User Guide Assessment Plans
An Assessment Plan describes how the controls in a system will be assessed
— the methods, scope, and objectives — before the assessment happens. In OSCAL
it is the assessment-plan document. It sits between the SSP (what is
implemented) and the SAR (what was found). This guide covers creating and
managing SAPs.
Who this is for: assessors and assessment coordinators. Working with SAPs requires authentication and a role with SAP permissions — see RBAC.
- Access: signed in, with a role that permits creating/editing SAPs.
- Prerequisites: a completed SSP for the system being assessed — see System Security Plans.
-
Where to find it: Assessment → Assessment Plans (
/sap_documents).
A Security Assessment Plan (SAP) detail view.
flowchart LR
SSP[SSP] --> SAP[Assessment Plan]
SAP --> METHOD[Assessment methods per control]
SAP --> SAR[Assessment Results]
- Plan an assessment — define which controls are assessed and by what method before fieldwork begins.
- Import an existing OSCAL SAP and manage it in SPARC.
- Hand off to results — the SAP is the basis the SAR is created from.
The SAP is the OSCAL assessment-plan; the SAR (see
Assessment Results) records the outcome.
- Go to Assessment → Assessment Plans (
/sap_documents). - Click Create New, or Upload to import an existing SAP from JSON.
- Provide the plan metadata.
- Save. The detail page (
/sap_documents/:id) shows controls organized by family with an assessment method heatmap.
On the SAP detail page, the method heatmap (grouped by NIST family) shows how controls are distributed across assessment methods — a quick way to confirm coverage before the assessment starts. Edit the document metadata inline via the edit toggle.
On the detail page use Export OSCAL (validated / unvalidated) or JSON.
- Create the SAP only after the SSP is complete — the plan should reflect the controls actually in scope.
- Use the method heatmap to catch families with thin coverage before fieldwork, not after.
- Keep the SAP and the SAR paired: create the SAR from this SAP so the results trace cleanly back to the plan.
| Symptom | Likely cause | What to do |
|---|---|---|
| Upload rejected | File isn't a valid OSCAL SAP | Validate the JSON before importing |
| OSCAL export fails validation | Missing required plan metadata | Fill the flagged fields, then use the validated export |
| SAR wizard can't find this SAP | SAP not saved/complete | Confirm the SAP exists and is saved before creating the SAR |
| Can't edit the SAP | View-only role | Request SAP write permission (RBAC) |
- User Guides index
- System Security Plans (SSP) — the input to the plan.
- Security Assessment Results (SAR) — the next step.
- Screens & UI — exhaustive element-level reference.