTcompliance.ai validates against the current OSCAL schema and the FedRAMP profile constraints before export, and runs consistency checks across the documents in the package.
Does it work for CMMC Level 2?
Yes. The same evidence base supports FedRAMP and CMMC Level 2 packages with the control mapping intact, so contractors and providers serving federal civilian and DoD missions keep one source of truth.
Do I still need a DOCX document?
Some reviewers still ask for the Word format. The same approved content exports as OSCAL and as DOCX, so the two stay in sync.
Does AI replace the assessor?
No. AI drafts and compares. Your independent assessor decides whether the implementation is adequate, and Auditor Co-Pilot only gives the assessor a faster, logged way to review the evidence.
Plan your OSCAL pipeline against the CR26 dates
Quzara and NISTcompliance.ai generate the machine-readable package from the evidence your environment already produces. Engage Quzara through our GSA HACS vehicle or directly.