Skip to content

Commit

Permalink
Add system-characteristics 'has-network-architecture' constraints (#707)
Browse files Browse the repository at this point in the history
* Added   constraints & tests

* Corrected message
  • Loading branch information
Gabeblis authored and aj-stein-gsa committed Sep 24, 2024
1 parent 1f831f9 commit 4180e7d
Show file tree
Hide file tree
Showing 21 changed files with 225 additions and 0 deletions.
27 changes: 27 additions & 0 deletions features/fedramp_extensions.feature
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,24 @@ Examples:
| has-incident-response-plan-PASS.yaml |
| has-information-system-contingency-plan-FAIL.yaml |
| has-information-system-contingency-plan-PASS.yaml |
| has-network-architecture-FAIL.yaml |
| has-network-architecture-PASS.yaml |
| has-network-architecture-description-FAIL.yaml |
| has-network-architecture-description-PASS.yaml |
| has-network-architecture-diagram-FAIL.yaml |
| has-network-architecture-diagram-PASS.yaml |
| has-network-architecture-diagram-caption-FAIL.yaml |
| has-network-architecture-diagram-caption-PASS.yaml |
| has-network-architecture-diagram-description-FAIL.yaml |
| has-network-architecture-diagram-description-PASS.yaml |
| has-network-architecture-diagram-link-FAIL.yaml |
| has-network-architecture-diagram-link-PASS.yaml |
| has-network-architecture-diagram-link-rel-FAIL.yaml |
| has-network-architecture-diagram-link-rel-PASS.yaml |
| has-network-architecture-diagram-link-rel-allowed-value-FAIL.yaml |
| has-network-architecture-diagram-link-rel-allowed-value-PASS.yaml |
| has-network-architecture-diagram-uuid-FAIL.yaml |
| has-network-architecture-diagram-uuid-PASS.yaml |
| has-rules-of-behavior-FAIL.yaml |
| has-rules-of-behavior-PASS.yaml |
| has-separation-of-duties-matrix-FAIL.yaml |
Expand Down Expand Up @@ -122,6 +140,15 @@ Examples:
| has-identity-assurance-level |
| has-incident-response-plan |
| has-information-system-contingency-plan |
| has-network-architecture |
| has-network-architecture-description |
| has-network-architecture-diagram |
| has-network-architecture-diagram-caption |
| has-network-architecture-diagram-description |
| has-network-architecture-diagram-link |
| has-network-architecture-diagram-link-rel |
| has-network-architecture-diagram-link-rel-allowed-value |
| has-network-architecture-diagram-uuid |
| has-rules-of-behavior |
| has-separation-of-duties-matrix |
| has-user-guide |
Expand Down
12 changes: 12 additions & 0 deletions src/validations/constraints/content/ssp-all-VALID.xml
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,18 @@
<p>The authorization boundary includes all components within the main data center and the disaster recovery site.</p>
</description>
</authorization-boundary>
<network-architecture>
<description>
<p>A holistic, top-level explanation of the network architecture.</p>
</description>
<diagram uuid="e97c3395-433a-48c1-8cc7-dd1e1555941c">
<description>
<p>A diagram-specific explanation.</p>
</description>
<link href="#61081e81-850b-43c1-bf43-1ecbddcb9e7f" rel="diagram"/>
<caption>Network Diagram</caption>
</diagram>
</network-architecture>
</system-characteristics>

<system-implementation>
Expand Down
28 changes: 28 additions & 0 deletions src/validations/constraints/fedramp-external-constraints.xml
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,34 @@
<expect id="has-federation-assurance-level" target="./system-characteristics" test="prop[@name eq 'federation-assurance-level']" level="INFORMATIONAL">
<message>This FedRAMP SSP does define its NIST SP 800-63 federation assurance level (IAL).</message>
</expect>
<expect id="has-network-architecture" target="./system-characteristics" test="network-architecture" level="ERROR">
<message>A FedRAMP SSP must include a network architecture.</message>
</expect>
<expect id="has-network-architecture-diagram" target="./system-characteristics" test="network-architecture/diagram" level="WARNING">
<message>A FedRAMP SSP must have at least one network architecture diagram.</message>
</expect>
<expect id="has-network-architecture-diagram-uuid" target="./system-characteristics" test="network-architecture/diagram/@uuid" level="ERROR">
<message>Each FedRAMP SSP network architecture diagram must have a unique identifier.</message>
</expect>
<expect id="has-network-architecture-diagram-description" target="./system-characteristics" test="network-architecture/diagram/description" level="ERROR">
<message>Each FedRAMP SSP network architecture diagram must have a description.</message>
</expect>
<expect id="has-network-architecture-diagram-link" target="./system-characteristics" test="network-architecture/diagram/link" level="ERROR">
<message>Each FedRAMP SSP network architecture diagram must have a link.</message>
</expect>
<expect id="has-network-architecture-diagram-caption" target="./system-characteristics" test="network-architecture/diagram/caption" level="ERROR">
<message>Each FedRAMP SSP network architecture diagram must have a caption.</message>
</expect>
<expect id="has-network-architecture-diagram-link-rel" target="./system-characteristics" test="network-architecture/diagram/link/@rel" level="ERROR">
<message>Each FedRAMP SSP network architecture diagram must have a link rel attribute.</message>
</expect>
<expect id="has-network-architecture-diagram-link-rel-allowed-value" target="./system-characteristics" test="network-architecture/diagram/link/@rel eq 'diagram'" level="ERROR">
<message>Each FedRAMP SSP network architecture diagram must have a link rel attribute with the value "diagram".</message>
</expect>
<expect id="has-network-architecture-description" target="./system-characteristics" test="network-architecture/description" level="ERROR">
<message>A FedRAMP SSP must have a network architecture description.</message>
</expect>

</constraints>
</context>
<context>
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Negative Test for has-network-architecture
description: This test case validates the behavior of constraint has-network-architecture
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Positive Test for has-network-architecture
description: This test case validates the behavior of constraint has-network-architecture
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-description
description: >-
This test case validates the behavior of constraint
has-network-architecture-description
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-description
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-description
description: >-
This test case validates the behavior of constraint
has-network-architecture-description
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-description
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-diagram
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-diagram
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-diagram
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-diagram
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-diagram-caption
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-caption
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-caption
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-diagram-caption
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-caption
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-caption
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-diagram-description
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-description
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-description
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-diagram-description
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-description
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-description
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-diagram-link
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-link
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-link
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-diagram-link
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-link
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-link
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-diagram-link-rel
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-link-rel
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-link-rel
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-diagram-link-rel
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-link-rel
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-link-rel
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-diagram-link-rel-allowed-value
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-link-rel-allowed-value
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-link-rel-allowed-value
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-diagram-link-rel-allowed-value
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-link-rel-allowed-value
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-link-rel-allowed-value
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for has-network-architecture-diagram-uuid
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-uuid
content: ../content/ssp-all-INVALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-uuid
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for has-network-architecture-diagram-uuid
description: >-
This test case validates the behavior of constraint
has-network-architecture-diagram-uuid
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: has-network-architecture-diagram-uuid
result: pass

0 comments on commit 4180e7d

Please sign in to comment.