From f840e89a8a92cec1d00d895456e4088b10e44d82 Mon Sep 17 00:00:00 2001 From: "~ . ~" <156969148+wandmagic@users.noreply.github.com> Date: Tue, 1 Oct 2024 06:53:09 -0400 Subject: [PATCH 1/2] has sensitivity-level constraint --- features/fedramp_extensions.feature | 3 + ...has-security-sensitivity-level-INVALID.xml | 298 ++++++++++++++++++ .../fedramp-external-constraints.xml | 3 + .../has-security-sensitivity-level-FAIL.yaml | 9 + .../has-security-sensitivity-level-PASS.yaml | 9 + 5 files changed, 322 insertions(+) create mode 100644 src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml create mode 100644 src/validations/constraints/unit-tests/has-security-sensitivity-level-FAIL.yaml create mode 100644 src/validations/constraints/unit-tests/has-security-sensitivity-level-PASS.yaml diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature index 6ffa56cfa..3f47aa976 100644 --- a/features/fedramp_extensions.feature +++ b/features/fedramp_extensions.feature @@ -101,6 +101,8 @@ Examples: | has-network-architecture-diagram-link-rel-allowed-value-PASS.yaml | | has-rules-of-behavior-FAIL.yaml | | has-rules-of-behavior-PASS.yaml | + | has-security-sensitivity-level-FAIL.yaml | + | has-security-sensitivity-level-PASS.yaml | | has-separation-of-duties-matrix-FAIL.yaml | | has-separation-of-duties-matrix-PASS.yaml | | has-user-guide-FAIL.yaml | @@ -197,6 +199,7 @@ Examples: | has-network-architecture-diagram-link-rel | | has-network-architecture-diagram-link-rel-allowed-value | | has-rules-of-behavior | + | has-security-sensitivity-level | | has-separation-of-duties-matrix | | has-user-guide | | information-type-system | diff --git a/src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml b/src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml new file mode 100644 index 000000000..09975d38b --- /dev/null +++ b/src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml @@ -0,0 +1,298 @@ + + + Enhanced Example System Security Plan + 2024-08-01T14:30:00Z + 2024-08-01T14:30:00Z + 1.1 + 1.0.0 + SSP-2024-002 + + Document Creator + + + Content Approver + + + System Administrator + + + Asset Owner + + + System Owner + + + Authorizing Official Point of Contact + + + Information System Security Officer (or Equivalent) + + +
+ US +
+ + + +
+ US +
+ + + + Example Organization + ExOrg + + + + Jane Doe + jane.doe@example.com +
+ + + 11111111-0000-4000-9000-000000000001 + + + 22222222-0000-4000-9000-000000000002 + + +

This SSP is an example for demonstration purposes.

+ + + + + F00000001 + Enhanced Example System + +

This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.

+ + + + + + + + + + Financial Information + +

Contains sensitive financial data related to organizational operations.

+ + + C.2.8.12 + + + fips-199-high + + + fips-199-moderate + + + fips-199-low + + + + + fips-199-moderate + fips-199-moderate + fips-199-moderate + + + +

A holistic, top-level explanation of the system's data flows.

+ + + +

A diagram-specific explanation.

+ + + Data Flow Diagram + + + + + + System Administrator + + + system-admin + + + Primary Application Server + +

Main application server hosting the core system functionality.

+ + main line + + + 11111111-0000-4000-9000-000000000001 + + +

This is the primary application server for the system.

+ + + + External API Connection + +

Secure connection to an external API for data enrichment.

+ + + + + + 11111111-0000-4000-9000-000000000001 + + +

This connection is used for secure data exchange with external systems.

+ + + + +

Primary database server

+ + + + + + + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + +

Implementation of controls for the Enhanced Example System

+ + + + + + + + +

Access Control Policy and Procedures (AC-1) is fully implemented in our system.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + + +

Information System Component Inventory (CM-8) is partially implemented.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + Access Control Policy + +

Detailed access control policy document

+ + + + + + User's Guide + +

User's Guide

+ + + + + +

Table 12-1 Attachments: User's Guide Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Rules of Behavior

+ + + + + + 00000000 + +

Table 12-1 Attachments: Rules of Behavior (ROB)

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Contingency Plan (CP)

+ + + + + + 00000000 + +

Table 12-1 Attachments: Contingency Plan (CP) Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Configuration Management (CM) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Configuration Management (CM) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Incident Response (IR) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Incident Response (IR) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Separation of Duties Matrix + +

Separation of Duties Matrix

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + \ No newline at end of file diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index 881e99a33..ad7180ca1 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -137,6 +137,9 @@ Each FedRAMP SSP data flow diagram must have a link rel attribute with the value "diagram". + + A FedRAMP SSP Must have a security sensitivity level. + diff --git a/src/validations/constraints/unit-tests/has-security-sensitivity-level-FAIL.yaml b/src/validations/constraints/unit-tests/has-security-sensitivity-level-FAIL.yaml new file mode 100644 index 000000000..0aa9e2dd7 --- /dev/null +++ b/src/validations/constraints/unit-tests/has-security-sensitivity-level-FAIL.yaml @@ -0,0 +1,9 @@ +test-case: + name: Negative Test for has-security-sensitivity-level + description: >- + This test case validates the behavior of constraint + has-security-sensitivity-level + content: ../content/ssp-has-security-sensitivity-level-INVALID.xml + expectations: + - constraint-id: has-security-sensitivity-level + result: fail diff --git a/src/validations/constraints/unit-tests/has-security-sensitivity-level-PASS.yaml b/src/validations/constraints/unit-tests/has-security-sensitivity-level-PASS.yaml new file mode 100644 index 000000000..be4216b92 --- /dev/null +++ b/src/validations/constraints/unit-tests/has-security-sensitivity-level-PASS.yaml @@ -0,0 +1,9 @@ +test-case: + name: Positive Test for has-security-sensitivity-level + description: >- + This test case validates the behavior of constraint + has-security-sensitivity-level + content: ../content/ssp-all-VALID.xml + expectations: + - constraint-id: has-security-sensitivity-level + result: pass From b5b92cb36a572d9742e5d53336e9862606319e72 Mon Sep 17 00:00:00 2001 From: "~ . ~" <156969148+wandmagic@users.noreply.github.com> Date: Tue, 1 Oct 2024 09:31:27 -0400 Subject: [PATCH 2/2] Update ssp-has-security-sensitivity-level-INVALID.xml --- ...has-security-sensitivity-level-INVALID.xml | 302 +----------------- 1 file changed, 6 insertions(+), 296 deletions(-) diff --git a/src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml b/src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml index 09975d38b..25cbe3dbe 100644 --- a/src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml +++ b/src/validations/constraints/content/ssp-has-security-sensitivity-level-INVALID.xml @@ -1,298 +1,8 @@ - - - Enhanced Example System Security Plan - 2024-08-01T14:30:00Z - 2024-08-01T14:30:00Z - 1.1 - 1.0.0 - SSP-2024-002 - - Document Creator - - - Content Approver - - - System Administrator - - - Asset Owner - - - System Owner - - - Authorizing Official Point of Contact - - - Information System Security Officer (or Equivalent) - - -
- US -
- - - -
- US -
- - - - Example Organization - ExOrg - - - - Jane Doe - jane.doe@example.com -
- - - 11111111-0000-4000-9000-000000000001 - - - 22222222-0000-4000-9000-000000000002 - - -

This SSP is an example for demonstration purposes.

- - - + + - F00000001 - Enhanced Example System - -

This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.

- - - - - - - - - - Financial Information - -

Contains sensitive financial data related to organizational operations.

- - - C.2.8.12 - - - fips-199-high - - - fips-199-moderate - - - fips-199-low - - - - - fips-199-moderate - fips-199-moderate - fips-199-moderate - - - -

A holistic, top-level explanation of the system's data flows.

- - - -

A diagram-specific explanation.

- - - Data Flow Diagram - - - - - System Administrator - - - system-admin - - - Primary Application Server - -

Main application server hosting the core system functionality.

- - main line - - - 11111111-0000-4000-9000-000000000001 - - -

This is the primary application server for the system.

- - - - External API Connection - -

Secure connection to an external API for data enrichment.

- - - - - - 11111111-0000-4000-9000-000000000001 - - -

This connection is used for secure data exchange with external systems.

- - - - -

Primary database server

- - - - - - - - - 11111111-0000-4000-9000-000000000001 - - - - - - - - -

Implementation of controls for the Enhanced Example System

- - - - - - - - -

Access Control Policy and Procedures (AC-1) is fully implemented in our system.

- - - - 11111111-0000-4000-9000-000000000001 - - - - - - - - - -

Information System Component Inventory (CM-8) is partially implemented.

- - - - 11111111-0000-4000-9000-000000000001 - - - - - - - Access Control Policy - -

Detailed access control policy document

- - - - - - User's Guide - -

User's Guide

- - - - - -

Table 12-1 Attachments: User's Guide Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Rules of Behavior

- - - - - - 00000000 - -

Table 12-1 Attachments: Rules of Behavior (ROB)

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Contingency Plan (CP)

- - - - - - 00000000 - -

Table 12-1 Attachments: Contingency Plan (CP) Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Configuration Management (CM) Plan

- - - - - - 00000000 - -

Table 12-1 Attachments: Configuration Management (CM) Plan Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Incident Response (IR) Plan

- - - - - - 00000000 - -

Table 12-1 Attachments: Incident Response (IR) Plan Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Separation of Duties Matrix - -

Separation of Duties Matrix

- - - - - - 00000000 - -

May use rlink with a relative path, or embedded as base64.

- - - - \ No newline at end of file +