FedRAMP Rev 5 G.6: G.6 Automation, machine-readable artifacts and OSCAL

GSA must establish a means of automating security assessments, reviews and reuse of authorizations, so FedRAMP should receive all authorization and continuous monitoring artifacts as machine-readable data through APIs to the extent feasible, with PDF and Word formats not counting as machine-readable; the program office works with OMB, NIST, CISA and GRC tool providers so artifacts are submitted in OSCAL or its successor, publishes the transition standards, and explores AI in package review and monitoring through pilots. Agencies must have procedures to produce, accept and submit machine-readable materials and ensure their GRC and inventory tools can produce, transmit and ingest OSCAL artifacts; FedRAMP maintains an inventory of the services within an offering with per-service customer adoption assets covering control responsibilities, inheritance and secure implementation guidance.