From 73b413f200a81c0a8fb54d8fecd5b118555b495d Mon Sep 17 00:00:00 2001 From: Rene Tshiteya Date: Thu, 5 Sep 2024 13:28:31 -0400 Subject: [PATCH] Add responsible-party-is-person constraint --- features/fedramp_extensions.feature | 3 + .../constraints/content/ssp-all-INVALID.xml | 64 +++++++ .../constraints/content/ssp-all-VALID.xml | 173 +++++++++++++----- .../fedramp-external-constraints.xml | 118 +++++++----- .../responsible-party-is-person-FAIL.yaml | 7 + .../responsible-party-is-person-PASS.yaml | 7 + 6 files changed, 278 insertions(+), 94 deletions(-) create mode 100644 src/validations/constraints/unit-tests/responsible-party-is-person-FAIL.yaml create mode 100644 src/validations/constraints/unit-tests/responsible-party-is-person-PASS.yaml diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature index a297fc489..c327fd82e 100644 --- a/features/fedramp_extensions.feature +++ b/features/fedramp_extensions.feature @@ -65,6 +65,8 @@ Examples: | resource-has-title-PASS.yaml | | response-point-FAIL.yaml | | response-point-PASS.yaml | + | responsible-party-is-person-FAIL.yaml | + | responsible-party-is-person-PASS.yaml | | scan-type-FAIL.yaml | | scan-type-PASS.yaml | | user-type-FAIL.yaml | @@ -109,6 +111,7 @@ Examples: | prop-response-point-has-cardinality-one | | resource-has-base64-or-rlink | | resource-has-title | + | responsible-party-is-person | | scan-type | | user-type | #END_DYNAMIC_CONSTRAINT_IDS \ No newline at end of file diff --git a/src/validations/constraints/content/ssp-all-INVALID.xml b/src/validations/constraints/content/ssp-all-INVALID.xml index 6904ae83c..f7801defe 100644 --- a/src/validations/constraints/content/ssp-all-INVALID.xml +++ b/src/validations/constraints/content/ssp-all-INVALID.xml @@ -23,6 +23,48 @@ Asset Owner + + Information System Owner + +

The individual within the CSP who is ultimately accountable for everything related to this system.

+ + + + Authorizing Official + +

The individual or individuals who must grant this system an authorization to operate.

+ + + + Authorizing Official's Point of Contact + +

The individual representing the authorizing official.

+ + + + Information System Management Point of Contact (POC) + +

The highest level manager who responsible for system operation on behalf of the System Owner.

+ + + + Information System Technical Point of Contact + +

The individual or individuals leading the technical operation of the system.

+ + + + General Point of Contact (POC) + +

A general point of contact for the system, designated by the system owner.

+ + + + System Information System Security Officer (or Equivalent) + +

The individual accountable for the security posture of the system on behalf of the system owner.

+ +
WRONG @@ -48,6 +90,28 @@ 22222222-0000-4000-9000-000000000002 + + 11111111-0000-4000-9000-000000000001 + + + 22222222-0000-4000-9000-000000000002 + + + 11111111-0000-4000-9000-000000000001 + + + 11111111-0000-4000-9000-000000000001 + + + 11111111-0000-4000-9000-000000000001 + + + 11111111-0000-4000-9000-000000000001 + + + 11111111-0000-4000-9000-000000000001 + +

This SSP is an example for demonstration purposes.

 diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml index 4bbcee219..5b3b11ba3 100644 --- a/src/validations/constraints/content/ssp-all-VALID.xml +++ b/src/validations/constraints/content/ssp-all-VALID.xml @@ -1,8 +1,8 @@ + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd" + uuid="12345678-1234-4321-8765-123456789012"> Enhanced Example System Security Plan 2024-08-01T14:30:00Z @@ -10,7 +10,7 @@ 1.1 1.0.0 SSP-2024-002 - + Document Creator @@ -23,27 +23,73 @@ Asset Owner + + Information System Owner + +

The individual within the CSP who is ultimately accountable for everything related to + this system.

+ + + + Authorizing Official + +

The individual or individuals who must grant this system an authorization to operate.

+ + + + Authorizing Official's Point of Contact + +

The individual representing the authorizing official.

+ + + + Information System Management Point of Contact (POC) + +

The highest level manager who responsible for system operation on behalf of the System + Owner.

+ + + + Information System Technical Point of Contact + +

The individual or individuals leading the technical operation of the system.

+ + + + General Point of Contact (POC) + +

A general point of contact for the system, designated by the system owner.

+ + + + System Information System Security Officer (or Equivalent) + +

The individual accountable for the security posture of the system on behalf of the system + owner.

+ + -
+
US
- + -
+
US
- + Example Organization ExOrg - + Jane Doe jane.doe@example.com -
+
@@ -52,25 +98,51 @@ 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 11111111-0000-4000-9000-000000000001 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + +

This SSP is an example for demonstration purposes.

 - - - + + + F00000001 Enhanced Example System -

This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.

+

This is an enhanced example system for demonstration purposes, incorporating more + FedRAMP-specific elements.

 - - - + + + moderate - + Financial Information

Contains sensitive financial data related to organizational operations.

@@ -94,29 +166,30 @@ moderate moderate - + -

The authorization boundary includes all components within the main data center and the disaster recovery site.

+

The authorization boundary includes all components within the main data center and the + disaster recovery site.

 - + System Administrator - - + + system-admin - + Primary Application Server

Main application server hosting the core system functionality.

 main line - + 11111111-0000-4000-9000-000000000001 @@ -124,15 +197,15 @@

This is the primary application server for the system.

 - + External API Connection

Secure connection to an external API for data enrichment.

 - - - + + + 11111111-0000-4000-9000-000000000001 @@ -140,70 +213,72 @@

This connection is used for secure data exchange with external systems.

 - +

Primary database server

 - - - - - - + + + + + + 11111111-0000-4000-9000-000000000001 - + - +

Implementation of controls for the Enhanced Example System

 - - + + - +

Access Control Policy and Procedures (AC-1) is fully implemented in our system.

 - + 11111111-0000-4000-9000-000000000001 - + - + - +

Information System Component Inventory (CM-8) is partially implemented.

 - + 11111111-0000-4000-9000-000000000001 - + Access Control Policy

Detailed access control policy document

 - - + + User's Guide diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index 484f6f85a..33b57a3af 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -4,43 +4,50 @@ - - - + + + - + Duplicate reponse point at '{ path(.) }'.

This appears in FedRAMP profiles and resolved profile catalogs.

-

For control statements, it signals to the CSP which statements require a response in the SSP.

-

For control objectives, it signals to the assessor which control objectives must appear in the assessment results, which aligns with the FedRAMP test case workbook.

- +

For control statements, it signals to the CSP which statements require a response + in the SSP.

+

For control objectives, it signals to the assessor which control objectives must + appear in the assessment results, which aligns with the FedRAMP test case + workbook.

+ + + + + + + + Each data center address must contain a country code. + + + Each data center must have an address that is within the United States. + - - - - - - Each data center address must contain a country code. - - - Each data center must have an address that is within the United States. - - - - - - - - Every supporting artifact found in a citation should have a title. - - - Every supporting artifact found in a citation must have at least one base64 or rlink element. - - + + + + + + Every supporting artifact found in a citation should have a title. + + + Every supporting artifact found in a citation must have at least one base64 + or rlink element. + + A FedRAMP SSP must have a User Guide attached. @@ -59,20 +66,41 @@ A FedRAMP SSP must have a Separation of Duties Matrix attached. - - - - - - There must be at least two (2) data centers listed. - + + + + + + There must be at least two (2) data centers listed. + - - There must be a single primary data center. - - - There must be one or more alternate data center(s). - - - - + + There must be a single primary data center. + + + There must be one or more alternate data center(s). + + + + + + + + In-Scope UUIDs for party assemblies of type "person". + An index of UUIDs for party assemblies of type "person". + + + + + This responsible-party references a party which is not a person. + + +

For roles 'system-owner', 'authorizing-official-poc', 'system-poc-management', 'system-poc-technical', 'system-poc-other', and 'information-system-security-officer', the responsible-role party must be a party of type 'person'.

+ + + + + \ No newline at end of file diff --git a/src/validations/constraints/unit-tests/responsible-party-is-person-FAIL.yaml b/src/validations/constraints/unit-tests/responsible-party-is-person-FAIL.yaml new file mode 100644 index 000000000..283522d1d --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-is-person-FAIL.yaml @@ -0,0 +1,7 @@ +test-case: + name: Negative Test for responsible-party-is-person + description: This test case validates the behavior of constraint responsible-party-is-person + content: ssp-all-INVALID.xml + expectations: + - constraint-id: responsible-party-is-person + result: fail \ No newline at end of file diff --git a/src/validations/constraints/unit-tests/responsible-party-is-person-PASS.yaml b/src/validations/constraints/unit-tests/responsible-party-is-person-PASS.yaml new file mode 100644 index 000000000..688d13c40 --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-is-person-PASS.yaml @@ -0,0 +1,7 @@ +test-case: + name: Positive Test for responsible-party-is-person + description: This test case validates the behavior of constraint responsible-party-is-person + content: ../content/ssp-all-VALID.xml + expectations: + - constraint-id: responsible-party-is-person + result: pass \ No newline at end of file