diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature index b056baaed..3f685de97 100644 --- a/features/fedramp_extensions.feature +++ b/features/fedramp_extensions.feature @@ -92,7 +92,6 @@ Examples: | has-rules-of-behavior | | has-security-impact-level | | has-security-sensitivity-level | - | has-separation-of-duties-matrix | | has-system-id | | has-system-name-short | | has-user-guide | @@ -299,8 +298,6 @@ Examples: | has-security-impact-level-PASS.yaml | | has-security-sensitivity-level-FAIL.yaml | | has-security-sensitivity-level-PASS.yaml | - | has-separation-of-duties-matrix-FAIL.yaml | - | has-separation-of-duties-matrix-PASS.yaml | | has-system-id-FAIL.yaml | | has-system-id-PASS.yaml | | has-system-name-short-FAIL.yaml | diff --git a/features/steps/fedramp_extensions_steps.ts b/features/steps/fedramp_extensions_steps.ts index 04524393b..052ea7594 100644 --- a/features/steps/fedramp_extensions_steps.ts +++ b/features/steps/fedramp_extensions_steps.ts @@ -421,7 +421,7 @@ async function checkConstraints( `The content may need adjustment to properly test this constraint.` ); } - !quiet && console.error(formatSarifOutput(sarifOutput)) + !quiet && console.error(formatSarifOutput({version:'2.1.0',runs:[{results:constraintResults,tool:{driver:{name:"oscal-cli"}}}]})) errors.push(""); // Add a blank line for readability } } diff --git a/src/validations/constraints/content/ssp-extraneous-implemented-requirements-VALID.oscal.xml b/src/validations/constraints/content/ssp-extraneous-implemented-requirements-VALID.oscal.xml new file mode 100644 index 000000000..3045c71ee --- /dev/null +++ b/src/validations/constraints/content/ssp-extraneous-implemented-requirements-VALID.oscal.xml @@ -0,0 +1,19 @@ + + + + Enhanced Example System Security Plan + 2024-08-01T14:30:00Z + 2024-08-01T14:30:00Z + 1.1 + 1.1.2 + SSP-2024-002 + + + + + + + diff --git a/src/validations/constraints/content/ssp-has-data-flow-diagram-link-href-target-VALID-2.xml b/src/validations/constraints/content/ssp-has-data-flow-diagram-link-href-target-VALID-2.xml new file mode 100644 index 000000000..330b13e6a --- /dev/null +++ b/src/validations/constraints/content/ssp-has-data-flow-diagram-link-href-target-VALID-2.xml @@ -0,0 +1,466 @@ + + + + Enhanced Example System Security Plan + 2024-08-01T14:30:00Z + 2024-08-01T14:30:00Z + 1.1 + 1.1.2 + SSP-2024-002 + + + + Document Creator + + + Content Approver + + + System Administrator + + + Asset Owner + + + System Owner + + + Authorizing Official Point of Contact + + + Information System Security Officer (or Equivalent) + + + Information System Management Point of Contact (POC) + +

The highest level manager who is responsible for system operation on behalf of the System Owner.

+ + + + Information System Technical Point of Contact + +

The individual or individuals leading the technical operation of the system.

+ + + + General Point of Contact (POC) + +

A general point of contact for the system, designated by the system owner.

+ + + + +
+ US +
+ + + +
+ US +
+ + + + Example Organization + ExOrg + + + + Jane Doe + jane.doe@example.com +
+ + + + 11111111-0000-4000-9000-000000000001 + + + 22222222-0000-4000-9000-000000000002 + + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + +

This SSP is an example for demonstration purposes.

+ + + + + + + F00000001 + Enhanced Example System + System's Short Name or Acronym + +

This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.

+ + + + + + + + fips-199-moderate + + + Financial Information + +

Contains sensitive financial data related to organizational operations.

+ + + C.2.8.12 + + + fips-199-high + fips-199-high + + + + fips-199-moderate + fips-199-low + +

Required if the base and selected values do not match.

+ + + + fips-199-high + fips-199-low + +

Required if the base and selected values do not match.

+ + + + + + fips-199-moderate + fips-199-moderate + fips-199-moderate + + + + +

The authorization boundary includes all components within the main data center and the disaster recovery site.

+ + + +

A diagram-specific explanation.

+ + + Authorization Boundary Diagram + + + + +

A holistic, top-level explanation of the network architecture.

+ + + +

A diagram-specific explanation.

+ + + Network Diagram + + + + +

A holistic, top-level explanation of the system's data flows.

+ + + +

A diagram-specific explanation.

+ + + + Data Flow Diagram + + + + + + + System Administrator + + + + system-admin + + Admin +

admin user

 + administration + + + + + + Primary Application Server + +

Main application server hosting the core system functionality.

+ + main line + + + 11111111-0000-4000-9000-000000000001 + + +

This is the primary application server for the system.

+ + + + + External API Connection + +

Secure connection to an external API for data enrichment.

+ + + + + + 11111111-0000-4000-9000-000000000001 + + +

This connection is used for secure data exchange with external systems.

+ + + + + +

Primary database server

+ + + + + + + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + + +

Implementation of controls for the Enhanced Example System

+ + + + + + + + +

Access Control Policy and Procedures (AC-1) is fully implemented in our system.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + + + +

Information System Component Inventory (CM-8) is partially implemented.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + Access Control Policy + +

Detailed access control policy document

+ + + + + + User's Guide + +

User's Guide

+ + + + + +

Table 12-1 Attachments: User's Guide Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Rules of Behavior

+ + + + + + 00000000 + +

Table 12-1 Attachments: Rules of Behavior (ROB)

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Contingency Plan (CP)

+ + + + + + 00000000 + +

Table 12-1 Attachments: Contingency Plan (CP) Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Configuration Management (CM) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Configuration Management (CM) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Incident Response (IR) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Incident Response (IR) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Separation of Duties Matrix + +

Separation of Duties Matrix

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + + Authorization Boundary + +

Authorization Boundary Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + Network Architecture + +

Network Architecture Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + Data Flow + +

Data flow Diagram

+ + + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + Data Flow-2 + +

Data flow Diagram

+ + + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + + + diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index 9432986fc..491415452 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -64,7 +64,11 @@ - + + + + + Component Has Authentication Method @@ -80,21 +84,34 @@ A FedRAMP SSP MUST have each component describing leveraged systems, interconnections, or authorized services identify a "provider" role that references one responsible party. - - Has Authorization Boundary Diagram Link Href Target - - A FedRAMP SSP MUST include an authorization boundary diagram. - - + + Has Authorization Boundary Diagram Link Href Target + + A FedRAMP SSP MUST include at least one valid authorization boundary diagram. Each diagram resource must have a prop element with name="type" and either value="image" or value="diagram", and class="authorization-boundary". + + + Has Data Flow Diagram Link Href Target - A FedRAMP SSP MUST include a data flow diagram. - - - Has Network Architecture Diagram Link Href Target - - A FedRAMP SSP MUST include a network architecture diagram. - + A FedRAMP SSP MUST include at least one valid data flow diagram. + + + Has Network Architecture Diagram Link Href Target + + A FedRAMP SSP MUST include at least one valid network architecture diagram. Each diagram resource must have a prop element with name="type" and either value="image" or value="diagram", and class="network-architecture". + Import Profile has available document diff --git a/src/validations/constraints/unit-tests/extraneous-implemented-requirements-PASS.yaml b/src/validations/constraints/unit-tests/extraneous-implemented-requirements-PASS.yaml index 33e78fc2b..64f86ef5e 100644 --- a/src/validations/constraints/unit-tests/extraneous-implemented-requirements-PASS.yaml +++ b/src/validations/constraints/unit-tests/extraneous-implemented-requirements-PASS.yaml @@ -3,7 +3,9 @@ test-case: description: >- This test case validates the behavior of constraint extraneous-implemented-requirements - content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml + content: + - ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml + - ../content/ssp-extraneous-implemented-requirements-VALID.oscal.xml expectations: - constraint-id: extraneous-implemented-requirements result: pass diff --git a/src/validations/constraints/unit-tests/has-data-flow-diagram-link-href-target-PASS.yaml b/src/validations/constraints/unit-tests/has-data-flow-diagram-link-href-target-PASS.yaml index 1a5a51981..994ca2e7e 100644 --- a/src/validations/constraints/unit-tests/has-data-flow-diagram-link-href-target-PASS.yaml +++ b/src/validations/constraints/unit-tests/has-data-flow-diagram-link-href-target-PASS.yaml @@ -6,6 +6,7 @@ test-case: Scenario 2: Tests a link provided directly in the @href. content: - ../content/ssp-has-data-flow-diagram-link-href-target-VALID-1.xml + - ../content/ssp-has-data-flow-diagram-link-href-target-VALID-2.xml expectations: - constraint-id: has-data-flow-diagram-link-href-target result: pass