fedramp_values.xml

<?xml version="1.0" encoding="UTF-8"?>
<fedramp-values
    xmlns="https://fedramp.gov/ns/oscal">
    <metadata>
        <title>[EXPERIMENTAL] FedRAMP Defined Identifiers and Accepted Values</title>
        <title-short>FedRAMP Data Values (Experimental)</title-short>
        <published>2023-06-30T00:00:00Z</published>
        <last-modified>2023-06-30T00:00:00Z</last-modified>
        <version>fedramp-2.0.0-oscal-1.1.1</version>
        <oscal-version>1.1.1</oscal-version>
        <revisions>
            <revision>
                <published>2023-06-30T00:00:00Z</published>
                <version>DRAFT-01</version>
                <prop
                    name="party-uuid"
                    ns="https://fedramp.gov/ns/oscal"
                    value="b6a86c7d-4883-4ff8-9bcf-632b72ac3b80"/>
                <remarks>
                    <p>Initial draft for fedramp-2.0.0-oscal-1.1.1 release. Subject to change.</p>
                </remarks>
            </revision>
        </revisions>
        <author>FedRAMP PMO</author>
        <description>This EXPERIMENTAL file provides the FedRAMP defined identifiers and acceptable values in a machine-readable format.</description>
        <remarks/>
    </metadata>

    <namespace>
        <ns
            name="fedramp"
            ns="https://fedramp.gov/ns/oscal"/>
    </namespace>

    <value-set
        name="system-identifier-type">
        <formal-name>System Identifier Type</formal-name>
        <description>Indicates the source of the unique ID assigned to the system. FedRAMP requires a FedRAMP-assigned identifier; however, additional
            identifiers may also be provided.</description>
        <binding
            pattern="system-id/@identifier-type"/>
        <allowed-values
            allow-other="yes">
            <enum
                short-label="FedRAMP ID"
                value="http://fedramp.gov">FedRAMP-Assigned Identifier</enum>
            <enum
                short-label="UUIDv4"
                value="https://ietf.org/rfc/rfc4122">RFC-4122 UUIDv4 Value</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="address-type">
        <formal-name>Address Type</formal-name>
        <description>The type of address for the party</description>
        <binding
            pattern="party/address/@type"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Home"
                value="home">Home</enum>
            <enum
                short-label="Work"
                value="work">Work</enum>
        </allowed-values>
        <remarks>FedRAMP requires work addresses.</remarks>
    </value-set>

    <!-- Removed value-set[@name='eauth-level'] in accordance with NIST SP 800-63-3. -->

    <value-set
        name="identity-assurance-level">
        <formal-name>Identity Assurance Level</formal-name>
        <description>The identity assurance level as defined by NIST SP 800-63, Revision 3.</description>
        <binding
            pattern="system-characteristics/prop[@name='identity-assurance-level']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="L"
                value="1">Low</enum>
            <enum
                short-label="M"
                value="2">Moderate</enum>
            <enum
                short-label="H"
                value="3">High</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="authenticator-assurance-level">
        <formal-name>Authenticator Assurance Level</formal-name>
        <description>The authenticator assurance level as defined by NIST SP 800-63, Revision 3.</description>
        <binding
            pattern="system-characteristics/prop[@name='authenticator-assurance-level']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="L"
                value="1">Low</enum>
            <enum
                short-label="M"
                value="2">Moderate</enum>
            <enum
                short-label="H"
                value="3">High</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="federation-assurance-level">
        <formal-name>Federation Assurance Level</formal-name>
        <description>The federation assurance level as defined by NIST SP 800-63, Revision 3.</description>
        <binding
            pattern="system-characteristics/prop[@name='federation-assurance-level']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="L"
                value="1">Low</enum>
            <enum
                short-label="M"
                value="2">Moderate</enum>
            <enum
                short-label="H"
                value="3">High</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="authorization-type">
        <formal-name>Authorization Type</formal-name>
        <description>The FedRAMP Authorization Type</description>
        <binding
            pattern="system-characteristics/prop[@name='authorization-type'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="JAB"
                value="fedramp-jab">FedRAMP JAB P-ATO</enum>
            <enum
                short-label="Agency"
                value="fedramp-agency">FedRAMP Agency ATO</enum>
            <enum
                short-label="LI-SaaS"
                value="fedramp-li-saas">FedRAMP Tailored for LI-SaaS</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="service-model">
        <formal-name>Service Model</formal-name>
        <description>The cloud service model.</description>
        <binding
            pattern="system-characteristics/prop[@name='cloud-service-model']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="SaaS"
                value="saas">Software as a Service</enum>
            <enum
                short-label="PaaS"
                value="paas">Platform as a Service</enum>
            <enum
                short-label="IaaS"
                value="iaas">Infrastructure as a Service</enum>
            <enum
                short-label="Other"
                value="other">Other</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="deployment-model">
        <formal-name>Deployment Model</formal-name>
        <description>The cloud deployment model.</description>
        <binding
            pattern="system-characteristics/prop[@name='cloud-deployment-model'][@ns='https://fedramp.gov/ns/oscal']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Public"
                value="public-cloud">Public Cloud</enum>
            <enum
                short-label="Private"
                value="private-cloud">Private Cloud</enum>
            <enum
                short-label="USG-Only"
                value="government-only-cloud">U.S. Government Only</enum>
            <enum
                short-label="Hybrid"
                value="hybrid-cloud">Hybrid</enum>
            <enum
                short-label="Other"
                value="other">Other</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="security-level">
        <formal-name>Security Impact Level</formal-name>
        <description>The security objective level as defined by NIST SP 800-60.</description>
        <binding
            pattern="security-sensitivity-level"/>
        <binding
            pattern="security-impact-level"/>
        <binding
            pattern="(security-objective-confidentiality|security-objective-integrity|security-objective-availability)"/>
        <binding
            pattern="system-information/information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="L"
                value="fips-199-low">Low</enum>
            <enum
                short-label="M"
                value="fips-199-moderate">Moderate</enum>
            <enum
                short-label="H"
                value="fips-199-high">High</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="privacy-designation">
        <formal-name>Privacy Designation</formal-name>
        <description>Indicates whether this system is privacy sensitive.</description>
        <binding
            pattern="system-information/prop[@name='privacy-sensitive']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Yes"
                value="yes">Privacy Sensitive</enum>
            <enum
                short-label="No"
                value="no">Not Privacy Sensitive</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="privacy-threshold-analysis-q1">
        <formal-name>Privacy Threshold Analysis (Q1)</formal-name>
        <description>Does the ISA collect, maintain, or share PII in any identifiable form?</description>
        <binding
            pattern="system-information/prop[@name='pta-1'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Yes"
                value="yes">Yes</enum>
            <enum
                short-label="No"
                value="no">No</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="privacy-threshold-analysis-q2">
        <formal-name>Privacy Threshold Analysis (Q2)</formal-name>
        <description>Does the ISA collect, maintain, share PII info from or about the public?</description>
        <binding
            pattern="system-information/prop[@name='pta-2'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Yes"
                value="yes">Yes</enum>
            <enum
                short-label="No"
                value="no">No</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="privacy-threshold-analysis-q3">
        <formal-name>Privacy Threshold Analysis (Q3)</formal-name>
        <description>Has a Privacy Impact Assessment ever been performed for the ISA?</description>
        <binding
            pattern="system-information/prop[@name='pta-3'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Yes"
                value="yes">Yes</enum>
            <enum
                short-label="No"
                value="no">No</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="privacy-threshold-analysis-q4">
        <formal-name>Privacy Threshold Analysis (Q4)</formal-name>
        <description>Is there a Privacy Act System of Records Notice (SORN) for this ISA system?</description>
        <binding
            pattern="system-information/prop[@name='pta-4'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Yes"
                value="yes">Yes</enum>
            <enum
                short-label="No"
                value="no">No</enum>
        </allowed-values>
        <remarks>If "yes" a SORN ID must be provided.</remarks>
    </value-set>

    <value-set
        name="likelihood">
        <formal-name>Likelihood</formal-name>
        <description>The likelihood of a risk.</description>
        <binding
            pattern="risk/risk-metric[@name='likelihood'][@system='https://fedramp.gov']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="L"
                value="low">Low</enum>
            <enum
                short-label="M"
                value="moderate">Moderate</enum>
            <enum
                short-label="H"
                value="high">High</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="impact-level">
        <formal-name>Impact Level</formal-name>
        <description>The impact level of a risk.</description>
        <binding
            pattern="risk/risk-metric[@name='impact'][@system='https://fedramp.gov']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="L"
                value="low">Low</enum>
            <enum
                short-label="M"
                value="moderate">Moderate</enum>
            <enum
                short-label="H"
                value="high">High</enum>
        </allowed-values>
    </value-set>

    <!-- Additional values to be defined here. -->

    <value-set
        name="information-type-system">
        <formal-name>Information Type System</formal-name>
        <description>Identifies the system from which the information type was defined.</description>
        <binding
            pattern="information-type/information-type-id/@system"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="SP 800-60 V2R1"
                value="https://doi.org/10.6028/NIST.SP.800-60v2r1">NIST SP 800-60, Volume 2, Revision 1</enum>
        </allowed-values>
        <remarks>FedRAMP only allows information types defined in NIST SP 800-60v2r1.</remarks>
    </value-set>

    <value-set
        name="operational-status">
        <formal-name>Operational Status (system)</formal-name>
        <description>The operational status of the system</description>
        <binding
            pattern="status/@state"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Operational"
                value="operational">Operational</enum>
            <enum
                short-label="Development"
                value="under-development">Under Development</enum>
            <enum
                short-label="Major Mod."
                value="under-major-modification">Major Modification</enum>
            <enum
                short-label="Alternative"
                value="disposition">Alternative Implementation</enum>
            <enum
                short-label="Other"
                value="other">Other</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="user-type">
        <formal-name>User Type</formal-name>
        <description>Identifies the user type.</description>
        <binding
            pattern="user/prop[@name='type']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="I"
                value="internal">Internal</enum>
            <enum
                short-label="E"
                value="external">External</enum>
            <enum
                short-label="P"
                value="general-public">General Public</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="user-privilege">
        <formal-name>User Privilege</formal-name>
        <description>Identifies the privilege level of the user.</description>
        <binding
            pattern="user/prop[@name='privilege-level']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="P"
                value="privileged">Privileged</enum>
            <enum
                short-label="NP"
                value="non-privileged">Non-Privileged</enum>
            <enum
                short-label="NLA"
                value="no-logical-access">No Logical Access</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="user-sensitivity-level">
        <formal-name>User Sensitivity level</formal-name>
        <description>Identifies the sensitivity level of the user.</description>
        <binding
            pattern="user/prop[@name='sensitivity'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="High"
                value="high-risk">High Risk</enum>
            <enum
                short-label="Sev."
                value="severe">Severe</enum>
            <enum
                short-label="Mod."
                value="moderate">Moderate</enum>
            <enum
                short-label="Lim."
                value="limited">Limited</enum>
            <enum
                short-label="N/A"
                value="not-applicable">Not Applicable</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="interconnection-direction">
        <formal-name>Interconnection Direction</formal-name>
        <description>Identifies the direction of information flow for the interconnection.</description>
        <binding
            pattern="component[@component-type='interconnection']/prop[@name='interconnection-direction'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="In"
                value="incoming">Incoming</enum>
            <enum
                short-label="Out"
                value="outgoing">Outgoing</enum>
            <enum
                short-label="In/Out"
                value="incoming-outgoing">Bi-Directional</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="interconnection-security">
        <formal-name>Interconnection Security</formal-name>
        <description>Identifies the type of security applied to the interconnection.</description>
        <binding
            pattern="component[@component-type='interconnection']/prop[@name='interconnection-security'][@ns='https://fedramp.gov/ns/oscal']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="IPsec"
                value="ipsec">IPsec</enum>
            <enum
                short-label="VPN"
                value="vpn">Virtual Private Network</enum>
            <enum
                short-label="TLS"
                value="tls">Transport-Layer Security</enum>
            <enum
                short-label="TLS"
                value="dtls">Transport-Layer Security</enum>
            <enum
                short-label="Cert"
                value="certificate">Certificate Authentication Security</enum>
            <enum
                short-label="SFT"
                value="secure-file-transfer">Secure File Transfer</enum>
            <enum
                short-label="Other"
                value="other">Other</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="component-type">
        <formal-name>Component Type</formal-name>
        <description>identifies the component type.</description>
        <binding
            pattern="component/@component-type"/>
        <allowed-values
            allow-other="yes">
            <enum
                short-label="S/W"
                value="software">Software</enum>
            <enum
                short-label="H/W"
                value="hardware">Hardware</enum>
            <enum
                short-label="Svc"
                value="service">Service</enum>
            <enum
                short-label="Pol"
                value="policy">Policy</enum>
            <enum
                short-label="Pros"
                value="process">Process</enum>
            <enum
                short-label="Proc"
                value="procedure">Procedure</enum>
            <enum
                short-label="Plan"
                value="plan">Plan</enum>
            <enum
                short-label="Guide"
                value="guidance">Guidance</enum>
            <enum
                short-label="Std"
                value="standard">Standard</enum>
            <enum
                short-label="Val"
                value="validation">Validation</enum>
            <enum
                short-label="Sys"
                value="this-system">This System</enum>
            <enum
                short-label="Int"
                value="interconnection">Interconnection</enum>
            <enum
                short-label="Ls"
                value="leveraged-system">Leveraged System</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="asset-type">
        <formal-name>Asset Type</formal-name>
        <description>Identifies the type of asset.</description>
        <binding
            pattern="component/prop[@name='asset-type']"/>
        <binding
            pattern="inventory-item/prop[@name='asset-type']"/>
        <allowed-values
            allow-other="yes">
            <enum
                short-label="OS"
                value="operating-system">Operating System</enum>
            <enum
                short-label="DB"
                value="database">Database</enum>
            <enum
                short-label="Web"
                value="web-server">Service</enum>
            <enum
                short-label="DNS"
                value="dns-server">Policy</enum>
            <enum
                short-label="eMail"
                value="email-server">Process</enum>
            <enum
                short-label="LDAP"
                value="directory-server">Procedure</enum>
            <enum
                short-label="PBX"
                value="pbx">Private Branch Exchange</enum>
            <enum
                short-label="FW"
                value="firewall">Firewall</enum>
            <enum
                short-label="Rtr"
                value="router">Router</enum>
            <enum
                short-label="Swtch"
                value="switch">Switch</enum>
            <enum
                short-label="Store"
                value="storage-array">Storage Array</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="scan-type">
        <formal-name>Scan Type</formal-name>
        <description>Identifies the type of scan.</description>
        <binding
            pattern="component/prop[@name='scan-type'][@ns='https://fedramp.gov/ns/oscal']"/>
        <binding
            pattern="inventory-item/prop[@name='scan-type'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Inf./OS"
                value="infrastructure">Infrastructure and Operating System Scan</enum>
            <enum
                short-label="DB"
                value="database">Database Scan</enum>
            <enum
                short-label="Web"
                value="web">Web Scan</enum>
            <enum
                short-label="Other"
                value="other">Web Scan</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="transport-type">
        <formal-name>Transport Type</formal-name>
        <description>The internet protocol transport type.</description>
        <binding
            pattern="component[@component-type='service']/protocol/port-range/@transport"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="TCP"
                value="tcp">TCP</enum>
            <enum
                short-label="UDP"
                value="udp">UDP</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="virtual">
        <formal-name>Virtual</formal-name>
        <description>Indicates if the asset is virtual.</description>
        <binding
            pattern="inventory-item/prop[@name='virtual']"/>
        <binding
            pattern="component/prop[@name='virtual']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Y"
                value="yes">Yes</enum>
            <enum
                short-label="N"
                value="no">No</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="public">
        <formal-name>Public</formal-name>
        <description>Indicates if the asset is exposed to the public Internet.</description>
        <binding
            pattern="inventory-item/prop[@name='public']"/>
        <binding
            pattern="component/prop[@name='public']"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Y"
                value="yes">Yes</enum>
            <enum
                short-label="N"
                value="no">No</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="allows-authenticated-scan">
        <formal-name>Allows Authenticated Scan</formal-name>
        <description>Indicates if the asset is capable of having an authenticated scan.</description>
        <binding
            pattern="inventory-item/prop[@name='allows-authenticated-scan']/@value"/>
        <binding
            pattern="component/prop[@name='allows-authenticated-scan']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Y"
                value="yes">Yes</enum>
            <enum
                short-label="N"
                value="no">No</enum>
        </allowed-values>
        <remarks>if the value is "no", the prop remarks must contain the reason why.</remarks>
    </value-set>

    <value-set
        name="is-scanned">
        <formal-name>Is Scanned</formal-name>
        <description>Indicates if the asset is scan.</description>
        <binding
            pattern="inventory-item/prop[@name='is-scanned']/@value"/>
        <binding
            pattern="component/prop[@name='is-scanned']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Y"
                value="yes">Yes</enum>
            <enum
                short-label="N"
                value="no">No</enum>
        </allowed-values>
        <remarks>if the value is "no", the prop remarks must contain the reason why.</remarks>
    </value-set>

    <value-set
        name="control-implementation-status">
        <formal-name>Control Implementation Status</formal-name>
        <description>The implementation status of the control.</description>
        <binding
            pattern="implemented-requirement/prop[@name='implementation-status']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="Implemented"
                value="implemented">Implemented</enum>
            <enum
                short-label="Partial"
                value="partial">Partially Implemented</enum>
            <enum
                short-label="Planned"
                value="planned">Planned</enum>
            <enum
                short-label="Alternative"
                value="alternative">Alternative Implementation</enum>
            <enum
                short-label="N/A"
                value="not-applicable">Not Applicable</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="control-origination">
        <formal-name>Control Origination</formal-name>
        <description>The point(s) from which the control satisfaction originates.</description>
        <binding
            pattern="implemented-requirement/prop[@name='control-origination'][@ns='https://fedramp.gov/ns/oscal']/@value"/>
        <allowed-values
            allow-other="no">
            <enum
                short-label="SP Corporate"
                value="sp-corporate">Service Provider (Corporate)</enum>
            <enum
                short-label="SP System"
                value="sp-system">Service Provider (System Specific)</enum>
            <enum
                short-label="Cust. Configured"
                value="customer-configured">Configured by Customer</enum>
            <enum
                short-label="Cust. Provided"
                value="customer-provided">Provided by Customer</enum>
            <enum
                short-label="Inherited"
                value="inherited">Inherited</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="attachment-type">
        <formal-name>Attachment Type</formal-name>
        <description>Identifies the type of attachment.</description>
        <binding
            pattern="resource/prop[@name='type'][@ns='https://fedramp.gov/ns/oscal']"/>
        <allowed-values
            allow-other="yes">
            <enum
                short-label="Law"
                value="law">Law or Statute</enum>
            <enum
                short-label="Regulation"
                value="regulation">Regulation or Directive</enum>
            <enum
                short-label="Standard"
                value="standard">Industry Standard</enum>
            <enum
                short-label="Guidance"
                value="guidance">Guidance</enum>
            <enum
                short-label="Policy"
                value="policy">Policy</enum>
            <enum
                short-label="Procedure"
                value="procedure">Procedure</enum>
            <enum
                short-label="Guidance"
                value="guide">Guidance Document</enum>
            <enum
                short-label="ROB"
                value="rules-of-behavior">Rules of Behavior</enum>
            <enum
                short-label="Plan"
                value="plan">Plan</enum>
            <enum
                short-label="SSP"
                value="system-security-plan">System Security Plan</enum>
            <enum
                short-label="artifact"
                value="artifact">Artifact</enum>
            <enum
                short-label="evidence"
                value="evidence">Evidence</enum>
            <enum
                short-label="screen"
                value="screen-shot">Screen Shot</enum>
            <enum
                short-label="image"
                value="image">Image</enum>
            <enum
                short-label="Report"
                value="tool-report">Tool Report</enum>
            <enum
                short-label="Raw"
                value="raw-tool-output">Raw Tool Output</enum>
            <enum
                short-label="Notes"
                value="interview-notes">Interview Notes</enum>
            <enum
                short-label="Questions"
                value="questionnaire">Questions</enum>
            <enum
                short-label="Report"
                value="report">Report</enum>
            <enum
                short-label="FR Citations"
                value="fedramp-citations">FedRAMP Citations</enum>
            <enum
                short-label="FR Acronyms"
                value="fedramp-acronyms">FedRAMP Acronyms</enum>
            <enum
                short-label="FR Logo"
                value="fedramp-logo">FedRAMP Logo</enum>
            <enum
                short-label="SoD Matrix"
                value="separation-of-duties-matrix">Separation of Duties Matrix</enum>
            <enum
                short-label="Logo"
                value="logo">Logo</enum>
            <!-- See, e.g., https://www.dol.gov/general/ppii#:~:text=Personal%20Identifiable%20Information%20(PII)%20is,either%20direct%20or%20indirect%20means. -->
            <!-- All the privacy "types" need rationalization -->
            <enum
                short-label="PII"
                value="personally-identifiable-information">Personal Identifiable Information (PII)</enum>
            <enum
                short-label="Agreement"
                value="agreement">Agreement</enum>
            <enum
                short-label="Agreement"
                value="isa-agreement">Interconnection Security Agreement</enum>
            <enum
                short-label="IRP"
                value="incident-response-plan">Incident Response Plan</enum>
            <enum
                short-label="ISPP"
                value="information-security-policies-and-procedures">Incident Security Policies and Procedures</enum>
            <enum
                short-label="User Guide"
                value="users-guide">User Guide</enum>
            <enum
                short-label="PIA"
                value="privacy-impact-assessment">Privacy Impact Assessment</enum>
            <enum
                short-label="ISCP"
                value="information-system-contingency-plan">Information System Contingency Plan</enum>
            <enum
                short-label="CMP"
                value="configuration-management-plan">configuration-management-plan</enum>
        </allowed-values>
        <remarkas>Not all values apply to all FedRAMP artifacts.</remarkas>
    </value-set>

    <value-set
        name="hash-algorithm">
        <formal-name>Hash Algorithm</formal-name>
        <description>Identifies the algorithm used to create the hash value of the attachment.</description>
        <binding
            pattern="resource/hash/@algorithm"/>
        <allowed-values
            allow-other="yes">
            <enum
                short-label="SHA-224"
                value="SHA-224">SHA-224</enum>
            <enum
                short-label="SHA-256"
                value="SHA-256">SHA-256</enum>
            <enum
                short-label="SHA-384"
                value="SHA-384">SHA-384</enum>
            <enum
                short-label="SHA-512"
                value="SHA-512">SHA-512</enum>
            <enum
                short-label="RIPEMD-160"
                value="RIPEMD-160">RIPEMD-160</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="role-type">
        <formal-name>Defined Role Identifiers</formal-name>
        <description>Identifies the type of role for a responsible party.</description>
        <binding
            pattern="role/@id"/>
        <allowed-values
            allow-other="yes">
            <enum
                label="Assessor"
                value="assessor">Assessor</enum>
            <enum
                label="Assessment Team"
                value="assessment-team">Assessment Team</enum>
            <enum
                label="Assessment Lead"
                value="assessment-lead">Assessment Lead</enum>
            <enum
                label="Assessment Executive"
                value="assessment-executive">Assessment Executive</enum>
            <enum
                label="CSP"
                value="cloud-service-provider">Cloud Service Provider</enum>
            <enum
                label="CSP Operations Center"
                value="csp-operations-center">Cloud Service Provider Operations Center</enum>
            <enum
                label="CSP Assessment PoC"
                value="csp-assessment-poc">Cloud Service Provider Assessment Point(s) of Contact</enum>
            <enum
                label="CSP End of Testing PoC"
                value="csp-end-of-testing-poc">Cloud Service Provider End of Testing Point(s) of Contact</enum>
            <enum
                label="CSP Results PoC"
                value="csp-results-poc">Cloud Service Provider Point(s) of Contact</enum>
            <enum
                label="FedRAMP PMO"
                value="fedramp-pmo">FedRAMP Project Management Office (PMO)</enum>
            <enum
                label="FedRAMP JAB"
                value="fedramp-jab">FedRAMP Joint Authorization Board (JAB)</enum>
            <enum
                label="Penetration Test Team"
                value="penetration-test-team">Penetration Test Team</enum>
            <enum
                label="Penetration Test Lead"
                value="penetration-test-lead">Penetration Test Lead</enum>
        </allowed-values>
    </value-set>

    <value-set
        name="media-type">
        <formal-name>Resource Media Types</formal-name>
        <description>A subset of IANA media types expected to be encountered.</description>
        <binding
            pattern="rlink/@media-type"/>
        <binding
            pattern="base64/@media-type"/>
        <allowed-values>
            <enum
                value="application/gzip">application/gzip</enum>
            <enum
                value="application/msword">application/msword</enum>
            <enum
                value="application/octet-stream">application/octet-stream<!-- (NOTE: Used for a variety of binary formats, often ZIP archives.) --></enum>
            <enum
                value="application/pdf">application/pdf</enum>
            <enum
                value="application/vnd.ms-excel">application/vnd.ms-excel</enum>
            <enum
                value="application/vnd.ms-works">application/vnd.ms-works</enum>
            <enum
                value="application/vnd.oasis.opendocument.graphics">application/vnd.oasis.opendocument.graphics</enum>
            <enum
                value="application/vnd.oasis.opendocument.presentation">application/vnd.oasis.opendocument.presentation</enum>
            <enum
                value="application/vnd.oasis.opendocument.spreadsheet">application/vnd.oasis.opendocument.spreadsheet</enum>
            <enum
                value="application/vnd.oasis.opendocument.text">application/vnd.oasis.opendocument.text</enum>
            <enum
                value="application/vnd.openxmlformats-officedocument.presentationml.presentation">application/vnd.openxmlformats-officedocument.presentationml.presentation</enum>
            <enum
                value="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet">application/vnd.openxmlformats-officedocument.spreadsheetml.sheet</enum>
            <enum
                value="application/vnd.openxmlformats-officedocument.wordprocessingml.document">application/vnd.openxmlformats-officedocument.wordprocessingml.document</enum>
            <enum
                value="application/x-bzip">application/x-bzip</enum>
            <enum
                value="application/x-bzip2">application/x-bzip2</enum>
            <enum
                value="application/x-tar">application/x-tar</enum>
            <enum
                value="application/zip">application/zip</enum>
            <enum
                value="image/bmp">image/bmp</enum>
            <enum
                value="image/jpeg">image/jpeg<!-- (NOTE: Not standard, but very frequently used)--></enum>
            <enum
                value="image/png">image/png</enum>
            <enum
                value="image/tiff">image/tiff</enum>
            <enum
                value="image/webp">image/webp</enum>
            <enum
                value="image/svg+xml">image/svg+xml</enum>
            <enum
                value="text/csv">text/csv</enum>
            <enum
                value="text/html">text/html</enum>
            <enum
                value="text/plain">text/plain</enum>
            <enum
                value="application/xml">application/xml</enum>
            <enum
                value="text/xml">text/xml</enum>
            <enum
                value="application/json">application/json</enum>
            <enum
                value="application/yaml">application/yaml</enum>
        </allowed-values>
    </value-set>

</fedramp-values>