OSCAL-Native.
FEDRAMP-READY.
CMMC-Included.
Machine-readable compliance artifacts. Built for FedRAMP's September 2026 mandate. Ready for whatever DoD does next.
What you get
OSCAL Profile
Your tailored control selection in OSCAL JSON or XML. Imports from NIST 800-53 R5 with FedRAMP control hrefs; downloadable from any assessment page.
OSCAL System Security Plan (SSP)
Complete machine-readable SSP. system-characteristics, components built from your cloud connections, control implementation drawn from your findings + starter narratives.
OSCAL POA&M
Open gaps, owners, remediation plans, target completion dates. FedRAMP-flavored. Cross-references the SSP. One file per assessment cycle.
OSCAL Assessment Results
Evidence-backed findings ledger. Each finding cites evidence by UUID into back-matter resources. Attestation linkage flows through to the AR.
In-product preview
Every assessment page shows this OSCAL exports panel. One click pulls the document down to your desktop.
- OSCAL Profile
Tailored control selection — your assessment scope as a machine-readable Profile.
.json.xml - OSCAL System Security Plan
Complete machine-readable SSP with components, control implementation, evidence references.
.json - OSCAL POA&M
Open gaps, owners, remediation plans, target dates — cross-referenced to the SSP.
.json - OSCAL Assessment Results
Evidence-backed findings ledger with attestation linkage and observation records.
.json
Why this matters
FedRAMP RFC-0024 mandates machine-readable OSCAL submissions starting September 30, 2026. CSPs that miss the deadline lose certification by September 30, 2027. DoD will follow within 18-36 months for CMMC.
FORCE is OSCAL-native by design — not an afterthought, not a paid add-on, not a future feature with vague promises. Included in L2 Standard pricing at no extra cost.
Validation
Every OSCAL artifact FORCE generates passes structural validation before publication. Schema-strict validation against published FedRAMP schemas (via IBM compliance-trestle and NIST oscal-cli) lands as Phase 2.5 work — until then, structural checks ensure the artifacts you download are well-formed and reference-complete.
Every artifact carries an OSCAL version stamp (currently 1.1.2). When NIST publishes 1.2 or beyond, generators update; previously-generated artifacts retain validity against the version used at generation time per attestation-ledger immutability requirements.