Question 1

Can I import an OSCAL package from a government source or third-party assessor?

Accepted Answer

Yes. The OSCAL import endpoint accepts SSP, SAP, SAR, and POA&M documents in either JSON or XML format and projects them into the platform's assessment and POA&M tables. This handles assessment results delivered by a C3PAO, a DISA assessor, or a migration source — the data is immediately reflected in your compliance dashboard without manual re-entry. Idempotent import skips re-processing for documents you've already ingested.

Question 2

Does OSCAL support cover CMMC and RMF, or only FedRAMP?

Accepted Answer

OSCAL catalog and profile import supports the full range of OSCAL-formatted catalogs. NIST 800-53 Rev 5 (the foundation for both FedRAMP and RMF), CMMC L2 profiles, and custom baselines expressed as OSCAL profiles all import through the same endpoint. For CMMC, the platform's native CMMC assessment layer handles practice-level evidence; the OSCAL surfaces provide the machine-readable interchange with external tools and submission workflows.

Question 3

What's the difference between "OSCAL support" and "OSCAL native"?

Accepted Answer

"OSCAL native" typically means OSCAL is the internal data model — the platform stores compliance data in OSCAL schemas throughout. Advisedly's architecture is structured data with OSCAL surfaces: an optimized internal data model with OSCAL as the machine-readable interoperability layer. The practical result for most workflows is the same (valid OSCAL in and valid OSCAL out), but the internal architecture differs. The honest description is OSCAL import and export rather than a native OSCAL datastore — and transparency on this point matters when you're evaluating tooling for a long-term compliance program.

Question 4

Is this relevant to the FedRAMP 20x pilot?

Accepted Answer

Yes. FedRAMP 20x Phase 2 (pilot as of March 2026) specifically aims to replace static document review with programmatic evidence consumption. OSCAL-formatted artifacts are the evidence format the automated review pipeline expects. Organizations participating in the 20x pilot or positioning for future automation-ready authorization submissions need OSCAL output from live assessment data — not from a quarterly document export. Begin at /assess to map your current compliance posture against 20x readiness requirements.