FedRAMP JSON Schemas
This page lists the JSON Schemas for FedRAMP submission artifacts. These schemas define the structure of machine-readable documents that providers and assessors submit during the FedRAMP certification process.
Want to check a document? Use the JSON Schema Validator to validate your JSON against any of these schemas — entirely in your browser.
Accepted vulnerability information required when reporting vulnerability detection and response activity per VER-RPT-AVI.
fedramp-accepted-vulnerability-info-schema-2026-06-24.jsonRelated Rules
Public information an Advisory Service must supply in machine-readable format on their website per MKT-CAS-WEB.
fedramp-advisor-information-schema-2026-06-24.jsonRelated Rules
Public information an Independent Assessment Service must supply in machine-readable format on their website per MKT-IAS-WEB.
fedramp-assessor-information-schema-2026-06-24.jsonRelated Rules
Identification, service properties, contacts, and supporting documentation for a Cloud Service Offering per FRC-CSO-PKG.
fedramp-certification-package-overview-schema-2026-06-24.jsonRelated Rules
Shared type definitions referenced by other FedRAMP schemas.
Machine-readable historical Vulnerability Evaluation and Reporting activity for automated retrieval per VER-TFR-MRH.
fedramp-historical-ver-activity-schema-2026-06-24.jsonRelated Rules
Unified schema for the three incident report types in the IEC-CSO lifecycle: Initial (IEC-CSO-IIR), Ongoing (IEC-CSO-OIR), and Final (IEC-CSO-FIR).
fedramp-incident-report-schema-2026-06-24.jsonRelated Rules
Quarterly Ongoing Certification Report (OCR) per CCM-OCR-AVL, covering the entire period since the previous report.
fedramp-ongoing-certification-report-schema-2026-06-24.jsonRelated Rules
JSON Schema for Cloud Service Provider (CSP) system submission for FedRAMP certification per SDR-CSO-FRR.
fedramp-security-decision-record-schema-2026-06-24.jsonRelated Rules
Required information for a Significant Change Notification per SCN-CSO-INF. Note per the rule: structure of the information may vary depending on how the provider tracks this internally.
fedramp-significant-change-notifications-schema-2026-06-24.jsonRelated Rules
Vulnerability detection and response activity report per VER-RPT-VDT. Covers non-accepted vulnerabilities only; see VER-RPT-AVI for accepted vulnerabilities.
fedramp-vulnerability-detail-report-schema-2026-06-24.jsonRelated Rules