Export OSCAL Assessment Results
Export the OSCAL Assessment Results (AR) file for an authorization package from the CAM Workspace.
Before you begin
- The authorization package must be in the Assess, Authorize, or Monitor step.
- At least one control test in the engagement must have a closed state. Accepted closed states are:
- Closed Complete
- Closed Incomplete
- Closed Skipped
Roles required:
- Information System Security Manager (sn_irm_cont_auth.info_system_sec_manager)
- Information System Security Officer (sn_irm_cont_auth.info_system_sec_officer)
- CAM Administrator (sn_irm_cont_auth.admin)
Procedure
-
Navigate to Workspaces > CAM Workspace.
-
In the CAM Workspace, select the List icon.
-
Select Authorization packages from the RMF list.
-
Select the authorization package record in the Assess, Authorize, or Monitor step for which you want to generate an AR file.
-
Select Generate OSCAL.
A banner appears with the message:
The files are being generated. Refresh the page after some time, then select Download OSCAL Files to download the OSCAL files.The system starts generating OSCAL files asynchronously. This process takes a few minutes depending on package complexity. The Download OSCAL Files button appears when the process is complete.
A single AR JSON file is generated for each engagement linked to the authorization package. If the package has multiple engagements, multiple AR files are generated.
Warning: Each time you run a generate operation, any previously generated OSCAL files for the package are deleted and replaced.
-
After the files are generated, select Download OSCAL Files.
[Omitted image "download-oscal.png"] Alt text: Download OSCAL files
The Download OSCAL Files button appears only after file generation completes. If generation is in progress, the button is unavailable.
Note: Confirm that the pop-up blocker is turned off for the URL so that the ZIP file downloads automatically to your local machine.
A ZIP file is downloaded containing the following OSCAL files:
-
Catalog JSON file
-
Profile JSON file
-
SSP JSON file
-
Overlay Catalog JSON file (if overlays are configured. Also includes overlays from associated control tailoring requests)
-
Assessment Plan (AP) JSON file (one per engagement)
-
Assessment Results (AR) JSON file (one per engagement)
-
POA&M JSON file (included if POA&M items exist) The exported OSCAL AR JSON file contains the following structure:
-
Reviewed controls: Control selections with control IDs and statement IDs from completed control tests
-
Control objective IDs: References to test templates associated with the engagement
-
Findings: Array of issues linked to control tests that failed assessment
- UUID corresponds to the issue or POAM record
- Target contains control test reference and UUID
- State is "not satisfied" when findings exist
- Description and title provide issue details
-
Attestations: Objects for all completed controls including:
- Responsible parties (control test owner and UUID)
- Control test title and UUID
- Operational effectiveness rating from the control test
- Assessment procedures linked to the control test with their operational effectiveness ratings
-
Metadata and Local Definitions
- Metadata: Responsible parties, roles, and all engagement fields
- Local definitions: Related controls with control IDs, control objectives, and assessment procedure labels
-
What to do next
Validate these files using the OSCAL CLI validator and import them into other systems or share them with external auditors for assessment planning.
Parent Topic:Export in OSCAL format
---
title: Export OSCAL Assessment Results
description: Export the OSCAL Assessment Results \(AR\) file for an authorization package from the CAM Workspace.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/grc-continuous-authorization-and-monitoring-workspace/cam-oscal-assessment-result-export.html
release: australia
product: GRC: Continuous Authorization and Monitoring Workspace
classification: grc-continuous-authorization-and-monitoring-workspace
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Export in OSCAL format, CAM OSCAL, Continuous authorization and monitoring tasks in the CAM Workspace, Use, Continuous Authorization and Monitoring, Governance, Risk, and Compliance]
---
# Export OSCAL Assessment Results
Export the OSCAL Assessment Results \(AR\) file for an authorization package from the CAM Workspace.
## Before you begin
- The authorization package must be in the Assess, Authorize, or Monitor step.
- At least one control test in the engagement must have a closed state. Accepted closed states are:
- Closed Complete
- Closed Incomplete
- Closed Skipped
Roles required:
- Information System Security Manager \(sn\_irm\_cont\_auth.info\_system\_sec\_manager\)
- Information System Security Officer \(sn\_irm\_cont\_auth.info\_system\_sec\_officer\)
- CAM Administrator \(sn\_irm\_cont\_auth.admin\)
## Procedure
1. Navigate to **Workspaces** > **CAM Workspace**.
2. In the CAM Workspace, select the **List** icon.
3. Select **Authorization packages** from the RMF list.
4. Select the authorization package record in the Assess, Authorize, or Monitor step for which you want to generate an AR file.
5. Select **Generate OSCAL**.
A banner appears with the message: `The files are being generated. Refresh the page after some time, then select Download OSCAL Files to download the OSCAL files.`
The system starts generating OSCAL files asynchronously. This process takes a few minutes depending on package complexity. The Download OSCAL Files button appears when the process is complete.
A single AR JSON file is generated for each engagement linked to the authorization package. If the package has multiple engagements, multiple AR files are generated.
**Warning:** Each time you run a generate operation, any previously generated OSCAL files for the package are deleted and replaced.
6. After the files are generated, select **Download OSCAL Files**.
\[Omitted image "download-oscal.png"\] Alt text: Download OSCAL files
The **Download OSCAL Files** button appears only after file generation completes. If generation is in progress, the button is unavailable.
**Note:** Confirm that the pop-up blocker is turned off for the URL so that the ZIP file downloads automatically to your local machine.
A ZIP file is downloaded containing the following OSCAL files:
- Catalog JSON file
- Profile JSON file
- SSP JSON file
- Overlay Catalog JSON file \(if overlays are configured. Also includes overlays from associated control tailoring requests\)
- Assessment Plan \(AP\) JSON file \(one per engagement\)
- Assessment Results \(AR\) JSON file \(one per engagement\)
- POA&M JSON file \(included if POA&M items exist\)
The exported OSCAL AR JSON file contains the following structure:
- Reviewed controls: Control selections with control IDs and statement IDs from completed control tests
- Control objective IDs: References to test templates associated with the engagement
- Findings: Array of issues linked to control tests that failed assessment
- UUID corresponds to the issue or POAM record
- Target contains control test reference and UUID
- State is "not satisfied" when findings exist
- Description and title provide issue details
- Attestations: Objects for all completed controls including:
- Responsible parties \(control test owner and UUID\)
- Control test title and UUID
- Operational effectiveness rating from the control test
- Assessment procedures linked to the control test with their operational effectiveness ratings
- Metadata and Local Definitions
- Metadata: Responsible parties, roles, and all engagement fields
- Local definitions: Related controls with control IDs, control objectives, and assessment procedure labels
## What to do next
Validate these files using the OSCAL CLI validator and import them into other systems or share them with external auditors for assessment planning.
**Parent Topic:**[Export in OSCAL format](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-continuous-authorization-and-monitoring-workspace/oscal-support-cam.md)
This file has no frontmatter.