JCAM

Overview

The JCAM integration connects RegScale to the Department of Justice's JCAM GRC tool (formerly CSAM). It brings System Security Plan content, control implementations, POA&Ms, assessments, and artifacts out of JCAM and into RegScale, and can push a limited set of updates back.

Direction	Commands	What moves
JCAM → RegScale	`import_*`	System front matter, privacy, authorization, continuity, POCs, information types, interconnections, FISMA rollups, control implementations, POA&Ms, assessments, artifacts
RegScale → JCAM	`export_*`	System front matter, authorization record, POA&Ms

The export_* commands overwrite data in JCAM. There is no conflict resolution between the two systems. Decide which system is authoritative for each data domain before enabling exports, and read Exporting to JCAM first.

The CSAM → JCAM rename

DoJ renamed the product from CSAM to JCAM. The CLI accommodates both spellings:

Item	Current	Still accepted
Command group	`regscale jcam`	`regscale csam` (hidden, logs a deprecation warning)
Config keys	`jcamToken`, `jcamURL`, `jcamFilter`, …	`csamToken`, `csamURL`, `csamFilter`, … (warns once per key)
Connection test	`regscale jcam test_jcam`	`regscale jcam test_csam`
SSP custom field	`JCAM Id`	`CSAM Id` (used automatically if `JCAM Id` does not exist)
API base path	`/CSAM/api`	— the served route genuinely did not change

Migrate to the jcam* spellings when convenient; nothing breaks in the meantime.

Prerequisites

RegScale CLI installed and initialized (regscale init)
A JCAM API token with the access described in Access & Permission Requirements
Your JCAM host URL — e.g. https://jcam.example.gov
Network access from the CLI host to the JCAM host over HTTPS (see Network access)
RegScale custom fields created — see below. This is a hard prerequisite.
NIST 800-53 Rev 4 and/or Rev 5 catalogs loaded in RegScale, for import_controls

Required RegScale custom fields

The integration stores JCAM-specific data in Security Plan custom fields. The CLI does not create these for you — if a field is missing, the command logs the missing field names and you must add them in RegScale before re-running.

The most important one is the linkage field:

Tab	Field	Type	Purpose
Basic Info	`JCAM Id`	text	Links a RegScale SSP to its JCAM system. Without this field populated, no system can be matched.

The full field set, by tab:

Basic Info
acronym (text), FISMA Id (text), JCAM Id (text), Sub Organization (text), Classification (select: Sensitive But Unclassified, Unclassified, Secret, Top Secret), Contractor System (select: Yes/No), FISMA Reportable (select: Yes/No), Critical Infrastructure (select: Yes/No), Mission Essential (select: Yes/No)

Agency Defined Data Items (new tab)
HVA Identifier (text), CFO Designation (Yes/No), AI-ML Components (select: None, Generative AI, Machine Learning), IOT-OT (select), External Web Interface (Yes/No), Law Enforcement Sensitive (Yes/No)

Financial Info (new tab)
Financial System (Yes/No), omb Exhibit (text), uii Code (text), Investment Name (text), Portfolio (text), Prior Fy Funding (dollar), Current Fy Funding (dollar), Next Fy Funding (dollar), Funding Import Status (text)

Status and Archive (new tab)
Risk Assessment Completed, Risk Assessment Next Due Date, Risk Assessment Expiration Date, SSP Completed, SSP Next Due Date, CM Completed, CM Next Due Date

Recovery Targets and Outcomes (new tab)
MTD (text), RTO (text), RPO (text)

Privacy Info (new tab)
PIA Date (date), PII (text), PTA Date (date), SORN Date (date), SORN Status (text), SORN Id (text)

Authorization (new tab)
Authorization Process (text), Initial Authorization Date (date), ATO Date (date), Authorization Next Due Date (date)

Continuity and Incident Response (new tab)
BIA Completed, BIA Next Due Date, CP Completed, CP Next Due Date, CP Training Completed, CP Training Next Due Date, CP Test Next Due Date, IRP Completed, IRP Next Due Date, IRP Training Completed, IRP Training Due Date, IRP Test Next Due Date, CPR Completed, CPR Next Due Date, CPR Expiration Date, Doc Review Completed, Doc Review Next Due Date, Doc Review Expiration Date (all date)

Continuity Tests (new tab)
CP Test Type (select: TableTop, Functional, Real-world, Call Tree), CP Date Tested (date), CP Test Outcome (select: Success, Failure), CP RPO Achieved (text), CP RTO Achieved (text), and the matching IRP * fields

Points of Contact (new tab) — all of type user
Certifying Official, Risk Executive, Co Authorizing Official, Chief Information Security Officer, Senior Information Security Officer, Alternate Information System Security Manager, Alternate Information System Security Officer, Senior Information Systems Security Officer, Technical Advisor, Technical Lead

Interconnection and Issue records use additional fields — Active and Classification on interconnections; External, Protection, Transfer Method on connections; User Identified Criticality and Delay - Dependency Reason on issues.

Tip: create the Basic Info fields first and run import_ssp. The command reports exactly which fields are missing, so you can add the remaining tabs iteratively rather than building all of them up front.

Access & Permission Requirements

JCAM credentials

Item	Where it comes from	Notes
API token	Issued by your JCAM administrator	A bearer token. Store as `jcamToken`. The CLI adds the `Bearer` prefix if you omit it.
JCAM URL	Your JCAM host, e.g. `https://jcam.example.gov`	Host only. Store as `jcamURL`.
Base path	Defaults to `/CSAM/api`	Override with `jcamBasePath` only if your tenant is on a renamed route.

JCAM tokens carry the permissions of the account they were issued for, and JCAM enforces per-system authorization. The token only ever sees the systems its underlying account is authorized for — which is also your primary scoping control.

Request the token against a dedicated service account rather than a named person, so the integration's access is independently auditable and survives staff changes.

Choosing a permission level

The decision is whether RegScale should be able to write to JCAM.

Import-only (recommended starting point)

Request a read-only token. Every import_* command and test_jcam work; every export_* command fails safely at the JCAM API rather than depending on an operator remembering not to run it.

Grant read access to:

System inventory and system detail for the systems in scope
Control implementations and inherited/common controls
POA&Ms, including their control and milestone sub-records
Control assessments
Artifacts, including artifact file download
The two reports listed in the endpoint table below — JCAM's System_Implementation_Statements_Query and Common Control Inheritance Report. Report execution is often a separate permission from system read; confirm it explicitly.

Export-enabled

Only needed if RegScale is authoritative for system front matter, the authorization record, or POA&Ms. Requires an ISSO / ISSM-level role able to update systems and create POA&Ms — write access to:

System front matter (update)
Security authorization record (update)
POA&Ms (create)

Recommendation: if you only intend to import, use a read-only token. Permissions are a stronger guardrail than process.

System scope

The CLI reads the full system list the token can see, then narrows it locally using the jcamFilter in init.yaml. Filtering happens client-side, so a broadly authorized token still retrieves everything before filtering. If least privilege matters for your deployment, scope the token's authorization to the intended systems as well.

API endpoints used

All paths are relative to <jcamURL>/CSAM/api.

Read — `test_jcam` and the `import_*` commands

Endpoint	Method	Effect	Required by
`v1/components`	GET	Read (connectivity probe only)	`test_jcam`
`v1/systems`	GET	Read — system inventory, filtered locally by `jcamFilter`	Every `import_` / `export_` command; this builds the run scope
`v1/systems/{id}`	GET	Read — system front matter	`import_ssp`, `export_ssp` (drift check)
`v1/systems/{id}/status`	GET	Read	`import_ssp`
`v1/systems/{id}/additionalstatus`	GET	Read	`import_ssp`
`v1/systems/{id}/agencydefineddataitems`	GET	Read	`import_ssp`
`v1/systems/{id}/securityauthorization`	GET	Read	`import_ssp`, `export_ssp`
`v1/systems/{id}/privacy`	GET	Read	`import_ssp`
`v1/systems/{id}/sorn`	GET	Read	`import_ssp`
`v1/systems/{id}/continuityresponse`	GET	Read	`import_ssp`
`v1/systems/{id}/continuitytest`	GET	Read	`import_ssp`
`v1/systems/{id}/systempointsofcontact`	GET	Read	`import_ssp`
`v1/systems/{id}/infotypes`	GET	Read	`import_ssp`
`v1/systems/{id}/interconnections`	GET	Read	`import_ssp`
`v1/systems/{id}/FISMArollup`	GET	Read	`import_ssp`
`v1/systems/{id}/controls/AC-1`	GET	Read — probe to detect Rev 4 vs Rev 5	`import_controls`
`v1/systems/{id}/controls/{control_id}`	GET	Read — control implementation	`import_controls`
`v1/systems/{id}/inheritedcontrols`	GET	Read	`import_controls`
`v1/reports/System_Implementation_Statements_Query`	POST	Read — report execution	`import_controls`
`v1/reports/Common Control Inheritance Report`	POST	Read — report execution	`import_controls`
`v1/systems/{id}/poams`	GET	Read	`import_poam`, `export_poams` (duplicate detection)
`v1/systems/{id}/poams/{poam_id}/controls`	GET	Read	`import_poam`
`v1/systems/{id}/poams/{poam_id}/milestones`	GET	Read	`import_poam`
`v1/systems/{id}/controls/{control_id}/assessments`	GET	Read	`import_assessments`
`v1/systems/{id}/artifacts`	GET	Read — artifact metadata	`import_artifacts`
`v1/artifacts/{artifact_id}`	GET	Read — file download	`import_artifacts`

POST on the two report paths is a read. JCAM takes report query criteria in the request body; those calls execute a report and return rows. They do not create or modify records.

Write — `export_*` commands only

Endpoint	Method	Effect	Required by
`v1/systems/{id}`	PUT	Write — overwrites JCAM system front matter	`export_ssp`
`v1/systems/{id}/securityauthorization`	PUT	Write — overwrites the JCAM authorization record	`export_ssp`
`v1/systems/{id}/poams`	POST	Write — creates POA&Ms in JCAM	`export_poams`

Network access

From	To	Protocol / Port
Host running the RegScale CLI	JCAM host	HTTPS / TCP 443

JCAM typically runs on restricted government infrastructure. Expect to coordinate one or more of the following with your network and JCAM teams:

Allow-listing the CLI host's egress IP on the JCAM side
Access from inside a government network or over VPN
An outbound proxy allowance for the JCAM hostname
Trust for an internal certificate authority on the CLI host

TLS verification follows the CLI's sslVerify setting and is on by default. Install your internal CA in the CLI host's trust store rather than disabling verification.

The CLI keeps a pooled HTTP/2 connection with a 60-second request timeout and retries transient failures (408, 429, 500, 502, 503, 504) up to five times. Some JCAM report endpoints are slow by design; a report that consistently times out is a JCAM performance matter, not a permissions one.

RegScale-side access

The RegScale account whose token is in init.yaml must be able to:

Read and create Security Plans — import_ssp creates a plan for any in-scope JCAM system that has no matching JCAM Id
Update Security Plans — front matter, categorization, status, deployment model
Read and write Custom Fields / Form Field Values on Security Plans
Read Catalogs and Security Controls — for Rev 4 / Rev 5 control matching
Create and update Control Implementations
Create and update Issues (POA&Ms) and their milestones
Create Assessments
Create Files and upload attachments (artifacts)
Read Users — for Points of Contact mapping
Create Interconnections and parent/child plan relationships

export_* additionally requires read access to whatever RegScale data is being pushed; it does not need any additional RegScale write permission.

Configuration

Add the JCAM keys to init.yaml:

jcamToken: "Bearer AAAA...."
jcamURL: "https://jcam.example.gov"
jcamBasePath: "/CSAM/api"

jcamFilter:
  organization: MGMT
  systemType: Major Application, General Support Service
  operationalStatus: Operational

jcamArtifactTypes:
  - Security Authorization
  - Business Impact Analysis
  - Contingency Plan

jcamAgencyDefinedDataItems:
  AI/ML Components: AI-ML Components

jcamFrameworkCatalog:
  800-53r5: 12
  800-53r4: 9

Configuration reference

Key	Type	Description
`jcamToken`	string	JCAM bearer token. The `Bearer` prefix is optional.
`jcamURL`	string	JCAM host URL
`jcamBasePath`	string	API base path. Defaults to `/CSAM/api` — leave it alone unless your tenant differs.
`jcamFilter`	dict	Selects which JCAM systems are in scope. Required in practice.
`jcamArtifactTypes`	list	JCAM artifact-type labels to import. Case-sensitive; must match JCAM exactly.
`jcamAgencyDefinedDataItems`	dict	Maps a JCAM agency-defined data item name to the RegScale custom field that receives it
`jcamFrameworkCatalog`	dict	Maps `800-53r5` / `800-53r4` to the RegScale catalog IDs to match controls against
`sslVerify`	boolean	Global CLI setting; also governs the JCAM connection

`jcamFilter`

Filtering is AND across keys, OR within a comma-separated value. The example above selects systems in the MGMT organization and of type Major Application or General Support Service and with operational status Operational.

Valid filter keys:

id, name, acronym, organization, systemType, financialSystem, classification, contractorSystem, fismaReportable, criticalInfrastructure, missionCritical, uiiCode, portfolio, categorization, fundingStatus, operationalStatus

If no systems match, the command stops with No results match filter in JCAM rather than proceeding against an empty scope.

`jcamFrameworkCatalog`

Use the lowercase keys 800-53r5 and 800-53r4. If the setting is absent, the CLI looks the two NIST catalogs up by their built-in identifiers — which works only if those catalogs are loaded in your RegScale instance.

CLI Commands

regscale jcam test_jcam            # Verify connectivity and credentials
regscale jcam import_ssp           # Import system records and all front-matter domains
regscale jcam import_controls      # Import control implementations and inheritance
regscale jcam import_poam          # Import POA&Ms, their controls and milestones
regscale jcam import_assessments   # Import control assessments
regscale jcam import_artifacts     # Import and attach artifact files
regscale jcam export_ssp           # Push front matter + authorization to JCAM (OVERWRITES)
regscale jcam export_poams         # Push POA&Ms to JCAM (OVERWRITES)

Command names accept underscores or hyphens — import_ssp and import-ssp are equivalent.

None of these commands take a Security Plan ID. Scope always comes from jcamFilter plus the JCAM Id values already stored on your RegScale plans. To narrow a run to one system, narrow the filter:

jcamFilter:
  id: "1234"

export_controls and export_assessment are registered but not yet implemented; they exit with Future Feature.

test_jcam

Probes the JCAM API and reports the outcome. It validates the token, URL, base path, network path, and TLS trust. It does not validate jcamFilter.

regscale jcam test_jcam

import_ssp

The workhorse command. For each JCAM system matching jcamFilter:

Creates a RegScale Security Plan if no plan carries that JCAM Id, otherwise updates the existing one
Saves system front matter — name, categorization, status, type, purpose
Imports agency-defined data items, per jcamAgencyDefinedDataItems
Imports the authorization process and status
Imports privacy data (PTA, PIA, PII, SORN)
Imports continuity and incident-response data, including test records
Imports Points of Contact, matched to RegScale users
Imports additional status and information types
Imports interconnections
Imports FISMA parent/child rollups

regscale jcam import_ssp

Each domain is reported separately at the end of the run. A domain that failed is reported as a failure and the command exits nonzero — a partial run cannot be mistaken for a clean sync. A domain with nothing to import is reported as skipped, which is normal (many systems have no SORN, for example).

Run this first: the other import commands rely on the JCAM Id linkage it establishes.

import_controls

Imports control implementations for every in-scope system, plus inherited and common controls.

regscale jcam import_controls

The command probes AC-1 to determine whether the system is on NIST 800-53 Rev 4 or Rev 5, then matches JCAM controls against the corresponding RegScale catalog. A system on any other framework is skipped with a warning.

Requires the relevant catalog to be loaded in RegScale and, ideally, jcamFrameworkCatalog to be set.

Implementation statements come from a JCAM report endpoint. Reports can be slow — allow the command time to complete rather than interrupting it.

import_poam

Imports POA&Ms as RegScale Issues, including their associated controls and milestones.

regscale jcam import_poam

import_assessments

Imports control assessments from JCAM as RegScale Assessments, linked to the control they assess.

regscale jcam import_assessments

import_artifacts

Downloads artifact files from JCAM and attaches them to the corresponding RegScale Security Plan.

regscale jcam import_artifacts

Only artifact types listed in jcamArtifactTypes are imported. The labels are case-sensitive and must match JCAM's artifactType values exactly. If none are configured, the command stops with No artifacts types configured to be imported.

Already-attached files are detected and not re-downloaded.

Exporting to JCAM

⚠️ Exports overwrite JCAM data

export_ssp and export_poams write into JCAM. There is no conflict resolution — if JCAM has been edited since your last import, those edits can be lost.

Both commands:

Prompt for confirmation before doing anything. Pass --yes to skip the prompt in automation — only after you have validated a manual run.
Run pre-flight drift detection. Before writing, the CLI compares the current JCAM record against what it is about to send. If a write would replace a non-empty JCAM value with a different one, the command reports the affected fields and stops.
Honor --force to write anyway. Drift detection is deliberately conservative and will occasionally flag a harmless change (a date moving by one day); --force is the override.

export_ssp

Pushes system front matter and the security authorization record from RegScale to JCAM.

regscale jcam export_ssp                 # prompts, stops on drift
regscale jcam export_ssp --force         # prompts, overwrites drifted fields
regscale jcam export_ssp --yes --force   # unattended overwrite — be certain

Option	Effect
`--yes`	Skip the overwrite confirmation prompt
`--force`	Bypass drift detection and overwrite JCAM values that differ

export_poams

Pushes POA&Ms from RegScale to JCAM.

regscale jcam export_poams

Option	Effect
`--yes`	Skip the overwrite confirmation prompt
`--force`	Bypass duplicate-title detection and POST every POA&M to JCAM

Without --force, POA&Ms whose title already exists in JCAM are treated as duplicates and skipped. --force will create duplicates — use it only when you know the existing JCAM records should be superseded.

Recommended practice

Run regscale jcam import_ssp immediately before any export. That way you know what is in JCAM, and drift detection compares against current data rather than a stale picture.

Recommended rollout

Create the Basic Info custom fields, especially JCAM Id
regscale jcam test_jcam — prove credentials, network, and TLS
Set jcamFilter to a single system (id: "<one system>")
regscale jcam import_ssp — add any custom fields it reports as missing, then re-run
Add import_controls, import_poam, import_assessments, import_artifacts one at a time, reviewing results after each
Widen jcamFilter to the full intended scope
Schedule the imports; leave exports disabled unless RegScale is the authoritative source

Troubleshooting

Symptom	Likely cause	Resolution
`Failure to retrieve plans from JCAM`	Bad or expired token, wrong URL, wrong base path, or no network path	Run `test_jcam`; confirm `jcamToken`, `jcamURL`, `jcamBasePath`
`No results match filter in JCAM`	`jcamFilter` matches nothing, or the token is not authorized for those systems	Check filter values against the systems the account can see in the JCAM UI
`The following custom fields are missing: [...]`	Required RegScale custom fields not created	Add the listed fields on the named tab, then re-run
Nothing imports even though systems matched	RegScale plans have no `JCAM Id` populated	Run `import_ssp` first; it creates plans and establishes the linkage
Warning about the legacy `CSAM Id` field	Tenant predates the rename	Working as intended. Rename the field to `JCAM Id` when convenient.
Warning that a `csam*` config key is deprecated	`init.yaml` still uses pre-rename keys	Working as intended. Rename to the `jcam*` spelling.
A domain reports "skipped" for most systems	JCAM has no data for that domain on those systems	Usually normal — confirm in the JCAM UI
A domain reports "failure" and the command exits nonzero	API or authorization error on that endpoint	Check the run summary for the specific message; often a missing read permission on one endpoint
`import_controls` says the framework is unsupported	System is on neither 800-53 Rev 4 nor Rev 5	Not currently supported
`import_controls` produces no implementations	Catalog not loaded, or `jcamFrameworkCatalog` points at the wrong catalog ID	Load the NIST catalog and set `jcamFrameworkCatalog` with lowercase `800-53r5` / `800-53r4` keys
`No artifacts types configured to be imported`	`jcamArtifactTypes` unset or still the placeholder	Set it to the exact, case-sensitive JCAM artifact-type labels
Report-backed imports time out	JCAM report endpoints are slow under load	Retry off-peak; raise with your JCAM administrators if persistent
Export stops reporting drift	JCAM holds different non-empty values than RegScale	Import first and review. Use `--force` only when RegScale is authoritative.
Export fails with an authorization error	Token is read-only	Expected on an import-only deployment. Request write access only if you intend to export.