diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature index 62190e486..5a3d5ede9 100644 --- a/features/fedramp_extensions.feature +++ b/features/fedramp_extensions.feature @@ -48,6 +48,7 @@ Examples: | deployment-model | | external-system-nature-of-agreement | | extraneous-implemented-requirements | + | fedramp-citations-has-correct-link | | fedramp-version | | fully-operational-date-is-valid | | fully-operational-date-type | @@ -75,6 +76,7 @@ Examples: | has-data-flow-diagram-link-rel-allowed-value | | has-data-flow-diagram-uuid | | has-federation-assurance-level | + | has-fedramp-citations | | has-fully-operational-date | | has-identity-assurance-level | | has-incident-response-plan | @@ -212,6 +214,8 @@ Examples: | external-system-nature-of-agreement-PASS.yaml | | extraneous-implemented-requirements-FAIL.yaml | | extraneous-implemented-requirements-PASS.yaml | + | fedramp-citations-has-correct-link-FAIL.yaml | + | fedramp-citations-has-correct-link-PASS.yaml | | fedramp-version-FAIL.yaml | | fedramp-version-PASS.yaml | | fully-operational-date-is-valid-FAIL.yaml | @@ -266,6 +270,8 @@ Examples: | has-data-flow-diagram-uuid-PASS.yaml | | has-federation-assurance-level-FAIL.yaml | | has-federation-assurance-level-PASS.yaml | + | has-fedramp-citations-FAIL.yaml | + | has-fedramp-citations-PASS.yaml | | has-fully-operational-date-FAIL.yaml | | has-fully-operational-date-PASS.yaml | | has-identity-assurance-level-FAIL.yaml | diff --git a/features/steps/fedramp_extensions_steps.ts b/features/steps/fedramp_extensions_steps.ts index 04524393b..fbe1ef7d8 100644 --- a/features/steps/fedramp_extensions_steps.ts +++ b/features/steps/fedramp_extensions_steps.ts @@ -421,7 +421,7 @@ async function checkConstraints( `The content may need adjustment to properly test this constraint.` ); } - !quiet && console.error(formatSarifOutput(sarifOutput)) + !quiet && console.error(formatSarifOutput({version:"2.1.0",runs:[{tool:{driver:{name:"oscal-js"}},results:constraintResults}]})) errors.push(""); // Add a blank line for readability } } diff --git a/src/validations/constraints/content/ssp-fedramp-citations-has-correct-link-INVALID.xml b/src/validations/constraints/content/ssp-fedramp-citations-has-correct-link-INVALID.xml new file mode 100644 index 000000000..faf9e2fa7 --- /dev/null +++ b/src/validations/constraints/content/ssp-fedramp-citations-has-correct-link-INVALID.xml @@ -0,0 +1,13 @@ + + + + + FedRAMP Applicable Laws and Regulations + + + +

Must be present in a FedRAMP SSP.

+
+
+
+
\ No newline at end of file diff --git a/src/validations/constraints/content/ssp-has-fedramp-citations-INVALID.xml b/src/validations/constraints/content/ssp-has-fedramp-citations-INVALID.xml new file mode 100644 index 000000000..d78295bb1 --- /dev/null +++ b/src/validations/constraints/content/ssp-has-fedramp-citations-INVALID.xml @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index 02b4b395f..db02b599b 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -127,11 +127,21 @@ + + FedRAMP Citations Has Correct Link + + The FedRAMP Laws, Regulations, Standards and Guidance MUST be https://www.fedramp.gov/assets/resources/templates/FedRAMP-Laws-Regulations-Standards-and-Guidance-Reference.xlsx + Has Configuration Management Plan A FedRAMP SSP MUST have a Configuration Management Plan attached. + + Has FedRAMP Citations Reference + + A FedRAMP MUST be have exactly one resource with a link to the FedRAMP Laws, Regulations, Standards and Guidance, but {count(resource[prop[@name='type' and @value='citation' and @class='fedramp-citations']])} found. + Has Incident Response Plan diff --git a/src/validations/constraints/unit-tests/fedramp-citations-has-correct-link-FAIL.yaml b/src/validations/constraints/unit-tests/fedramp-citations-has-correct-link-FAIL.yaml new file mode 100644 index 000000000..42fa89f94 --- /dev/null +++ b/src/validations/constraints/unit-tests/fedramp-citations-has-correct-link-FAIL.yaml @@ -0,0 +1,9 @@ +test-case: + name: Negative Test for fedramp-citations-has-correct-link + description: >- + This test case validates the behavior of constraint + fedramp-citations-has-correct-link + content: ../content/ssp-fedramp-citations-has-correct-link-INVALID.xml + expectations: + - constraint-id: fedramp-citations-has-correct-link + result: fail diff --git a/src/validations/constraints/unit-tests/fedramp-citations-has-correct-link-PASS.yaml b/src/validations/constraints/unit-tests/fedramp-citations-has-correct-link-PASS.yaml new file mode 100644 index 000000000..a1b422e93 --- /dev/null +++ b/src/validations/constraints/unit-tests/fedramp-citations-has-correct-link-PASS.yaml @@ -0,0 +1,9 @@ +test-case: + name: Positive Test for fedramp-citations-has-correct-link + description: >- + This test case validates the behavior of constraint + fedramp-citations-has-correct-link + content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml + expectations: + - constraint-id: fedramp-citations-has-correct-link + result: pass diff --git a/src/validations/constraints/unit-tests/has-fedramp-citations-FAIL.yaml b/src/validations/constraints/unit-tests/has-fedramp-citations-FAIL.yaml new file mode 100644 index 000000000..f37ea97ec --- /dev/null +++ b/src/validations/constraints/unit-tests/has-fedramp-citations-FAIL.yaml @@ -0,0 +1,7 @@ +test-case: + name: Negative Test for has-fedramp-citations + description: This test case validates the behavior of constraint has-fedramp-citations + content: ../content/ssp-has-fedramp-citations-INVALID.xml + expectations: + - constraint-id: has-fedramp-citations + result: fail diff --git a/src/validations/constraints/unit-tests/has-fedramp-citations-PASS.yaml b/src/validations/constraints/unit-tests/has-fedramp-citations-PASS.yaml new file mode 100644 index 000000000..a4f3a44ae --- /dev/null +++ b/src/validations/constraints/unit-tests/has-fedramp-citations-PASS.yaml @@ -0,0 +1,7 @@ +test-case: + name: Positive Test for has-fedramp-citations + description: This test case validates the behavior of constraint has-fedramp-citations + content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml + expectations: + - constraint-id: has-fedramp-citations + result: pass