Add system-characteristics 'has-authorization-boundary' constraints (#…

…702) * Added system-characteristics 'has-authorization-boundary' constraints & tests * Style corrections * Rephrase * Fix IAL-FAL acronym typo and wrap up review. --------- Co-authored-by: A.J. Stein <[email protected]>
GSA · Sep 24, 2024 · 6f5f4f9 · 6f5f4f9
1 parent 4180e7d
commit 6f5f4f9
Show file tree

Hide file tree

Showing 17 changed files with 180 additions and 5 deletions.
diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature
@@ -45,6 +45,20 @@ Examples:
   | deployment-mode-PASS.yaml |
   | has-authenticator-assurance-level-FAIL.yaml |
   | has-authenticator-assurance-level-PASS.yaml |
+  | has-authorization-boundary-diagram-FAIL.yaml |
+  | has-authorization-boundary-diagram-PASS.yaml |
+  | has-authorization-boundary-diagram-caption-FAIL.yaml |
+  | has-authorization-boundary-diagram-caption-PASS.yaml |
+  | has-authorization-boundary-diagram-description-FAIL.yaml |
+  | has-authorization-boundary-diagram-description-PASS.yaml |
+  | has-authorization-boundary-diagram-link-FAIL.yaml |
+  | has-authorization-boundary-diagram-link-PASS.yaml |
+  | has-authorization-boundary-diagram-link-rel-FAIL.yaml |
+  | has-authorization-boundary-diagram-link-rel-PASS.yaml |
+  | has-authorization-boundary-diagram-link-rel-allowed-value-FAIL.yaml |
+  | has-authorization-boundary-diagram-link-rel-allowed-value-PASS.yaml |
+  | has-authorization-boundary-diagram-uuid-FAIL.yaml |
+  | has-authorization-boundary-diagram-uuid-PASS.yaml |
   | has-configuration-management-plan-FAIL.yaml |
   | has-configuration-management-plan-PASS.yaml |
   | has-federation-assurance-level-FAIL.yaml |
@@ -135,6 +149,13 @@ Examples:
   | data-center-primary |
   | deployment-model |
   | has-authenticator-assurance-level |
+  | has-authorization-boundary-diagram |
+  | has-authorization-boundary-diagram-caption |
+  | has-authorization-boundary-diagram-description |
+  | has-authorization-boundary-diagram-link |
+  | has-authorization-boundary-diagram-link-rel |
+  | has-authorization-boundary-diagram-link-rel-allowed-value |
+  | has-authorization-boundary-diagram-uuid |
   | has-configuration-management-plan |
   | has-federation-assurance-level |
   | has-identity-assurance-level |

diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml
@@ -112,6 +112,13 @@
       <description>
         <p>The authorization boundary includes all components within the main data center and the disaster recovery site.</p>
       </description>
+      <diagram uuid="dbf46c27-52a9-49c4-beb6-b6399cd75497">
+            <description>
+               <p>A diagram-specific explanation.</p>
+            </description>
+            <link href="#d2eb3c18-6754-4e3a-a933-03d289e3fad5" rel="diagram"/>
+            <caption>Authorization Boundary Diagram</caption>
+         </diagram>
     </authorization-boundary>
     <network-architecture>
          <description>

diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml
@@ -57,19 +57,40 @@
                 <message>A FedRAMP SSP must have a Separation of Duties Matrix attached.</message>
             </expect>
             <expect id="categorization-has-correct-system-attribute" target="./system-characteristics" test="system-information/information-type/categorization/@system eq 'https://doi.org/10.6028/NIST.SP.800-60v2r1'" level="ERROR">
-            <message>A FedRAMP SSP information-type categorization requires a correct system attribute. FedRAMP only supports the system value 'https://doi.org/10.6028/NIST.SP.800-60v2r1'.</message>
+                <message>A FedRAMP SSP information-type categorization requires a correct system attribute. FedRAMP only supports the system value 'https://doi.org/10.6028/NIST.SP.800-60v2r1'.</message>
             </expect>
             <expect id="categorization-has-information-type-id" target="./system-characteristics" test="system-information/information-type/categorization/information-type-id" level="ERROR">
-            <message>A FedRAMP SSP information type categorization must have at least one information type identifier.</message>
+                <message>A FedRAMP SSP information type categorization must have at least one information type identifier.</message>
             </expect>
             <expect id="has-identity-assurance-level" target="./system-characteristics" test="prop[@name eq 'identity-assurance-level']" level="INFORMATIONAL">
-            <message>This FedRAMP SSP does define its NIST SP 800-63 identity assurance level (IAL).</message>
+                <message>This FedRAMP SSP does define its NIST SP 800-63 identity assurance level (IAL).</message>
             </expect>
             <expect id="has-authenticator-assurance-level" target="./system-characteristics" test="prop[@name eq 'authenticator-assurance-level']" level="INFORMATIONAL">
-            <message>This FedRAMP SSP does define its NIST SP 800-63 authenticator assurance level (AAL).</message>
+                <message>This FedRAMP SSP does define its NIST SP 800-63 authenticator assurance level (AAL).</message>
             </expect>
             <expect id="has-federation-assurance-level" target="./system-characteristics" test="prop[@name eq 'federation-assurance-level']" level="INFORMATIONAL">
-            <message>This FedRAMP SSP does define its NIST SP 800-63 federation assurance level (IAL).</message>
+                <message>This FedRAMP SSP does define its NIST SP 800-63 federation assurance level (FAL).</message>
+            </expect>
+            <expect id="has-authorization-boundary-diagram" target="./system-characteristics/authorization-boundary" test="diagram" level="WARNING">
+                <message>A FedRAMP SSP must have at least one authorization boundary diagram.</message>
+            </expect>
+            <expect id="has-authorization-boundary-diagram-uuid" target="./system-characteristics/authorization-boundary" test="diagram/@uuid" level="ERROR">
+                <message>Each authorization boundary diagram in a FedRAMP SSP must have a unique identifier.</message>
+            </expect>
+            <expect id="has-authorization-boundary-diagram-description" target="./system-characteristics/authorization-boundary" test="diagram/description" level="ERROR">
+                <message>A FedRAMP SSP document authorization boundary diagram must have a description.</message>
+            </expect>
+            <expect id="has-authorization-boundary-diagram-link" target="./system-characteristics/authorization-boundary" test="diagram/link" level="ERROR">
+                <message>Each FedRAMP SSP authorization boundary diagram must have a link.</message>
+            </expect>
+            <expect id="has-authorization-boundary-diagram-link-rel" target="./system-characteristics/authorization-boundary" test="diagram/link/@rel" level="ERROR">
+                <message>Each FedRAMP SSP authorization boundary diagram must have a link rel attribute.</message>
+            </expect>
+            <expect id="has-authorization-boundary-diagram-link-rel-allowed-value" target="./system-characteristics/authorization-boundary" test="diagram/link/@rel eq 'diagram'" level="ERROR">
+                <message>Each FedRAMP SSP authorization boundary diagram must have a link rel attribute with the value "diagram".</message>
+            </expect>
+            <expect id="has-authorization-boundary-diagram-caption" target="./system-characteristics/authorization-boundary" test="diagram/caption" level="ERROR">
+                <message>Each FedRAMP SSP authorization boundary diagram must have a caption.</message>
             </expect>
             <expect id="has-network-architecture" target="./system-characteristics" test="network-architecture" level="ERROR">
                 <message>A FedRAMP SSP must include a network architecture.</message>

diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-FAIL.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for has-authorization-boundary-diagram
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram
+  content: ../content/ssp-all-INVALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram
+      result: fail
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-PASS.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for has-authorization-boundary-diagram
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram
+      result: pass
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-caption-FAIL.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-caption-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for has-authorization-boundary-diagram-caption
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-caption
+  content: ../content/ssp-all-INVALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-caption
+      result: fail
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-caption-PASS.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-caption-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for has-authorization-boundary-diagram-caption
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-caption
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-caption
+      result: pass
diff --git a/...lidations/constraints/unit-tests/has-authorization-boundary-diagram-description-FAIL.yaml b/...lidations/constraints/unit-tests/has-authorization-boundary-diagram-description-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for has-authorization-boundary-diagram-description
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-description
+  content: ../content/ssp-all-INVALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-description
+      result: fail
diff --git a/...lidations/constraints/unit-tests/has-authorization-boundary-diagram-description-PASS.yaml b/...lidations/constraints/unit-tests/has-authorization-boundary-diagram-description-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for has-authorization-boundary-diagram-description
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-description
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-description
+      result: pass
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-FAIL.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for has-authorization-boundary-diagram-link
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-link
+  content: ../content/ssp-all-INVALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-link
+      result: fail
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-PASS.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for has-authorization-boundary-diagram-link
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-link
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-link
+      result: pass
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-rel-FAIL.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-rel-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for has-authorization-boundary-diagram-link-rel
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-link-rel
+  content: ../content/ssp-all-INVALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-link-rel
+      result: fail
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-rel-PASS.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-link-rel-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for has-authorization-boundary-diagram-link-rel
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-link-rel
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-link-rel
+      result: pass
diff --git a/...onstraints/unit-tests/has-authorization-boundary-diagram-link-rel-allowed-value-FAIL.yaml b/...onstraints/unit-tests/has-authorization-boundary-diagram-link-rel-allowed-value-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for has-authorization-boundary-diagram-link-rel-allowed-value
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-link-rel-allowed-value
+  content: ../content/ssp-all-INVALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-link-rel-allowed-value
+      result: fail
diff --git a/...onstraints/unit-tests/has-authorization-boundary-diagram-link-rel-allowed-value-PASS.yaml b/...onstraints/unit-tests/has-authorization-boundary-diagram-link-rel-allowed-value-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for has-authorization-boundary-diagram-link-rel-allowed-value
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-link-rel-allowed-value
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-link-rel-allowed-value
+      result: pass
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-uuid-FAIL.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-uuid-FAIL.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for has-authorization-boundary-diagram-uuid
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-uuid
+  content: ../content/ssp-all-INVALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-uuid
+      result: fail
diff --git a/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-uuid-PASS.yaml b/src/validations/constraints/unit-tests/has-authorization-boundary-diagram-uuid-PASS.yaml
@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for has-authorization-boundary-diagram-uuid
+  description: >-
+    This test case validates the behavior of constraint
+    has-authorization-boundary-diagram-uuid
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: has-authorization-boundary-diagram-uuid
+      result: pass