Home
Platform
Machine-readable packages

Machine-readable packages, not Word documents

Federal compliance is moving from documents to data. FedRAMP's 2026 rules require JSON alongside human-readable text, and agencies must be able to ingest OSCAL and JSON. NISTcompliance.ai generates FedRAMP Certification Package Overviews and Security Decision Records, and SSPs and POA&Ms for FISMA and CMMC, from the same record, so the human-readable and machine-readable versions never drift apart.

Book a demo Trust Center

Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2

Formats

What each framework expects

Swipe to see every column

Framework	Core package	Format notes
FedRAMP (2026 rules)	Certification Package Overview and Security Decision Record	Human-readable and JSON; OSCAL optional in some cases
FISMA and RMF	SSP, assessment results and POA&M per system	FedRAMP rule AGU-AGC-GRC requires agency GRC tools to ingest OSCAL and JSON
CMMC	System security plan (CA.L2-3.12.4) and POA&M	Results reported to SPRS or CMMC eMASS
Department of War (DoD) Impact Levels	Security authorization package and inheritance	Made available in eMASS
GovRAMP	GovRAMP templates; FedRAMP-format documents accepted for Fast Track	Per GovRAMP SAF v4.2

Sources: FedRAMP 2026 changes, FedRAMP Agency Use rules, 32 CFR 170.21, DoD Reciprocity Playbook, GovRAMP SAF v4.2. Sources checked Oct 23, 2026. Not a substitute for the official text.

Rules that require it

Where machine-readable is mandatory

CDS-CSO-CBFMUST

Automated consistency

FedRAMP providers must use automation to keep human-readable and machine-readable information consistent.

AGU-AGC-GRCMUST

Agencies ingest OSCAL and JSON

Agencies must ensure their GRC and inventory tools can produce and ingest machine-readable artifacts, including OSCAL and JSON.

CDS-CSO-PUBMUST

Public data in JSON

Public service information is shared in human-readable and JSON formats.

2026 CHANGESGUIDANCE

JSON by default

FedRAMP moved to simplified JSON documents, with OSCAL optional in some cases.

Sources: CDS rules, FedRAMP Agency Use rules, FedRAMP 2026 changes. Sources checked Oct 23, 2026. Not a substitute for the official text.

How it works

Generate, validate, sync

Generate
Packages come from your live evidence, not from a template you edit by hand.
Validate
Machine-readable output is checked before it is shared.
Sync
Human-readable and machine-readable versions come from the same record.
Share
Publish to your trust center or share with your assessor.

Go deeper