Answers

FedRAMP OSCAL: The September 30 Machine-Readable Authorization Milestone

FedRAMP is moving cloud authorization packages to OSCAL -- the Open Security Controls Assessment Language -- and the September 30 fiscal-year boundary is the milestone when machine-readable, OSCAL-based submission becomes the expected format for new packages. OSCAL is NIST's standard for expressing security controls, system security plans, and assessment results as structured data instead of prose documents, so a system security plan is not a PDF an assessor reads by eye but a machine-readable package a tool can validate against NIST SP 800-53 controls. The September 30 milestone matters for two reasons. First, it aligns with the federal fiscal-year close, so a cloud service provider seeking authorization on the new track should have its control inventory and system security plan expressed in OSCAL before that date to avoid a manual, slower review path. Second, OSCAL-based packages are the natural substrate for a verified measurement credential: because the control statements are already structured and machine-readable, an independent signature over the package proves the controls were asserted as-stated and unaltered since submission, turning a self-asserted security narrative into a checkable record. The Council of AI treats the FedRAMP OSCAL transition as the same problem as its own containment work: monitored containment, not provable isolation. A machine-readable package plus a signature does not prove a cloud system is secure -- it proves the security claim is well-formed, attributable, and verifiable, which is the honest, audit-grade version of the guarantee buyers actually need.

Measurement, not certification. Verify a card at /gspc-verify.