User Guides

User Guides

Task-oriented guides for using the SPARC application, one per major area of the UI. Where the Screens & UI page is an exhaustive element-by-element reference, these guides answer "how do I actually get this done?" — step by step, with the primary use cases and workflows for each screen.

SPARC helps compliance teams build and maintain the OSCAL documents that make up a FedRAMP / NIST 800-53 authorization package: the System Security Plan (SSP), Assessment Plan (SAP), Security Assessment Results (SAR), and Plan of Action & Milestones (POA&M) — plus the control catalogs, baselines, and component definitions they build on.

New here? Start with Getting Started to stand up and log in, then User Guide: Getting Oriented for a tour of the interface.

These guides ship inside the app. From v1.13.1, every SPARC deployment bundles this exact set of guides as an in-app Help Center — open it from the Help & Guides section in the left sidebar, the ? button in the top navigation (which deep-links to the guide for the screen you're on), or the Resources page. The in-app guides render the same Markdown you see here, so the wiki and the shipped documentation never drift (#784).

---

The compliance lifecycle in SPARC

Most work in SPARC follows the Risk Management Framework (RMF) document lifecycle. Each stage produces an OSCAL document that feeds the next:

flowchart LR
    CAT[Control Catalog] --> BASE[Baseline / Profile]
    BASE --> SSP[System Security Plan]
    CDEF[Component Definition] --> SSP
    SSP --> SAP[Assessment Plan]
    SAP --> SAR[Assessment Results]
    SAR --> POAM["POA&M"]
    SSP -. bundled into .-> ATO[ATO Package]
    SAP -. bundled into .-> ATO
    SAR -. bundled into .-> ATO
    POAM -. bundled into .-> ATO

Loading

1. Load a control catalog (e.g. NIST SP 800-53 Rev 5) and tailor a baseline from it.
2. Document how your system meets each control in an SSP, optionally reusing component definitions (CDEF).
3. Plan the assessment in a SAP, record the outcome in a SAR.
4. Track open findings to closure in a POA&M.
5. Bundle everything for a boundary into an ATO package.

---

Guides by area

Orientation & workspace

Guide	Covers
Getting Oriented	Dashboard, navigation, the Organization → Boundary → document hierarchy, roles
Authorization Boundaries	Boundaries, environments, team members, leveraged authorizations, ATO packages

Controls library

Guide	Covers
Control Catalogs & Baselines	Catalogs, families, controls, baselines/profiles, control mappings
Converters & Imports	Rule-to-NIST converters, STIG parsing, import flows

OSCAL documents

Guide	Covers
System Security Plans (SSP)	Create, enrich, edit control implementations, export
Component Definitions (CDEF)	Reusable component control sets, bulk apply
Security Assessment Plan (SAP)	Plan how controls will be assessed
Security Assessment Results (SAR)	Record pass/fail outcomes, findings
POA&M	Track findings, risks, remediations, milestones
Evidence & Attestations	Upload evidence, attach attestations
HDF Amendment Triage	Ingest scanner findings, triage into dispositions, export HDF Amendments for CI

Trust store & administration

Guide	Covers
Compliance Library	Authoritative sources, review & promotion queues, federation
Security Keys & Smart Cards	Enroll a FIDO2 key or CAC/PIV; passwordless sign-in
Administration	Users, roles/permissions, service accounts, audit log

---

Conventions used in these guides

• Navigation paths are written as Menu → Item (e.g. Implementation → System Security Plans).
• Button and field labels appear in bold and match what you see on screen.
• Each guide opens with a Before you start section listing the role and any prerequisite documents you need.
• For the full inventory of every screen, route, and field, see the Screens & UI reference.

Screenshots are being added incrementally. Diagrams in these guides render directly in the wiki; per-screen captures are tracked as a follow-up.