Create style guide for FedRAMP OSCAL Constraints (#760)

* Remove FedRAMP namespace from 'data-center' props (#795) * Hotfix/info (#780) * fix informational constraint handling and make ssp-all valid correct * revert external constraint changes * Update fedramp-external-constraints.xml * Update fedramp_extensions_steps.ts * update info handling * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update src/validations/constraints/fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update src/validations/constraints/fedramp-external-constraints.xml Co-authored-by: Gabeblis <[email protected]> * Update dev-constraint.js --------- Co-authored-by: Gabeblis <[email protected]> * [skip ci] Create style guide doc for #675 * [skip ci] FSCR-1 re external constraints for #675 * [skip ci] FCSR-1, woops, need formal name for #675 * [skip ci] Tweak FCSR-1 anchor ID in #675 * [skip ci] Stop header hacks for IDs in #675 I read more about these techniques than I would like, but none of them appear to work effectively for making anchors like `#fcsr-1` without adding other content to the anchor which I would like to avoid. https://gist.github.com/asabaylus/3071099?permalink_comment_id=3895584 Either it never worked or something changed. Oh well! * [skip ci] Add FCSR-2 on context sorting for #675 * [skip ci] Add FCSR-3 about alpha sorting for #675 * [skip ci] Add FCSR-4 to require help-url for #675 * [skip ci] Adjust title from style guide to dev style guide per Rene's review * [skip ci] Adjust grammar and style per Rene's review Co-authored-by: Rene Tshiteya <[email protected]> * [skip ci] @Rene2mt's feedback: add ID req for #675 * [skip ci] @Rene2mt's feedback: level req for #675 * [skip ci] @Rene2mt's review: why CRITICAL for #675 * [skip ci] Woops, missed IDs for reqs for #675 * [skip ci] Feedback: add message req for #675 * [skip ci] Fix constraint path in examples for #675 * [skip ci] Add remarks rec guidance for #675 * [skip ci] Add @wandmagic's rec for FCSR-1 for #675 * [skip ci] Add FCSR-10 re active voice for #675 * [skip ci] Remove FCSR-10's incorrect only for #675 * [skip ci] Add FCSR-11 about BCP14 words for #675 * [skip ci] Add no-jargon req FCSR-12 for #675 * [skip ci] Item, not sequence style req for #675 * [skip ci] Add req for sequence ctx hints for #675 * [skip ci] Add FCSR-15 re formal-names for #675 * [skip ci] Remove anchor hack from FCSR-1 for #675 * [skip ci] Wrap up kebab case IDs, reorder for #675 * [skip ci] Fixes from @Rene2mt'2 review for #675 * [skip ci] Add labels for rules in #675 * [skip ci] Simplify rule titles for #675 Follow feedback from @brian-ruf in his review. * [skip ci] Finalize table index with reqs for #645 * [skip ci] Limit informational constraints for #675 * [skip ci] Feedback: FRR1 about OSCAL constraints, not Metaschema constraints Co-authored-by: David Waltermire <[email protected]> * [skip ci] Update FRR1 in table listing too Co-authored-by: David Waltermire <[email protected]> * [skip ci] Add space in status row of table for FRR2 Co-authored-by: David Waltermire <[email protected]> * [skip ci] Add missing word to FRR3 title Co-authored-by: David Waltermire <[email protected]> * [skip ci] Improve the prose in FRR2 guidance Co-authored-by: David Waltermire <[email protected]> * [skip ci] Reorder statements in sentence of FRR2 guidance Co-authored-by: David Waltermire <[email protected]> * [skip ci] Clarify ambiguous wording in FRR5 Co-authored-by: David Waltermire <[email protected]> * [skip ci] Correct typos in FRR6 formal name Co-authored-by: David Waltermire <[email protected]> * [skip ci] Make FRR7 formal name more explicit Co-authored-by: David Waltermire <[email protected]> * [skip ci] Improve FRR8 formal name Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR8 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR9 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR9 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FRR9 guidance to specify expect constraints Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FRR9 constraint examples for correct type Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FRR10 formal name to be more clear Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR10 formal name in table index Co-authored-by: David Waltermire <[email protected]> * [skip ci] Make FRR11 formal name better sentence fragment Co-authored-by: David Waltermire <[email protected]> * [skip ci] Fix FRR11 above requirement text Co-authored-by: David Waltermire <[email protected]> * [skip ci] Adjust FedRAMP reqs prefix FCSR->FRR Given related work in the program, I want to generalize the prefix to be more general and global for all form of FedRAMP requirements down the road. * [skip ci] Add missing examples to FRR17 for #675 * [skip ci] Align formal names, spacing for #675 I had to fix up some of the formal names where Dave covered some of them in many places, but not all. Also other suggestions add some space. * [skip ci] Add level to many examples, finish #675 * [skip ci] Fold longer bg info for reqs in #675 * [skip ci] Clarify FRR1 bad example is bad in #645 * [skip ci] Clarify context order examples for #675 * [skip ci] Clarify case sorting for FRR3 in #675 * [skip ci] Clean up explanation of FRR10 for #675 * [skip ci] Fix typos in FRR13 and FRR15 for #675 * [skip ci] FRR2 feedback from Kylie for #675 * [skip ci] Reword FRR9 with Kylie's feedback in #675 * [skip ci] Woops, FRR16 twice, no FRR17 for #675 * [skip ci] Last call and let reqs in FRR18 for #675 * [skip ci] Correct ID for FRR18 to anchor in table Co-authored-by: Gabeblis <[email protected]> * [skip ci] Offset req ID sequence Per discussion with others on a call with leads and staff from both FR branches, begin with an offset sequences and reserve the first 100 for other uses for the time being. /cc @kscarf1 * [skip ci] BCP14 keywords in #675 summary text * [skip ci] Tighten up summary text more for #675 * [skip ci] Add back to top anchors for #675 * [skip ci] Better grammar and flow for #675 summary * [skip ci] Improve FRR102 guidance text for #675 * [skip ci] Capitalize and fix FRR110 title for #675 * [skip ci] Fix poor grammar in FRR117 text for #675 * [skip ci] Explicit docs URL in FRR104 for #675 Address missing feedback to @kyhu65867 from review that had not been previously addressed by yours truly. * [skip ci] Fix FRR105 with feedback for #675 Address some feedback about wording and style of the unique ID req. * [skip ci] Fix FRR103 spacing for #675 Completely address feedback from @david-waltermire after checking for final review of style guide left in the comment below. #760 (comment) * [skip ci] Fix FRR108 conformant example for #675 --------- Co-authored-by: Rene Tshiteya <[email protected]> Co-authored-by: wandmagic <[email protected]> Co-authored-by: Gabeblis <[email protected]> Co-authored-by: David Waltermire <[email protected]>
GSA · Nov 1, 2024 · 9817417 · 9817417
1 parent 38260df
commit 9817417
Show file tree

Hide file tree

Showing 9 changed files with 9,937 additions and 102 deletions.
diff --git a/src/validations/constraints/STYLE.md b/src/validations/constraints/STYLE.md
diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml
@@ -8,9 +8,8 @@
     <published>2024-08-01T14:30:00Z</published>
     <last-modified>2024-08-01T14:30:00Z</last-modified>
     <version>1.1</version>
-    <oscal-version>1.1.2</oscal-version>
+    <oscal-version>1.0.0</oscal-version>
     <document-id scheme="https://example.com/identifiers">SSP-2024-002</document-id>
-    <prop name="fedramp-version" ns="https://fedramp.gov/ns/oscal" value="fedramp-3.0.0rc1-oscal-1.1.2"/>
 
     <role id="creator">
       <title>Document Creator</title>
@@ -33,36 +32,18 @@
      <role id="information-system-security-officer">
        <title>Information System Security Officer (or Equivalent)</title>
      </role>
-     <role id="system-poc-management">
-      <title>Information System Management Point of Contact (POC)</title>
-      <description>
-         <p>The highest level manager who is responsible for system operation on behalf of the System Owner.</p>
-      </description>
-      </role>
-      <role id="system-poc-technical">
-          <title>Information System Technical Point of Contact</title>
-          <description>
-            <p>The individual or individuals leading the technical operation of the system.</p>
-          </description>
-      </role>
-      <role id="system-poc-other">
-          <title>General Point of Contact (POC)</title>
-          <description>
-            <p>A general point of contact for the system, designated by the system owner.</p>
-          </description>
-      </role>
 
     <location uuid="11111112-0000-4000-9001-000000000009">
       <address >
         <country>US</country>
       </address>
-      <prop name="type" value="data-center" class="primary"/>
+      <prop name='data-center' value='dc-zone-1' class='primary'/>
     </location>
     <location uuid="11111112-0000-4000-9000-000000000003">
       <address >
         <country>US</country>
       </address>
-      <prop name="type" value="data-center" class="alternate"/>
+      <prop name='data-center' value='aws-us-west-1' class='alternate'/>
     </location>
     <party uuid="11111111-0000-4000-9000-000000000001" type="organization">
       <name>Example Organization</name>
@@ -81,29 +62,6 @@
     <responsible-party role-id="content-approver">
       <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
     </responsible-party>
-
-    <responsible-party role-id="system-owner">
-      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
-    </responsible-party>
-    <responsible-party role-id="authorizing-official">
-      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
-    </responsible-party>
-    <responsible-party role-id="authorizing-official-poc">
-      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
-    </responsible-party>
-    <responsible-party role-id="system-poc-management">
-      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
-    </responsible-party>
-    <responsible-party role-id="system-poc-technical">
-      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
-    </responsible-party>
-    <responsible-party role-id="system-poc-other">
-      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
-    </responsible-party>
-    <responsible-party role-id="information-system-security-officer">
-      <party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
-    </responsible-party>
-
     <remarks>
       <p>This SSP is an example for demonstration purposes.</p>
     </remarks>
@@ -114,7 +72,6 @@
   <system-characteristics>
     <system-id identifier-type="https://fedramp.gov">F00000001</system-id>
     <system-name>Enhanced Example System</system-name>
-    <system-name-short>System's Short Name or Acronym</system-name-short>
     <description>
       <p>This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.</p>
     </description>
@@ -136,22 +93,12 @@
         </categorization>
         <confidentiality-impact>
           <base>fips-199-high</base>
-          <selected>fips-199-high</selected>
-          <!-- adjustment-justification removed to ensure cia-impact-has-adjustment-justification passes when base and selected have the same impact level -->
         </confidentiality-impact>
         <integrity-impact>
           <base>fips-199-moderate</base>
-          <selected>fips-199-low</selected>
-          <adjustment-justification>
-            <p>Required if the base and selected values do not match.</p>
-          </adjustment-justification>
         </integrity-impact>
         <availability-impact>
-          <base>fips-199-high</base>
-          <selected>fips-199-low</selected>
-          <adjustment-justification>
-            <p>Required if the base and selected values do not match.</p>
-          </adjustment-justification>
+          <base>fips-199-low</base>
         </availability-impact>
       </information-type>
     </system-information>
@@ -203,15 +150,8 @@
     <user uuid="44444444-0000-4000-9000-000000000004">
       <title>System Administrator</title>
       <prop name="type" value="internal"/>
-      <prop ns="https://fedramp.gov/ns/oscal" name="privilege-level" value="read-write"/>
-      <prop ns="https://fedramp.gov/ns/oscal" name="sensitivity" value="high-risk"/>
+      <prop name="privilege-level" value="read-write"/>
       <role-id>system-admin</role-id>
-      <authorized-privilege>
-        <title>Admin</title>
-        <description><p>admin user</p></description>
-        <function-performed>administration</function-performed>
-      </authorized-privilege>
-
     </user>
 
     <component uuid="55555555-0000-4000-9000-000000000005" type="this-system">

diff --git a/src/validations/constraints/content/ssp-data-center-US-INVALID.xml b/src/validations/constraints/content/ssp-data-center-US-INVALID.xml
@@ -8,13 +8,7 @@
       <address >
         <country>WRONG</country>
       </address>
-      <prop name="type" value="data-center" class="primary" />
-    </location>
-    <location uuid="11291112-0070-4000-9001-000890000009">
-      <address >
-        <country>WRONG</country>
-      </address>
-      <prop name="type" value="data-center" class="alternate" />
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-alternate-INVALID.xml b/src/validations/constraints/content/ssp-data-center-alternate-INVALID.xml
@@ -4,17 +4,11 @@
                       xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
                       uuid="12345678-1234-4321-8765-123456789012">
   <metadata>
-    <location uuid="11155112-0340-4000-9001-000006500009">
-      <address >
-        <country>US</country>
-      </address>
-      <prop name='type' value='data-center' class='primary'/>
-    </location>
     <location uuid="11111112-0000-4000-9001-000000000009">
       <address >
-        <country>US</country>
+        <country>WRONG</country>
       </address>
-      <prop name="type" value="data-center" class="tertiary" />
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-count-INVALID.xml b/src/validations/constraints/content/ssp-data-center-count-INVALID.xml
@@ -5,10 +5,10 @@
                       uuid="12345678-1234-4321-8765-123456789012">
   <metadata>
     <location uuid="11111112-0000-4000-9001-000000000009">
-      <address>
-        <country>US</country>
+      <address >
+        <country>WRONG</country>
       </address>
-      <prop name="type" value="data-center" class="tertiary" />
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-country-code-INVALID.xml b/src/validations/constraints/content/ssp-data-center-country-code-INVALID.xml
@@ -5,14 +5,9 @@
                       uuid="12345678-1234-4321-8765-123456789012">
   <metadata>
     <location uuid="11111112-0000-4000-9001-000000000009">
-      <address>
+      <address >
       </address>
-      <prop name='type' value='data-center' class='primary'/>
-    </location>
-    <location uuid="11117112-0080-4000-9001-001230000009">
-      <address>
-      </address>
-      <prop name="type" value="data-center" class="alternate" />
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/content/ssp-data-center-primary-INVALID.xml b/src/validations/constraints/content/ssp-data-center-primary-INVALID.xml
@@ -6,15 +6,9 @@
   <metadata>
     <location uuid="11111112-0000-4000-9001-000000000009">
       <address >
-        <country>US</country>
+        <country>WRONG</country>
       </address>
-      <prop name="type" value="data-center" class="tertiary" />
-    </location>
-    <location uuid="11143112-0000-4320-9001-000066700009">
-      <address >
-        <country>US</country>
-      </address>
-      <prop name="type" value="data-center" class="alternate'"/>
+      <prop name='data-center' value='dc-zone-1' class='tertiary'/>
     </location>
   </metadata>
 </system-security-plan>
diff --git a/src/validations/constraints/fedramp-external-allowed-values.xml b/src/validations/constraints/fedramp-external-allowed-values.xml
@@ -404,11 +404,9 @@
     </context>
 
     <context>
-        <metapath target="/system-security-plan/system-characteristics/security-sensitivity-level"/>
-        <metapath target="/system-security-plan/system-characteristics/security-impact-level/(security-objective-confidentiality|security-objective-integrity|security-objective-availability)"/>
-        <metapath target="/system-security-plan/system-characteristics/system-information/information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)"/> 
+        <metapath target="/system-security-plan/system-characteristics"/>
         <constraints>
-            <allowed-values id="security-level" target="." allow-other="no" level="ERROR">
+            <allowed-values id="security-level" target="system-information/information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)|security-impact-level/(security-objective-confidentiality|security-objective-integrity|security-objective-availability)|security-sensitivity-level" allow-other="no" level="ERROR">
                 <formal-name>Security Impact Level</formal-name>
                 <description>The security objective level as defined by <a href="https://doi.org/10.6028/NIST.SP.800-60v1r1">NIST SP 800-60</a>.</description>
                 <enum value="fips-199-low">Low</enum>