-
Notifications
You must be signed in to change notification settings - Fork 92
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Feature/fedramp citations #985
Closed
Closed
Changes from all commits
Commits
Show all changes
27 commits
Select commit
Hold shift + click to select a range
3dac868
~
wandmagic 60a1d72
~
wandmagic e513a60
improve constraints
wandmagic 9d1942e
improve constraints
wandmagic f6d6bf0
fix test files
wandmagic d93e1ed
Update fedramp-ssp-example.oscal.xml
wandmagic 7bae1e6
update content & constraints
wandmagic c9b6c41
Update src/validations/constraints/fedramp-external-constraints.xml
wandmagic 3d45b79
Update fedramp_extensions.feature
wandmagic aba77dc
Update fedramp_extensions.feature
wandmagic 3915486
Update fedramp-external-constraints.xml
wandmagic b0c3641
remove pia test
wandmagic d5f6fc4
Squashed commit of the following:
wandmagic 33fb459
rebase
wandmagic 5e9edb4
squashed commit
wandmagic f7a9ab0
update help uri
wandmagic 22710e8
remove un needed constraint
wandmagic f82cd48
remove duplicates
wandmagic d00aa90
improve style constraint
wandmagic 547287b
Update fedramp-external-constraints.xml
wandmagic e4ff8b7
Update fedramp-external-constraints.xml
wandmagic afd6804
rebase
wandmagic 375c8dd
address feedback
wandmagic 569c696
Update fedramp-external-constraints.xml
wandmagic 42ed895
fix missing constraint
wandmagic c2051e3
add test
wandmagic 620cdae
undo
wandmagic File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
41 changes: 41 additions & 0 deletions
41
documents/adr/0010-fedramp-identifier-type-and-namespace.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| # 10. FedRAMP System Identifier Type and Namespace | ||
|
|
||
| Date: 2024-10-11 | ||
|
|
||
| ## Status | ||
|
|
||
| Proposed | ||
|
|
||
| ## Context | ||
|
|
||
| The FedRAMP automation team needs to provide clear guidance on the acceptable values for an SSP system `identifier-type`, for its extension `prop` namespace values, and the naming system identifier `system` attribute (used in the assessent results and POA&M). | ||
|
|
||
| The OSCAL models specify a set of allowed values for `identifier-type` (see [OSCAL Metaschema Model](https://github.com/usnistgov/OSCAL/blob/4f02dac6f698efda387cc5f55bc99581eaf494b6/src/metaschema/oscal_implementation-common_metaschema.xml#L676-L704)). For FedRAMP systems, the only allowed value is "http://fedramp.gov/ns/oscal" because "https://fedramp.gov" is deprecated. However, use of "http://fedramp.gov/ns/oscal" for `identifier-type` may cause some confusion as FedRAMP extensions currently have `@ns` values of "https://fedramp.gov/ns/oscal" (notice the difference - **http** vs **https**). Currently, the allowed value for naming system identifier (in the assessment results and POA&M) is "https://fedramp.gov/ns/oscal". | ||
|
|
||
| ## Possible Solutions | ||
|
|
||
| The team considered multiple approaches listed below. | ||
|
|
||
| 1. **Option 1** - require "https://fedramp.gov" for `identifier-type`, `system`, and `prop` namespaces attribute value. | ||
| - Pros - the `identifier-type`, `system`, and FedRAMP extension `@ns` share the same value, reducing confusion. | ||
| - Cons - this value is marked as a deprecated `identifier-type` in the NIST model, thus creating a misalignment between core OSCAL and FedRAMP OSCAL requirements. | ||
|
|
||
| 2. **Option 2** - require "http://fedramp.gov/ns/oscal" for `identifier-type`, `system`, and `prop`. | ||
| - Pros - this approach aligns with NIST allowed values for `identifier-type`, and has the added benefit of reducing confusion since all use the same FedRAMP URI value. | ||
| - Cons - this approach is likely to impact the community since FedRAMP extensions will all need to be updated (e.g., change "https" to "http" in existing FedRAMP OSCAL documents). OSCAL content generating tools will also be impacted by the `@ns` change for FedRAMP extensions. | ||
|
|
||
| 3. **Option 3** - require "https://fedramp.gov/ns/oscal" for `identifier-type`, `system`, and `prop` namespaces attribute value. | ||
| - Pros - perceived lesser impact on existing FedRAMP OSCAL documents and tools, as only the `identifier-type` would require change. | ||
| - Cons - this approach does not align with NIST allowed-value for `identifier-type` which may cause confusion, thus creating a misalignment between core OSCAL and FedRAMP OSCAL requirements. | ||
|
|
||
| 4. **Option 4** - go with "http://fedramp.gov/ns/oscal" for `identifier-type`, and "https://fedramp.gov/ns/oscal" for FedRAMP extension `prop` namespaces and `system`. | ||
| - Pros - this approach aligns with NIST OSCAL allowed value for `identifier-type`, while preserving the current FedRAMP extension `prop` namespace value. This requires no change to existing FedRAMP OSCAL content or tools. | ||
| - Cons - FedRAMP OSCAL practitioners may be confused by the minor, subtle difference in allowed values for `identifier-type`, `system` and FedRAMP extention `prop` namespaces. | ||
|
|
||
| ## Decision | ||
|
|
||
| Proceed with Option 2. The inconsistency in documentation and tooling was the source of a bug that initiated an investigation and led to this ADR. This change will have an impact on updating documentation for FedRAMP, but there is little evidence or public feedback to indicate one or more community-maintained tools warrant this concern. Alignment sooner rather than later by FedRAMP, who will operationalize the FedRAMP constraints, is a key factor to prioritize this change the soonest major release, not defer it until later. | ||
|
|
||
| ## Consequences | ||
|
|
||
| Option 2 is not backwards compatible, as it requires updates to existing FedRAMP documentation. However, it establishes a consistent and maintainable standard that will reduce ambiguity in the long term. Implementing this now also minimizes the risk of future misalignment. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
12 changes: 12 additions & 0 deletions
12
src/validations/constraints/content/ssp-fedramp-citations-has-correct-link-INVALID.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012"> | ||
| <back-matter> | ||
| <resource uuid="b246c9e4-057f-4e4d-89be-a9c9234ef387"> | ||
| <title>Digital Identity Worksheet</title> | ||
| <description> | ||
| <p>Digital Identity Determination Worksheet</p> | ||
| </description> | ||
| <prop name="type" value="citation" class="fedramp-citations"/> | ||
| <rlink href="./documents/digital-identity.xlsx" media-type="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"/> | ||
| </resource> | ||
| </back-matter> | ||
| </system-security-plan> |
141 changes: 141 additions & 0 deletions
141
src/validations/constraints/content/ssp-has-e-authentication-workflow-INVALID.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,141 @@ | ||
| <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012"> | ||
wandmagic marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| <back-matter> | ||
| <resource uuid="eeeeeeee-0000-4000-9000-00000000000e"> | ||
| <title>Access Control Policy</title> | ||
| <description> | ||
| <p>Detailed access control policy document</p> | ||
| </description> | ||
| <prop name="type" value="policy" ns="https://fedramp.gov/ns/oscal"/> | ||
| <rlink href="https://example.com/policies/access-control.pdf"/> | ||
| </resource> | ||
| <resource uuid="90a128ac-c850-48f6-8fff-a55692f80b41"> | ||
| <title>User's Guide</title> | ||
| <description> | ||
| <p>User's Guide</p> | ||
| </description> | ||
| <prop name="type" value="users-guide"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <rlink href="./documents/guides/sample_guide.pdf"/> | ||
| <remarks> | ||
| <p>Table 12-1 Attachments: User's Guide Attachment</p> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="489112e1-57f2-4c29-8dd0-95b1442fbf3b"> | ||
| <title>Document Title</title> | ||
| <description> | ||
| <p>Rules of Behavior</p> | ||
| </description> | ||
| <prop name="type" value="rules-of-behavior"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/rob.docx" media-type="application/msword"/> | ||
| <base64 filename="rob.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>Table 12-1 Attachments: Rules of Behavior (ROB)</p> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="c7860916-f2f4-43aa-b578-d48cf8e6d381"> | ||
| <title>Document Title</title> | ||
| <description> | ||
| <p>Contingency Plan (CP)</p> | ||
| </description> | ||
| <prop name="type" value="plan" class="information-system-contingency-plan"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/cp.docx" media-type="application/msword"/> | ||
| <base64 filename="cp.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>Table 12-1 Attachments: Contingency Plan (CP) Attachment</p> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="ab56cf27-0dae-40d6-89b7-d750137309af"> | ||
| <title>Document Title</title> | ||
| <description> | ||
| <p>Configuration Management (CM) Plan</p> | ||
| </description> | ||
| <prop name="type" value="plan" class="configuration-management-plan"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/CM_Plan.docx" media-type="application/msword"/> | ||
| <base64 filename="CM_Plan.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>Table 12-1 Attachments: Configuration Management (CM) Plan Attachment</p> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="3f771ab5-8016-4571-98d1-f0fb962e15e2"> | ||
| <title>Document Title</title> | ||
| <description> | ||
| <p>Incident Response (IR) Plan</p> | ||
| </description> | ||
| <prop name="type" value="plan" class="incident-response-plan"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/IR_Plan.docx" media-type="application/msword"/> | ||
| <base64 filename="IR_Plan.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>Table 12-1 Attachments: Incident Response (IR) Plan Attachment</p> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="49fb4631-1da2-41ca-b0b3-e1b1006d4025"> | ||
| <title>Separation of Duties Matrix</title> | ||
| <description> | ||
| <p>Separation of Duties Matrix</p> | ||
| </description> | ||
| <prop ns="https://fedramp.gov/ns/oscal" name="type" value="separation-of-duties-matrix"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/Sep_Matrix.docx" media-type="application/msword"/> | ||
| <base64 filename="Sep_Matrix.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="d2eb3c18-6754-4e3a-a933-03d289e3fad5"> | ||
| <title>Authorization Boundary</title> | ||
| <description> | ||
| <p>Authorization Boundary Diagram</p> | ||
| </description> | ||
| <prop ns="https://fedramp.gov/ns/oscal" name="type" value="plan"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/AuthBoundary.docx" media-type="application/msword"/> | ||
| <base64 filename="AuthBoundary.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="61081e81-850b-43c1-bf43-1ecbddcb9e7f"> | ||
| <title>Network Architecture</title> | ||
| <description> | ||
| <p>Network Architecture Diagram</p> | ||
| </description> | ||
| <prop ns="https://fedramp.gov/ns/oscal" name="type" value="plan"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/NetworkArchitecture.docx" media-type="application/msword"/> | ||
| <base64 filename="NetworkArchitecture.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| <resource uuid="ac5d7535-f3b8-45d3-bf3b-735c82c64547"> | ||
| <title>Data Flow</title> | ||
| <description> | ||
| <p>Data flow Diagram</p> | ||
| </description> | ||
| <prop ns="https://fedramp.gov/ns/oscal" name="type" value="plan"/> | ||
| <prop name="published" value="2023-01-01T00:00:00Z"/> | ||
| <prop name="version" value="Document Version"/> | ||
| <rlink href="./documents/Dataflo.docx" media-type="application/msword"/> | ||
| <base64 filename="Dataflow.docx" media-type="application/msword">00000000</base64> | ||
| <remarks> | ||
| <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>.</p> | ||
| </remarks> | ||
| </resource> | ||
| </back-matter> | ||
| </system-security-plan> | ||
4 changes: 4 additions & 0 deletions
4
src/validations/constraints/content/ssp-has-fedramp-citations-INVALID.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| <system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012"> | ||
wandmagic marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| <back-matter> | ||
| </back-matter> | ||
| </system-security-plan> | ||
14 changes: 0 additions & 14 deletions
14
src/validations/constraints/content/ssp-has-separation-of-duties-matrix-INVALID.xml
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Blocking: remove with its constraint.