Create style guide for FedRAMP OSCAL Constraints (#760)

* Remove FedRAMP namespace from 'data-center' props (#795) * Hotfix/info (#780) * fix informational constraint handling and make ssp-all valid correct * revert external constraint changes * Update fedramp-external-constraints.xml * Update fedramp_extensions_steps.ts * update info handling * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update src/validations/constraints/fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update src/validations/constraints/fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update dev-constraint.js --------- Co-authored-by: Gabeblis <[email protected]> * [skip ci] Create style guide doc for #675 * [skip ci] FSCR-1 re external constraints for #675 * [skip ci] FCSR-1, woops, need formal name for #675 * [skip ci] Tweak FCSR-1 anchor ID in #675 * [skip ci] Stop header hacks for IDs in #675 I read more about these techniques than I would like, but none of them appear to work effectively for making anchors like `#fcsr-1` without adding other content to the anchor which I would like to avoid. https://gist.github.com/asabaylus/3071099?permalink_comment_id=3895584 Either it never worked or something changed. Oh well! * [skip ci] Add FCSR-2 on context sorting for #675 * [skip ci] Add FCSR-3 about alpha sorting for #675 * [skip ci] Add FCSR-4 to require help-url for #675 * [skip ci] Adjust title from style guide to dev style guide per Rene's review * [skip ci] Adjust grammar and style per Rene's review Co-authored-by: Rene Tshiteya <[email protected]> * [skip ci] @Rene2mt's feedback: add ID req for #675 * [skip ci] @Rene2mt's feedback: level req for #675 * [skip ci] @Rene2mt's review: why CRITICAL for #675 * [skip ci] Woops, missed IDs for reqs for #675 * [skip ci] Feedback: add message req for #675 * [skip ci] Fix constraint path in examples for #675 * [skip ci] Add remarks rec guidance for #675 * [skip ci] Add @wandmagic's rec for FCSR-1 for #675 * [skip ci] Add FCSR-10 re active voice for #675 * [skip ci] Remove FCSR-10's incorrect only for #675 * [skip ci] Add FCSR-11 about BCP14 words for #675 * [skip ci] Add no-jargon req FCSR-12 for #675 * [skip ci] Item, not sequence style req for #675 * [skip ci] Add req for sequence ctx hints for #675 * [skip ci] Add FCSR-15 re formal-names for #675 * [skip ci] Remove anchor hack from FCSR-1 for #675 * [skip ci] Wrap up kebab case IDs, reorder for #675 * [skip ci] Fixes from @Rene2mt'2 review for #675 * [skip ci] Add labels for rules in #675 * [skip ci] Simplify rule titles for #675 Follow feedback from @brian-ruf in his review. * [skip ci] Finalize table index with reqs for #645 * [skip ci] Limit informational constraints for #675 * [skip ci] Feedback: FRR1 about OSCAL constraints, not Metaschema constraints Co-authored-by: David Waltermire <[email protected]> * [skip ci] Update FRR1 in table listing too Co-authored-by: David Waltermire <[email protected]> * [skip ci] Add space in status row of table for FRR2 Co-authored-by: David Waltermire <[email protected]> * [skip ci] Add missing word to FRR3 title Co-authored-by: David Waltermire <[email protected]> * [skip ci] Improve the prose in FRR2 guidance Co-authored-by: David Waltermire <[email protected]> * [skip ci] Reorder statements in sentence of FRR2 guidance Co-authored-by: David Waltermire <[email protected]> * [skip ci] Clarify ambiguous wording in FRR5 Co-authored-by: David Waltermire <[email protected]> * [skip ci] Correct typos in FRR6 formal name Co-authored-by: David Waltermire <[email protected]> * [skip ci] Make FRR7 formal name more explicit Co-authored-by: David Waltermire <[email protected]> * [skip ci] Improve FRR8 formal name Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR8 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR9 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR9 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FRR9 guidance to specify expect constraints Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FRR9 constraint examples for correct type Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FRR10 formal name to be more clear Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR10 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Make FRR11 formal name better sentence fragment Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR11 above requirement text Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FedRAMP reqs prefix FCSR->FRR Given related work in the program, I want to generalize the prefix to be more general and global for all form of FedRAMP requirements down the road. * [skip ci] Add missing examples to FRR17 for #675 * [skip ci] Align formal names, spacing for #675 I had to fix up some of the formal names where Dave covered some of them in many places, but not all. Also other suggestions add some space. * [skip ci] Add level to many examples, finish #675 * [skip ci] Fold longer bg info for reqs in #675 * [skip ci] Clarify FRR1 bad example is bad in #645 * [skip ci] Clarify context order examples for #675 * [skip ci] Clarify case sorting for FRR3 in #675 * [skip ci] Clean up explanation of FRR10 for #675 * [skip ci] Fix typos in FRR13 and FRR15 for #675 * [skip ci] FRR2 feedback from Kylie for #675 * [skip ci] Reword FRR9 with Kylie's feedback in #675 * [skip ci] Woops, FRR16 twice, no FRR17 for #675 * [skip ci] Last call and let reqs in FRR18 for #675 * [skip ci] Correct ID for FRR18 to anchor in table Co-authored-by: Gabeblis <[email protected]> * [skip ci] Offset req ID sequence Per discussion with others on a call with leads and staff from both FR branches, begin with an offset sequences and reserve the first 100 for other uses for the time being. /cc @kscarf1 * [skip ci] BCP14 keywords in #675 summary text * [skip ci] Tighten up summary text more for #675 * [skip ci] Add back to top anchors for #675 * [skip ci] Better grammar and flow for #675 summary * [skip ci] Improve FRR102 guidance text for #675 * [skip ci] Capitalize and fix FRR110 title for #675 * [skip ci] Fix poor grammar in FRR117 text for #675 * [skip ci] Explicit docs URL in FRR104 for #675 Address missing feedback to @kyhu65867 from review that had not been previously addressed by yours truly. * [skip ci] Fix FRR105 with feedback for #675 Address some feedback about wording and style of the unique ID req. * [skip ci] Fix FRR103 spacing for #675 Completely address feedback from @david-waltermire after checking for final review of style guide left in the comment below. #760 (comment) * [skip ci] Fix FRR108 conformant example for #675 --------- Co-authored-by: Rene Tshiteya <[email protected]> Co-authored-by: wandmagic <[email protected]> Co-authored-by: Gabeblis <[email protected]> Co-authored-by: David Waltermire <[email protected]>
GSA · Oct 23, 2024 · 1b69dca · 1b69dca
1 parent 13e07fd
commit 1b69dca
Show file tree

Hide file tree

Showing 14 changed files with 1,282 additions and 18 deletions.
diff --git a/features/steps/fedramp_extensions_steps.ts b/features/steps/fedramp_extensions_steps.ts
@@ -314,7 +314,7 @@ async function checkConstraints(
       }
 
       const kinds = constraintResults.map((c) => {
-        if(c.level==='warning'||c.kind==='informational'){
+        if(c.level==='warning'){
           return 'fail'
         }else{
           return c.kind

diff --git a/src/scripts/dev-constraint.js b/src/scripts/dev-constraint.js
@@ -118,7 +118,7 @@ function analyzeTestFiles() {
                 if (result === 'pass' || file.toUpperCase().includes('PASS')) {
                     testResults[constraintId].pass = file;
                     testResults[constraintId].pass_file = filePath.split("/").pop();                
-                } else if (result === 'fail' ||result ==='informational'|| file.toUpperCase().includes('FAIL')) {
+                } else if (result === 'fail' || file.toUpperCase().includes('FAIL')) {
                     testResults[constraintId].fail = file;
                     testResults[constraintId].fail_file = filePath.split("/").pop();                
                 }
@@ -346,7 +346,6 @@ function getScenarioLineNumbers(featureFile, constraintId,tests) {
     const content = fs.readFileSync(featureFile, 'utf8');
     const lines = content.split('\n');
     const scenarioLines = [];
-    console.log(featureFile,tests,constraintId);
     for (let i = 0; i < lines.length; i++) {
         if (lines[i].includes(`${tests.fail}`) || lines[i].includes(`${tests.pass}`)||lines[i].includes(`${tests.fail_file}`) || lines[i].includes(`${tests.pass_file}`)) {
             scenarioLines.push(i + 1); // +1 because line numbers start at 1, not 0

diff --git a/src/validations/constraints/STYLE.md b/src/validations/constraints/STYLE.md
diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml
@@ -37,13 +37,13 @@
       <address >
         <country>US</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='primary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='primary'/>
     </location>
     <location uuid="11111112-0000-4000-9000-000000000003">
       <address >
         <country>US</country>
       </address>
-      <prop name='data-center' value='aws-us-west-1' class='alternate' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='aws-us-west-1' class='alternate'/>
     </location>
     <party uuid="11111111-0000-4000-9000-000000000001" type="organization">
       <name>Example Organization</name>
@@ -336,5 +336,54 @@
      <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p>
   </remarks>
 </resource>
+
+
+<resource uuid="d2eb3c18-6754-4e3a-a933-03d289e3fad5">
+  <title>Authorization Boundary</title>
+  <description>
+     <p>Authorization Boundary Diagram</p>
+  </description>
+  <prop ns="https://fedramp.gov/ns/oscal" name="type" value="plan"/>
+  <prop name="published" value="2023-01-01T00:00:00Z"/>
+  <prop name="version" value="Document Version"/>
+  <rlink href="./documents/AuthBoundary.docx" media-type="application/msword"/>
+  <base64 filename="AuthBoundary.docx" media-type="application/msword">00000000</base64>
+  <remarks>
+     <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p>
+  </remarks>
+</resource>
+
+<resource uuid="61081e81-850b-43c1-bf43-1ecbddcb9e7f">
+  <title>Network Architecture</title>
+  <description>
+     <p>Network Architecture Diagram</p>
+  </description>
+  <prop ns="https://fedramp.gov/ns/oscal" name="type" value="plan"/>
+  <prop name="published" value="2023-01-01T00:00:00Z"/>
+  <prop name="version" value="Document Version"/>
+  <rlink href="./documents/NetworkArchitecture.docx" media-type="application/msword"/>
+  <base64 filename="NetworkArchitecture.docx" media-type="application/msword">00000000</base64>
+  <remarks>
+     <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p>
+  </remarks>
+</resource>
+
+<resource uuid="ac5d7535-f3b8-45d3-bf3b-735c82c64547">
+  <title>Data Flow</title>
+  <description>
+     <p>Data flow Diagram</p>
+  </description>
+  <prop ns="https://fedramp.gov/ns/oscal" name="type" value="plan"/>
+  <prop name="published" value="2023-01-01T00:00:00Z"/>
+  <prop name="version" value="Document Version"/>
+  <rlink href="./documents/Dataflo.docx" media-type="application/msword"/>
+  <base64 filename="Dataflow.docx" media-type="application/msword">00000000</base64>
+  <remarks>
+     <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p>
+  </remarks>
+</resource>
+
+
+
   </back-matter>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-US-INVALID.xml b/src/validations/constraints/content/ssp-data-center-US-INVALID.xml
@@ -8,7 +8,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-alternate-INVALID.xml b/src/validations/constraints/content/ssp-data-center-alternate-INVALID.xml
@@ -8,7 +8,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-count-INVALID.xml b/src/validations/constraints/content/ssp-data-center-count-INVALID.xml
@@ -8,7 +8,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-country-code-INVALID.xml b/src/validations/constraints/content/ssp-data-center-country-code-INVALID.xml
@@ -7,7 +7,7 @@
     <location uuid="11111112-0000-4000-9001-000000000009">
       <address >
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-primary-INVALID.xml b/src/validations/constraints/content/ssp-data-center-primary-INVALID.xml
@@ -8,7 +8,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-role-defined-authorizing-official-poc-INVALID.xml b/src/validations/constraints/content/ssp-role-defined-authorizing-official-poc-INVALID.xml
@@ -27,7 +27,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
     <party uuid="11111111-0000-4000-9000-000000000001" type="organization">
       <name>Example Organization</name>

diff --git a/...ions/constraints/content/ssp-role-defined-information-system-security-officer-INVALID.xml b/...ions/constraints/content/ssp-role-defined-information-system-security-officer-INVALID.xml
@@ -27,7 +27,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
     <party uuid="11111111-0000-4000-9000-000000000001" type="organization">
       <name>Example Organization</name>

diff --git a/src/validations/constraints/content/ssp-role-defined-system-owner-INVALID.xml b/src/validations/constraints/content/ssp-role-defined-system-owner-INVALID.xml
@@ -27,7 +27,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
     <party uuid="11111111-0000-4000-9000-000000000001" type="organization">
       <name>Example Organization</name>

diff --git a/src/validations/constraints/fedramp-external-allowed-values.xml b/src/validations/constraints/fedramp-external-allowed-values.xml
@@ -375,11 +375,9 @@
     </context>
 
     <context>
-        <metapath target="/system-security-plan/system-characteristics/security-sensitivity-level"/>
-        <metapath target="/system-security-plan/system-characteristics/security-impact-level/(security-objective-confidentiality|security-objective-integrity|security-objective-availability)"/>
-        <metapath target="/system-security-plan/system-characteristics/system-information/information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)"/> 
+        <metapath target="/system-security-plan/system-characteristics"/>
         <constraints>
-            <allowed-values id="security-level" target="." allow-other="no" level="ERROR">
+            <allowed-values id="security-level" target="system-information/information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)|security-impact-level/(security-objective-confidentiality|security-objective-integrity|security-objective-availability)|security-sensitivity-level" allow-other="no" level="ERROR">
                 <formal-name>Security Impact Level</formal-name>
                 <description>The security objective level as defined by <a href="https://doi.org/10.6028/NIST.SP.800-60v1r1">NIST SP 800-60</a>.</description>
                 <enum value="fips-199-low">Low</enum>

diff --git a/src/web/package-lock.json b/src/web/package-lock.json