Import OSCAL Assessment Results (AR)

Import an OSCAL Assessment Results (AR) package from another instance or external tool to create an engagement.

Before you begin

Prepare the following files before starting the import.

• Catalog JSON file
• Profile JSON file
• SSP JSON file
• Assessment Plan (AP) JSON file
• Assessment Results (AR) JSON file
• Overlay JSON file (optional)
• POA&M JSON file (optional)

Role required: sn_irm_cont_auth.info_system_sec_manager, sn_irm_cont_auth.info_system_sec_officer, or sn_irm_cont_auth.admin

Note:

Only JSON files in valid OSCAL format are supported. The AR cannot be imported as a standalone file. It must always be imported together with the SSP and its associated files.

Procedure

1. Navigate to Workspaces > CAM Workspace.
2. In the CAM Workspace, select the icon.
3. Select New Import from the All OSCAL imports landing page.
4. In the Details section, complete the following fields and select Next.

   Table 1. Oscal import details

   Field	Description
   OSCAL model	Select AR.
   Source	Enter a name to identify this import.
   Import status recipients	(Optional) Select users to notify when the import completes.

5. In the Attachments section, upload the required files in each section and select Next after completing each section.

   The Attachments step presents the following sections in order. Mandatory sections are marked with an asterisk (*).

   Provide the attachments*

   Upload the mandatory files:

   • Catalog * — Catalog JSON file
   • Profile * — Profile JSON file
   • SSP * — SSP JSON file

   You can also optionally attach boundary, data flow, network, and enterprise architecture diagrams.

   Overlay attachments

   Upload an overlay JSON file if applicable. This section is optional.

   Assessment plan attachments*

   Upload the AP JSON file linked to the AR that you are importing. The maximum file size is 1024 MB.

   Assessment results attachments*

   Upload the AR JSON file. The maximum file size is 1024 MB.

   POA&M attachments

   Upload a POA&M JSON file if applicable. This section is optional. If provided, POA&M items from this file are aggregated with the POA&M items already present in the AR file.

6. In the User and Group Mapping step, verify or update the user and group mappings, then select Next.

   The step contains two sections:

   User mapping

   Lists all users from the uploaded files (AP, AR, and POA&M). Each row shows the OSCAL user, the corresponding ServiceNow user, and the roles the user is listed as in the import. For example, SCA, Assigned To (Engagement), Owner (Control Test), or Assigned To (POA&M).

   Users are mapped automatically based on the data in the JSON files. If the import files were exported from a different instance, some users might not exist on the target instance and their mapping will be empty. You can update any mapping manually before proceeding.

   Group mapping

   Lists all groups from the uploaded files and maps them to ServiceNow groups. Each row shows the OSCAL group, the corresponding ServiceNow group, and the role the group is listed as. For example, Issue Manager Group.

7. In the Preview and Override step, review the summary of records that will be created, skipped, or overridden.

   The preview table shows the record types and their counts across three columns: Will be created, Will be skipped, and Overridden.

   Note:

   Existing control objectives from the same source and reference are skipped automatically, and new entries are created for any new sources.
   1. If the engagement items from this package already exist on the instance, choose whether to skip or override them.
   2. To skip or override specific object types, select the object from the Select the ones you would wish to override list, select Skip or Override option and then select the Override button.
   3. Select Import to start the import.
      A confirmation message displays indicating the import process has started. Select Close.

      The system processes the import. This may take several minutes. If you specified import status recipients in the Details step, they receive a notification when the import completes.