diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature
index ee7b6ff79..8affb7d1f 100644
--- a/features/fedramp_extensions.feature
+++ b/features/fedramp_extensions.feature
@@ -10,7 +10,7 @@ Scenario Outline: Documents that should be valid are pass
Then I should have valid results " Initial publication. Minor Replace sample CSP information. CSP information must be present and associated with the "cloud-service-provider" role
- via prop
updates.responsible-party
.responsible-party
.
+
This example points to the FedRAMP Rev 5 Moderate baseline that is part of the official FedRAMP 3.0.0 release.
@@ -574,7 +571,7 @@For now, this is a required field. In the future we intend to pull this information directly from FedRAMP's records based on the "leveraged-system-identifier" property's value.
For now, this is a required field. In the future we intend to pull this information directly from FedRAMP's records @@ -807,9 +804,17 @@
admin user
+The user assembly is being reviewed for continued applicability @@ -820,31 +825,57 @@
admin user
+admin user
+admin user
+If 'yes', describe the authentication method.
If 'no', explain why no authentication is used.
If 'not-applicable', attest explain why authentication is not applicable in the remarks.
This is a leveraged system within which this system operates. @@ -942,7 +973,7 @@
Links to the vendor website describing the system are encouraged, but not required.
- +A service within the scope of the leveraged system's authorization boundary is considered an "authorized service". Any other service offered by the @@ -961,12 +992,13 @@ a "poam-item" link that references a corrisponding entry in this system's POA&M. - +
Both authorized and non-authorized leveraged services include:
"#11111111-2222-4000-8000-009000100001"
)"#11111111-2222-4000-8000-009000100001"
)
+
Although SSP Table 7.1 also requires data categoriation and hosting
@@ -996,13 +1028,13 @@
This is a service offered by a leveraged system and used by this system.
@@ -1017,7 +1049,8 @@
leveraged-authorization entry
Where relevant, this component should also have: Describe the service and what it is used for. If 'yes', describe the authentication method. If 'no', explain why no authentication is used. If 'not-applicable', attest explain why authentication is not applicable in the remarks. This is a service offered by a leveraged system and used by this system.
@@ -1092,7 +1129,8 @@
POAM&M ID (legacy) in a Excel workbook or poam-item-uuid (preferred)
in an OSCAL-based POA&M.
"#11111111-2222-4000-8000-009000100001"
)"#11111111-2222-4000-8000-009000100001"
)
+
"#11111111-2222-4000-8000-009000100001"
)"#11111111-2222-4000-8000-009000100001"
)
+
@@ -1101,7 +1139,7 @@
tools are able to distinguish between authorized and non-authorized services
from the same leveraged provider.
Where relevant, this component should also have:
- An "inherited-uuid" property if the leveraged system's owner provides a UUID for their system (such as in an OSCAL-based CRM).
Link(s) to the vendor's web site describing the service are encouraged, but not
@@ -1138,20 +1176,20 @@
- An external system to which this system shares an interconnection. While not required, each "system" component should have: Unlike prior FedRAMP OSCAL publications, avoid the use of FedRAMP
properties/extensions for these roles, instead favor the core OSCAL
responsible-roles constructs, and the NIST-standard roles of
@@ -1202,50 +1240,50 @@
Describe the purpose of the external system/service; specifically, provide reasons
for connectivity (e.g., system monitoring, system alerting, download updates, etc.) If 'yes', describe the authentication method in the remarks. If 'no', explain why no authentication is used in the remarks. If 'not-applicable', attest explain why authentication is not applicable in the remarks. Describe the hosting of the interconnection itself (NOT the hosting of the remote system). Unlike prior FedRAMP OSCAL publications, avoid the use of FedRAMP
properties/extensions for these roles, instead favor the core OSCAL
responsible-roles constructs, and the NIST-standard roles of
@@ -1309,13 +1347,13 @@
For an external system, the "implementation-point" property must always be present
with a value of "external". Each interconnection must be defined with both an "system" component and an
"interconnection" component. Must include all leveraged services and features from the leveraged authorization
@@ -1354,17 +1392,18 @@
Describe the service and what it is used for. If 'yes', describe the authentication method in the remarks. If 'no', explain why no authentication is used in the remarks. If 'not-applicable', attest explain why authentication is not applicable in the remarks. This can only be known if provided by the leveraged system.
@@ -1374,20 +1413,21 @@
This is a service provided by an external system other than the leveraged system. As a result, the "leveraged-authorization-uuid" property is not applicable and must
@@ -1404,7 +1444,8 @@
- An "implementation-point" property with a value of "external". - A "provided-by" link with a URI fragment that points to the UUID of the above
"system" component. - Example: - Example: - IMPORTANT: Due to a known error in core OSCAL (versions <=1.1.2) constraints,
this property is blocked from proper use. - a status with a state value of "operational" A service provided by an external system other than the leveraged system. Describe the service and what it is used for. If 'yes', describe the authentication method in the remarks. If 'no', explain why no authentication is used in the remarks. If 'not-applicable', attest explain why authentication is not applicable in the remarks. Either describe a risk associated with this service, or indicate there is no identified risk. If there is no risk, please explain your basis for that conclusion. If there are one or more identified risks, describe any resulting impact. If there are one or more identified risks, describe any mitigating factors. This is a service provided by an external system other than the leveraged system. - A "risk" property/extension - using the remarks, either describe any risk or state there is no risk and provide a basis for that assertion. As a result, the "leveraged-authorization-uuid" property is not applicable and must
@@ -1490,10 +1539,10 @@
If the leveraged system owner provides a UUID for their service (such as in an
OSCAL-based CRM), it should be reflected in the If 'yes', describe the authentication method in the remarks. If 'no', explain why no authentication is used in the remarks. If 'not-applicable', attest explain why authentication is not applicable in the remarks. Either describe a risk associated with this CLI, or indicate there is no identified risk. If there is no risk, please explain your basis for that conclusion. If there are one or more identified risks, describe any resulting impact. If there are one or more identified risks, describe any mitigating factors.
+
"#11111111-2222-4000-8000-009000100001"
"#11111111-2222-4000-8000-009000100001"
+ inherited-uuid
property.
FUNCTION: Describe typical component function.
FUNCTION: Describe typical component function.
FUNCTION: Describe typical component function.
None
None
None
If no, explain why. If yes, omit remarks field.
@@ -2187,7 +2235,7 @@If no, explain why. If yes, omit remark.
Asset wasn't running at time of scan.
Asset wasn't running at time of scan.
FedRAMP does not require any specific information here.
Describe how Part a is satisfied within the system.
Legacy approach. If no policy component is defined, describe here how the @@ -2361,8 +2401,7 @@ component is associated with the component representing the system.
Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Identity @@ -2374,26 +2413,22 @@
There
Describe the plan to complete the implementation.
Describe how this policy currently satisfies part a.
Describe the plan for addressing the missing policy elements.
Describe how Part b-1 is satisfied.
Describe how Part b-2 is satisfied.
Describe the plan to complete the implementation.
Describe any customer-configured requirements for satisfying this control.
Describe how the control is satisfied within the system.
Describe how AC-2, part a is satisfied within this system.
This points to the "This System" component, and is used any time a more @@ -2480,8 +2510,7 @@ leveraging systems to satisfy AC-2, part a.
Leveraged system's statement of a leveraging system's responsibilities in satisfaction of AC-2, part a.
@@ -2494,8 +2523,7 @@For the portion of the control satisfied by the application component of this system, describe how the control is met.
@@ -2512,8 +2540,7 @@Leveraging system's responsibilities with respect to inheriting this capability from this application.
@@ -2532,17 +2559,15 @@This can also be used to provide a summary, such as a holistic overview of how multiple components work together.
While the "this system" component is not explicitly required within every
- statement
, it will typically be present.
statement
, it will typically be present.
For the portion inherited from an underlying FedRAMP-authorized provider, describe what is inherited.
Optional description.
Consumer-appropriate description of what may be inherited as provided by the @@ -2554,8 +2579,7 @@ CRM (Inheritance and Responsibility Model).
Description of how the responsibility was satisfied.
The responsibility-uuid
links this to the same statement in the
@@ -2563,8 +2587,8 @@
It may be linked directly, but is more commonly provided via an OSCAL-based CRM (Inheritance and Responsibility Model).
Tools should use this to ensure all identified customer
- responsibility
statements have a corresponding
- satisfied
statement in the leveraging system's SSP.
responsibility
statements have a corresponding
+ satisfied
statement in the leveraging system's SSP.
Tool developers should be mindful that
Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
Describe how Part a is satisfied.
Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -2617,8 +2638,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -2628,16 +2648,14 @@Describe how Part b-1 is satisfied.
Describe how Part b-2 is satisfied.
Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -2692,8 +2707,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -2703,42 +2717,39 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -2770,8 +2779,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -2781,40 +2789,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -2846,8 +2849,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -2857,38 +2859,35 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -2920,8 +2917,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -2931,40 +2927,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -2996,8 +2987,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3007,40 +2997,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3072,8 +3057,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3083,40 +3067,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3148,8 +3127,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3159,40 +3137,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3224,8 +3197,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3235,40 +3207,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3300,8 +3267,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3311,40 +3277,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3376,8 +3337,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3387,40 +3347,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3452,8 +3407,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3463,40 +3417,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3528,8 +3477,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3539,40 +3487,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3604,8 +3547,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3615,40 +3557,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3680,8 +3617,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3691,40 +3627,37 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3756,8 +3687,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3767,35 +3697,32 @@For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how the control is satisfied within the system.
DMARC is employed.
@@ -3815,21 +3742,20 @@Describe the plan to complete the implementation.
Describe how the control is satisfied within the system.
For the portion of the control satisfied by the service provider, describe - how the control is met.
+ how the control is met.Describe how this policy component satisfies part a.
Component approach. This links to a component representing the Policy.
@@ -3861,8 +3785,7 @@ here too.Describe how this procedure component satisfies part a.
Component approach. This links to a component representing the procedure.
@@ -3902,8 +3825,7 @@Must be present in a FedRAMP SSP.
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Policy Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: User's Guide Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Rules of Behavior (ROB)
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Contingency Plan (CP) Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Configuration Management (CM) Plan Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Incident Response (IR) Plan Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Continuous Monitoring Plan Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
Table 12-1 Attachments: Procedure Attachment
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
FedRAMP Logo
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
FedRAMP prefers base64
for images and diagrams.
Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.
@@ -4735,7 +4701,8 @@May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
FedRAMP prefers base64
for images and diagrams.
Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.
@@ -4756,7 +4723,8 @@ system-characteristics/authorization-boundary/diagram/link/@href flag using a value of "#11111111-2222-4000-8000-001000000054"May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
FedRAMP prefers base64
for images and diagrams.
Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.
@@ -4777,7 +4745,8 @@ system-characteristics/network-architecture/diagram/link/@href flag using a value of "#11111111-2222-4000-8000-001000000055"May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
FedRAMP prefers base64
for images and diagrams.
Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.
@@ -4796,7 +4765,8 @@This should be referenced in the system-characteristics/data-flow/diagram/link/@href flag using a value of "#11111111-2222-4000-8000-001000000056"
May use rlink
with a relative path, or embedded as
- base64
.
base64
.
+
FedRAMP prefers base64
for images and diagrams.
Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.
@@ -4813,7 +4783,8 @@Federal Acquisition Supply Chain Security Act; Rule,85 Federal Register 54263 (September 1, 2020), pp 54263-54271.
Federal Acquisition Supply Chain Security Act; Rule,85 Federal Register 54263 (September 1, 2020), pp 54263-54271.
CSP-specific reference. Note the "type" property's class is "reference" + and the value is "citation".
+Separation of Duties Matrix
+May use rlink
with a relative path, or embedded as base64
.
+