Skip to main content

02 / Maintain your certification package

Your SSP is the starting point.
Your SDR is a maintained record.

Keep implementation details, evidence, and review decisions together. Carry supported SSP content forward, resolve the gaps, and export your SDR and Certification Package Overview from the records your team maintains.

Walk through your package Explore your Rev5 transition
Certification PackageProduct screenshot
Boundera Certification Package workspace showing CPO, SDR, ongoing certification, and vulnerability report exports. The SDR offers JSON and HTML downloads.
Security Decision Record + Certification Package OverviewHuman-readable records and machine-readable JSON.
Package export example (20x Class C). Rev5 packages use Rev5 controls.

Two connected outputs

Explain the offering.
Show the security decisions.

The CPO gives reviewers the overview. The SDR holds the implementation and review record behind it.

SDR

Security Decision Record

A record of how applicable rules and Rev5 controls are addressed, with evidence and review details behind the implementation.

  • Control narratives, parameter values, implementation status, and inherited responsibilities.
  • Verification and validation details, independent review, responses, and supporting artifacts.
  • Version and update information so reviewers can follow changes.

Boundera output: JSON + human-readable HTML.

Read the official SDR requirements
CPO

Certification Package Overview

A concise introduction to the cloud service offering and the information included in its certification package.

  • Service identification, contacts, included services, and relevant policy references.
  • Boundary resources, information flows, third-party dependencies, and cryptographic module records.
  • Package ownership, version information, and the applicable assessment summary.

Boundera output: JSON + human-readable HTML.

Read the official CPO requirements

Both exports depend on the records your team maintains. Missing evidence, unresolved gaps, and independent assessment work still need to be completed before submission.

From existing work to current records

Prepare it once.
Keep it connected.

Move from a document handoff to a repeatable process for review, maintenance, and export.

  1. Bring supported SSP content forward

    Import the narratives and context Boundera can recover. Review the source and proposed records before accepting changes.

    Output

    Reviewable control and rule records with source context.

  2. Fill the gaps in the record

    Connect implementation details with evidence. Complete missing parameters, boundary information, module records, and assessment details.

    Output

    A maintained package with visible gaps and supporting evidence.

  3. Review readiness and export

    Inspect completeness and schema checks, resolve blockers, and generate the package documents. Retain versions for later review.

    Output

    SDR and CPO exports in JSON and HTML, with package version history.

Beyond the SDR and CPO

Keep the supporting
reports close.

The package workspace also brings together outputs from the ongoing work your team records.

Ongoing Certification Report
Prepare a report from maintained certification information for the reporting period.
Vulnerability reports
Export the Vulnerability Detail Report, Accepted Vulnerability Info, and Historical VER Activity from vulnerability evaluation and response records.
Significant change and incident records
Keep prepared change notifications and incident reports available with the package. Your team manages external communications and delivery.
Package versions
Retain generated versions so a later review can refer to the records available at that point.
See how reviewers access the package

Walk through your
own records with us.

Bring your current package or review process. See what carries forward and what your team needs to finish.

Plan your Rev5 transition