How does CertiField generate an SSP?

The SSP is rendered from the authorization record: the FIPS 199 categorization, the system narratives, the per-control implementation statements, the published architecture snapshot and the linked evidence metadata. Because it is generated from facts rather than edited as prose, it can be regenerated after a change instead of rewritten, and each statement is tagged with whether it was authored, generated, or accepted from a proposal.

Can CertiField import an existing SSP?

Yes. DOCX, text-bearing PDF and plain text are ingested, sections are classified deterministically, and control implementations and narratives are extracted with the supporting quote attached. Nothing is written to the authorization record until an authorized practitioner accepts the proposal, and a proposal whose target has changed since extraction is refused as stale rather than overwriting a newer edit.

What OSCAL artifacts does CertiField support?

CertiField imports and exports the System Security Plan, the Security Assessment Report and the POA&M as OSCAL, and seeds its NIST SP 800-53 Rev 5 control catalog from the NIST OSCAL source.

Product · Authorization artifacts

The record generates the documents. Not the other way around.

Every artifact CertiField produces is a rendering of the authorization record at a point in time. That is why regenerating one after a change is a routine operation rather than a rewrite — and why two artifacts generated the same day cannot disagree with each other.

SSP
SAR
POA&M
Authorization package
OSCAL
DOCX · PDF

Ref: P-31
Kind: SSP
Grounded in: the authorization record
Tagged: per-statement provenance

System Security Plan

Generate the SSP from current system facts: the categorization and its rationale, the system narratives, per-control implementation statements, the published architecture snapshot and the evidence linked to each control. Regeneration is reproducible — the same record produces the same document.

Each statement carries where it came from. A statement a person wrote is marked as authored; one accepted from an extraction proposal is marked as accepted and keeps its provenance; and if somebody later edits a generated statement, its tag changes to reflect that a human took ownership of it.

Bringing in the SSP you already have

Ingest DOCX, text-bearing PDF or plain text. Sections are classified by named rules, with AI assisting only on headings the rules could not resolve. Control implementations and narratives are extracted with the supporting quote attached, then reviewed and accepted — or not.

Nothing a parser or a model produces reaches the authorization record until a person with the authority to accept it does so.

Ref: P-32
Kind: SAR
Grounded in: the assessment record

Security Assessment Report

Turn assessment results, per-CCI test results and determinations into a SAR built from the assessment record — including which architecture version each assessment was performed against, so the report describes the system as it was when it was assessed rather than as it is today.

Findings carry their source. A finding that came from a scan names the scan; one that came from a checklist item names the checklist item; one an assessor raised names the assessor.

Ref: P-33
Kind: POA&M
Upsert key: external POA&M id
Two-way: Jira sync

Plan of Action and Milestones

Move findings into managed remediation with milestones, owners and dates, and keep the link back to the assessment and the source evidence intact. Because remediation work usually lives in Jira, CertiField syncs it two ways rather than asking engineers to update a second tracker they will forget about.

POA&M items imported from eMASS keep their external identifier as the upsert key, so a round trip does not create duplicates or orphan the item your reviewers already have open.

Traceable back to the finding, the assessment and the evidence
Synced with Jira so remediation state stays honest
Round-trip safe against eMASS on the external identifier
False-positive decisions survive the next scan or SBOM upload

Ref: P-34
Kind: Package
Exporters: control info · CCI results · POA&M · inventory

Authorization package

Before you assemble anything, CertiField tells you whether the system is ready: inventory, controls, CCI test results, POA&M, evidence and documentation each carry a readiness state, and what is outstanding is named item by item rather than reduced to a score.

Then assemble what you need. An authorization package under SP 800-37 Rev. 2 is the System Security Plan, the Security Assessment Report and the POA&M — CertiField generates all three from the record, so the package is a rendering of current state rather than a folder somebody collated by hand.

Where the destination is eMASS specifically, the eMASS submission bundle is a single ZIP carrying current inventory, eMASS control information, CCI test results and POA&M exports, with a manifest of SHA-256 checksums so the receiving end can verify nothing changed in transit.

The Authorization Readiness view. Inventory, controls, POA&M, CCI test results, evidence and documentation each carry a readiness state, with a list of what still needs attention, above an eMASS submission bundle that generates a ZIP with a SHA-256 checksum manifest. — Readiness is assessed per input — inventory, controls, CCI results, POA&M, evidence and documentation — and the outstanding items are named rather than summarized into a score, so you know what is left before you assemble anything. System · eMASS · Export Prep

Ref: P-35
Kind: OSCAL
Catalog: seeded from NIST OSCAL
Artifacts: SSP · SAR · POA&M

Human-readable when people need it. Machine-readable when systems need it.

The same authorization record exports as OSCAL — System Security Plan, Security Assessment Report and POA&M — for the systems that consume structured authorization data, and as DOCX and PDF for the reviewers who are going to read it on a screen and mark it up.

OSCAL also comes in. An existing OSCAL package can be imported to establish the record rather than re-keyed, which matters most for the programs that already have an ATO and no appetite for starting the paperwork again.

Why both formats, from one record

Two audiences, one source of truth — the formats cannot drift apart
The 800-53 Rev 5 catalog is already seeded from NIST OSCAL, so identifiers line up
Provenance survives the export — a machine-readable artifact is still traceable

Next step

See what your RMF process looks like when the package keeps up with the system.

Request a demo Explore the product