Import OSCAL SSP · SN Doc Reader

From the New Import playbook experience page, you can import OSCAL files in the System Security Plan (SSP) model into CAM workspace. This action enables you to seamlessly upload authorization package data in OSCAL format.

Before you begin

Role required:

Information System Security Manager (sn_irm_cont_auth.info_system_sec_manager)
Information System Security Officer (sn_irm_cont_auth.info_system_sec_officer)
CAM Administrator (sn_irm_cont_auth.admin)

Note:

The catalog, catalog overlay, SSP, and profile file to be imported must be in JSON format and validated using the OSCAL-CLI tool https://github.com/usnistgov/oscal-cli for any validation error.
Recipients are notified through email on completion of the import process.
User who should be mapped for CAM specific personas.

The OSCAL SSP import is a synchronous process.

Enter OSCAL import details

Procedure

Navigate to Workspaces > CAM Workspace.
In the CAM Workspace, select [Omitted image "cam-oscal-import-icon.png"] Alt text: OSCAL import from the sidebar.
Select New Import from the All OSCAL imports landing page.
Select SSP from the OSCAL Model drop-down list.
Enter the Source name.
Enter the Import status recipients name.

You can list the users you want to be notified once the OSCAL import is complete. The recipient receives an email notification on the import status.
Select Next to continue to the next step in the OSCAL import process.

You’ll be directed to the Attachments tab to attach the SSP files.
Attach the individual files in the Attachments tab, then select Next to upload the Overlay file.

Note: Catalog, Profile, and SSP are mandatory files.
- Catalog: Contains the details of the control objectives and its related objects.
- Profile: Contains a baseline of selected controls from one or more control catalogs.
- SSP: Contains the details of the authorization boundary, authorization package, system elements, information types, controls, common controls, inherit, hybrid controls, and others.
- Data flow diagram, Boundary diagram, Network diagram and Enterprise Architecture: These diagrams are attached to the authorization boundary.
Select Next to continue with the attachments.
- Overlay attachments: Attach one or more overlay files.
- POA&M attachments: Add one or more POA&M files.
- Authorization boundary attachments: Attach diagrams and other supporting documentation relevant to the authorization boundary, such as boundary assessment documents or architectural diagrams.
- Authorization package attachments: Add specific authorization package documents. You can add the following files:
  - SSP Report
  - SAP Report
  - SAR Report
  - ATO Letter
  - POA&M Report
  - Executive Summary These documents attach to specific authorization package document fields.
  In addition, under the Attachments section, you can add general supporting documents, such as PDFs, Word documents, or images. These aren't linked to a specific field.
Select Next to continue to Roles and Responsibilities, where you can assign users to specific roles for the imported files.

These users will retain their roles throughout each step in the authorization package.
Select Next to continue to User mapping, where the system maps users from the OSCAL file to ServiceNow users.

These users will retain their roles throughout each step in the authorization package.

When usernames match, the system auto-maps them. When usernames do not match or the user does not exist in ServiceNow, you must manually select the corresponding ServiceNow user. The user mapping step verifies that all required roles are assigned (System Owner, ISSO, ISSM, Engagement Lead, Auditors). If mandatory roles are missing after auto-mapping, you must manually assign users before proceeding.
Select Next to continue to Preview and Override, where you can verify the files you uploaded.
In the Preview and Override tab, review the details that are to be created, skipped, or overridden and then perform one of the following:
- Select Import to import the SSP model.
  
  Note: When all the data is new and must be imported, the import action creates new records for the respective data. In this case, you can’t skip or override the files. However, if you import a file with the same source and matching records, you’ll have the option to skip the data.
- To override data, perform the following actions:
  1. Select Select list to override to choose the data to override.
  2. Select Skipped to list the reference that is to be skipped.
    
    Note: Based on the data you select from the drop-down: If the data is in the Will be skipped state, you can only override it. When you override a control objective, all associated control objective requirements will also be overridden.
  3. Select the reference from the list that you want to override.
    
    [Omitted image "cam-oscal-import-ssp6.png"] Alt text: Overriding skipped files.
  4. Select Override to override one or more selected references.
    
    The selected reference is flagged as overridden and the Overridden count is increased in the preview list.
- To skip data, perform the following actions:
  1. Select Select list to override to choose the data to skip.
  2. Select Overridden to list the reference that is to be skipped.
    
    Note: If it is in the Overridden state, you can only skip it.
  3. Select the reference from the list that you want to skip.[Omitted image "cam-oscal-import-ssp7.png"] Alt text: Skipping overridden files.
  4. Select Skip to override one or more selected references.
    
    The selected reference is flagged as skip and the Will be skipped count is increased in the preview list.
Select Import to import the SSP files.

Note: If an error occurs during the import process, review the error message displayed in the pop-up and take the necessary corrective action.

You can view the import status report in the All OSCAL import landing page.
If an error occurs during the import process, review the error message displayed in the pop-up and take the necessary corrective action.

You can also select the More Actions icon on the Attachments and Roles and Responsibilities tabs to select Restart Stage to restart the particular stage.

Note: You can also select the playbook action icon to select Restart Playbook to restart the playbook.

Parent Topic:Import in OSCAL format