diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature index aecf898bf..02490226f 100644 --- a/features/fedramp_extensions.feature +++ b/features/fedramp_extensions.feature @@ -167,10 +167,16 @@ Examples: | response-point-PASS.yaml | | responsible-party-is-person-FAIL.yaml | | responsible-party-is-person-PASS.yaml | + | responsible-party-prepared-by-FAIL.yaml | + | responsible-party-prepared-by-PASS.yaml | + | responsible-party-prepared-by-location-valid-FAIL.yaml | + | responsible-party-prepared-by-location-valid-PASS.yaml | | role-defined-authorizing-official-poc-FAIL.yaml | | role-defined-authorizing-official-poc-PASS.yaml | | role-defined-information-system-security-officer-FAIL.yaml | | role-defined-information-system-security-officer-PASS.yaml | + | role-defined-prepared-by-FAIL.yaml | + | role-defined-prepared-by-PASS.yaml | | role-defined-system-owner-FAIL.yaml | | role-defined-system-owner-PASS.yaml | | scan-type-FAIL.yaml | @@ -284,8 +290,11 @@ Examples: | resource-has-base64-or-rlink | | resource-has-title | | responsible-party-is-person | + | responsible-party-prepared-by | + | responsible-party-prepared-by-location-valid | | role-defined-authorizing-official-poc | | role-defined-information-system-security-officer | + | role-defined-prepared-by | | role-defined-system-owner | | scan-type | | security-level | diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml index 3e81f23a4..6d5a69e17 100644 --- a/src/validations/constraints/content/ssp-all-VALID.xml +++ b/src/validations/constraints/content/ssp-all-VALID.xml @@ -12,6 +12,12 @@ SSP-2024-002 + + Prepared By + +

This party prepared the SSP.

+ + Document Creator @@ -52,6 +58,17 @@ + + CSP HQ +
+ Suite 0000 + 1234 Some Street + Haven + ME + 00000 + US +
+
US @@ -64,6 +81,15 @@
+ + Person Name 1 + + + name@example.com + 2020000001 + 27b78960-59ef-4619-82b0-ae20b9c709ac + 6b286b5d-8f07-4fa7-8847-1dd0d88f73fb + Example Organization ExOrg @@ -75,6 +101,9 @@
+ + 3360e343-9860-4bda-9dfc-ff427c3dfab6 + 11111111-0000-4000-9000-000000000001 diff --git a/src/validations/constraints/content/ssp-responsible-party-prepared-by-INVALID.xml b/src/validations/constraints/content/ssp-responsible-party-prepared-by-INVALID.xml new file mode 100644 index 000000000..b032a9770 --- /dev/null +++ b/src/validations/constraints/content/ssp-responsible-party-prepared-by-INVALID.xml @@ -0,0 +1,13 @@ + + + + Prepared By + +

This organization prepared the SSP.

+ + + + 3360e343-9860-4bda-9dfc-ff427c3dfab6 + + + \ No newline at end of file diff --git a/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-INVALID-1.xml b/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-INVALID-1.xml new file mode 100644 index 000000000..bcf8d206b --- /dev/null +++ b/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-INVALID-1.xml @@ -0,0 +1,18 @@ + + + + + +
+ Suite 0000 + 1234 Some Street + + ME + 00000 +
+ + + 3360e343-9860-4bda-9dfc-ff427c3dfab6 + + + \ No newline at end of file diff --git a/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-INVALID.xml b/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-INVALID.xml new file mode 100644 index 000000000..fbdad1f26 --- /dev/null +++ b/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-INVALID.xml @@ -0,0 +1,22 @@ + + + + + + CSP HQ +
+ Suite 0000 + 1234 Some Street + + ME + 00000 +
+ + + 27b78960-59ef-4619-82b0-ae20b9c709ac + + + 3360e343-9860-4bda-9dfc-ff427c3dfab6 + + + \ No newline at end of file diff --git a/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-VALID-1.xml b/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-VALID-1.xml new file mode 100644 index 000000000..deffeb3d5 --- /dev/null +++ b/src/validations/constraints/content/ssp-responsible-party-prepared-by-location-valid-VALID-1.xml @@ -0,0 +1,473 @@ + + + + Enhanced Example System Security Plan + 2024-08-01T14:30:00Z + 2024-08-01T14:30:00Z + 1.1 + 1.1.2 + SSP-2024-002 + + + + Prepared By + +

This organization prepared the SSP.

+ + + + Document Creator + + + Content Approver + + + System Administrator + + + Asset Owner + + + System Owner + + + Authorizing Official Point of Contact + + + Information System Security Officer (or Equivalent) + + + Information System Management Point of Contact (POC) + +

The highest level manager who is responsible for system operation on behalf of the System Owner.

+ + + + Information System Technical Point of Contact + +

The individual or individuals leading the technical operation of the system.

+ + + + General Point of Contact (POC) + +

A general point of contact for the system, designated by the system owner.

+ + + +
+ US +
+ + + +
+ US +
+ + + + Person Name 1 + + + name@example.com + 2020000001 +
+ Suite 0000 + 1234 Some Street + Haven + ME + 00000 + US +
+ 6b286b5d-8f07-4fa7-8847-1dd0d88f73fb + + + Example Organization + ExOrg + + + + Jane Doe + jane.doe@example.com +
+ + + + 3360e343-9860-4bda-9dfc-ff427c3dfab6 + + + 11111111-0000-4000-9000-000000000001 + + + 22222222-0000-4000-9000-000000000002 + + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + +

This SSP is an example for demonstration purposes.

+ + + + + + + F00000001 + Enhanced Example System + System's Short Name or Acronym + +

This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.

+ + + + + + + + fips-199-moderate + + + Financial Information + +

Contains sensitive financial data related to organizational operations.

+ + + C.2.8.12 + + + fips-199-high + fips-199-high + + + + fips-199-moderate + fips-199-low + +

Required if the base and selected values do not match.

+ + + + fips-199-high + fips-199-low + +

Required if the base and selected values do not match.

+ + + + + + fips-199-moderate + fips-199-moderate + fips-199-moderate + + + + +

The authorization boundary includes all components within the main data center and the disaster recovery site.

+ + + +

A diagram-specific explanation.

+ + + Authorization Boundary Diagram + + + + +

A holistic, top-level explanation of the network architecture.

+ + + +

A diagram-specific explanation.

+ + + Network Diagram + + + + +

A holistic, top-level explanation of the system's data flows.

+ + + +

A diagram-specific explanation.

+ + + Data Flow Diagram + + + + + + + System Administrator + + + + system-admin + + Admin +

admin user

 + administration + + + + + + Primary Application Server + +

Main application server hosting the core system functionality.

+ + main line + + + 11111111-0000-4000-9000-000000000001 + + +

This is the primary application server for the system.

+ + + + + External API Connection + +

Secure connection to an external API for data enrichment.

+ + + + + + 11111111-0000-4000-9000-000000000001 + + +

This connection is used for secure data exchange with external systems.

+ + + + + +

Primary database server

+ + + + + + + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + + +

Implementation of controls for the Enhanced Example System

+ + + + + + + + +

Access Control Policy and Procedures (AC-1) is fully implemented in our system.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + + + +

Information System Component Inventory (CM-8) is partially implemented.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + Access Control Policy + +

Detailed access control policy document

+ + + + + + User's Guide + +

User's Guide

+ + + + + +

Table 12-1 Attachments: User's Guide Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Rules of Behavior

+ + + + + + 00000000 + +

Table 12-1 Attachments: Rules of Behavior (ROB)

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Contingency Plan (CP)

+ + + + + + 00000000 + +

Table 12-1 Attachments: Contingency Plan (CP) Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Configuration Management (CM) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Configuration Management (CM) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Incident Response (IR) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Incident Response (IR) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Separation of Duties Matrix + +

Separation of Duties Matrix

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + + Authorization Boundary + +

Authorization Boundary Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + Network Architecture + +

Network Architecture Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + Data Flow + +

Data flow Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + + + diff --git a/src/validations/constraints/content/ssp-role-defined-prepared-by-INVALID.xml b/src/validations/constraints/content/ssp-role-defined-prepared-by-INVALID.xml new file mode 100644 index 000000000..ac2413474 --- /dev/null +++ b/src/validations/constraints/content/ssp-role-defined-prepared-by-INVALID.xml @@ -0,0 +1,16 @@ + + + + Prepared By + +

The organization that prepared this SSP. If developed in-house, this is the CSP itself.

+ + + + 3360e343-9860-4bda-9dfc-ff427c3dfab6 + +

Exactly one

+ + + + \ No newline at end of file diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index 8bcfe5503..fdfdc433c 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -150,6 +150,10 @@ + + + + Data Center Alternate @@ -176,6 +180,16 @@ For roles 'system-owner' and 'information-system-security-officer', the responsible-role party MUST be a party of type 'person'. + + Responsible Party Prepared By + + A FedRAMP SSP MUST have a responsible party that defines which party performs the role of preparing the document. + + + Responsible Party Prepared By Location Valid + + A FedRAMP SSP MUST have a responsible party for preparing the document, and that party MUST define an address. + Role Defined Authorizing Official POC @@ -187,6 +201,11 @@ A FedRAMP SSP MUST define a role for the point of contact for an information system security officer. + + Role Defined Prepared By + + A FedRAMP SSP MUST define a role for preparing this document. + Role Defined System Owner diff --git a/src/validations/constraints/unit-tests/responsible-party-prepared-by-FAIL.yaml b/src/validations/constraints/unit-tests/responsible-party-prepared-by-FAIL.yaml new file mode 100644 index 000000000..20dd9ebe4 --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-prepared-by-FAIL.yaml @@ -0,0 +1,9 @@ +test-case: + name: Negative Test for responsible-party-prepared-by + description: >- + This test case validates the behavior of constraint + responsible-party-prepared-by + content: ../content/ssp-responsible-party-prepared-by-INVALID.xml + expectations: + - constraint-id: responsible-party-prepared-by + result: fail diff --git a/src/validations/constraints/unit-tests/responsible-party-prepared-by-PASS.yaml b/src/validations/constraints/unit-tests/responsible-party-prepared-by-PASS.yaml new file mode 100644 index 000000000..3f55f7247 --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-prepared-by-PASS.yaml @@ -0,0 +1,9 @@ +test-case: + name: Positive Test for responsible-party-prepared-by + description: >- + This test case validates the behavior of constraint + responsible-party-prepared-by + content: ../content/ssp-all-VALID.xml + expectations: + - constraint-id: responsible-party-prepared-by + result: pass diff --git a/src/validations/constraints/unit-tests/responsible-party-prepared-by-location-valid-FAIL.yaml b/src/validations/constraints/unit-tests/responsible-party-prepared-by-location-valid-FAIL.yaml new file mode 100644 index 000000000..d4a1be275 --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-prepared-by-location-valid-FAIL.yaml @@ -0,0 +1,12 @@ +test-case: + name: Negative Test for responsible-party-prepared-by-location-valid + description: >- + This test case validates the behavior of constraint responsible-party-prepared-by-location-valid. + Scenario 1: Tests the case of an invalid location assembly. + Scenario 2: Tests the case of an invalid address directly in the party itself. + content: + - ../content/ssp-responsible-party-prepared-by-location-valid-INVALID.xml + - ../content/ssp-responsible-party-prepared-by-location-valid-INVALID-1.xml + expectations: + - constraint-id: responsible-party-prepared-by-location-valid + result: fail diff --git a/src/validations/constraints/unit-tests/responsible-party-prepared-by-location-valid-PASS.yaml b/src/validations/constraints/unit-tests/responsible-party-prepared-by-location-valid-PASS.yaml new file mode 100644 index 000000000..f0f790e02 --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-prepared-by-location-valid-PASS.yaml @@ -0,0 +1,12 @@ +test-case: + name: Positive Test for responsible-party-prepared-by-location-valid + description: >- + This test case validates the behavior of constraint responsible-party-prepared-by-location-valid. + Scenario 1: Tests when a party references a location assembly. + Scenario 2: Tests when a party has an address assembly embedded. + content: + - ../content/ssp-all-VALID.xml + - ../content/ssp-responsible-party-prepared-by-location-valid-VALID-1.xml + expectations: + - constraint-id: responsible-party-prepared-by-location-valid + result: pass diff --git a/src/validations/constraints/unit-tests/role-defined-prepared-by-FAIL.yaml b/src/validations/constraints/unit-tests/role-defined-prepared-by-FAIL.yaml new file mode 100644 index 000000000..8e16c1f6a --- /dev/null +++ b/src/validations/constraints/unit-tests/role-defined-prepared-by-FAIL.yaml @@ -0,0 +1,7 @@ +test-case: + name: Negative Test for role-defined-prepared-by + description: This test case validates the behavior of constraint role-defined-prepared-by + content: ../content/ssp-role-defined-prepared-by-INVALID.xml + expectations: + - constraint-id: role-defined-prepared-by + result: fail diff --git a/src/validations/constraints/unit-tests/role-defined-prepared-by-PASS.yaml b/src/validations/constraints/unit-tests/role-defined-prepared-by-PASS.yaml new file mode 100644 index 000000000..20380bce1 --- /dev/null +++ b/src/validations/constraints/unit-tests/role-defined-prepared-by-PASS.yaml @@ -0,0 +1,7 @@ +test-case: + name: Positive Test for role-defined-prepared-by + description: This test case validates the behavior of constraint role-defined-prepared-by + content: ../content/ssp-all-VALID.xml + expectations: + - constraint-id: role-defined-prepared-by + result: pass