Skip to content

Commit

Permalink
introduce missing-response-components constraint (GSA#688)
Browse files Browse the repository at this point in the history 
* introduce missing-response-components constraint

* Add review feedback from AJ before merge

---------

Co-authored-by: A.J. Stein <[email protected]>
  • Loading branch information
@wandmagic @aj-stein-gsa @Rene2mt
2 people authored and Rene2mt committed Sep 27, 2024
1 parent 49b7ecd commit 5d331f0
Show file tree
Hide file tree
Showing 2 changed files with 198 additions and 0 deletions.
190 changes: 190 additions & 0 deletions src/validations/constraints/content/ssp-missing-by-component-INVALID.xml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,190 @@
<?xml version="1.0" encoding="UTF-8"?>
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
uuid="12345678-1234-4321-8765-123456789012">
<metadata>
<title>Enhanced Example System Security Plan</title>
<published>2024-08-01T14:30:00Z</published>
<last-modified>2024-08-01T14:30:00Z</last-modified>
<version>1.1</version>
<oscal-version>1.0.0</oscal-version>
<document-id scheme="https://example.com/identifiers">SSP-2024-002</document-id>

<role id="creator">
<title>Document Creator</title>
</role>
<role id="content-approver">
<title>Content Approver</title>
</role>
<role id="system-admin">
<title>System Administrator</title>
</role>
<role id="asset-owner">
<title>Asset Owner</title>
</role>
<location uuid="11111112-0000-4000-9001-000000000009">
<address >
<country>WRONG</country>
</address>
<prop name='data-center' value='dc-zone-1' class='tertiary' ns="https://fedramp.gov/ns/oscal"/>
</location>
<party uuid="11111111-0000-4000-9000-000000000001" type="organization">
<name>Example Organization</name>
<short-name>ExOrg</short-name>
<link rel="website" href="https://example.com"/>
<address type="unsupported-type" />
</party>
<party uuid="22222222-0000-4000-9000-000000000002" type="person">
<name>Jane Doe</name>
<email-address>[email protected]</email-address>
<address type="unsupported-type" />
</party>

<responsible-party role-id="creator">
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
</responsible-party>
<responsible-party role-id="content-approver">
<party-uuid>22222222-0000-4000-9000-000000000002</party-uuid>
</responsible-party>

<remarks>
<p>This SSP is an example for demonstration purposes.</p>
</remarks>
</metadata>

<import-profile href="https://raw.githubusercontent.com/GSA/fedramp-automation/master/dist/content/rev5/baselines/xml/FedRAMP_rev5_HIGH-baseline-resolved-profile_catalog.xml"/>

<system-characteristics>
<system-id identifier-type="https://fedramp.gov">F00000001</system-id>
<system-name>Enhanced Example System</system-name>
<description>
<p>This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.</p>
</description>
<prop name='cloud-service-model' value='unsupported-model' ns="https://fedramp.gov/ns/oscal"/>
<prop name='cloud-deployment-model' value='unsupported-value' ns="https://fedramp.gov/ns/oscal"/>
<prop name='authorization-type' value='unsupported-value' ns="https://fedramp.gov/ns/oscal"/>
<security-sensitivity-level>moderate</security-sensitivity-level>
<system-information>
<information-type uuid="33333333-0000-4000-9000-000000000003">
<title>Financial Information</title>
<description>
<p>Contains sensitive financial data related to organizational operations.</p>
</description>
<categorization system="https://unsupported-system.com">
<information-type-id>C.2.8.12</information-type-id>
</categorization>
<confidentiality-impact>
<base>high</base>
</confidentiality-impact>
<integrity-impact>
<base>moderate</base>
</integrity-impact>
<availability-impact>
<base>low</base>
</availability-impact>
</information-type>
</system-information>

<security-impact-level>
<security-objective-confidentiality>moderate</security-objective-confidentiality>
<security-objective-integrity>moderate</security-objective-integrity>
<security-objective-availability>moderate</security-objective-availability>
</security-impact-level>

<status state="operational"/>

<authorization-boundary>
<description>
<p>The authorization boundary includes all components within the main data center and the disaster recovery site.</p>
</description>
</authorization-boundary>
</system-characteristics>

<system-implementation>
<user uuid="44444444-0000-4000-9000-000000000004">
<title>System Administrator</title>
<prop name="type" value="unsupported-type"/>
<prop name="privilege-level" value="unsupported-access-type"/>
<role-id>system-admin</role-id>
</user>

<component uuid="55555555-0000-4000-9000-000000000005" type="unsupported-component-type">
<title>Primary Application Server</title>
<description>
<p>Main application server hosting the core system functionality.</p>
</description>
<purpose>main line</purpose>
<status state="operational"/>
<responsible-role role-id="system-admin">
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
</responsible-role>
<remarks>
<p>This is the primary application server for the system.</p>
</remarks>
</component>

<component uuid="66666666-0000-4000-9000-000000000006" type="interconnection">
<title>External API Connection</title>
<description>
<p>Secure connection to an external API for data enrichment.</p>
</description>
<prop name="interconnection-direction" value="unsupported-direction" ns="https://fedramp.gov/ns/oscal"/>
<prop name="interconnection-security" value="unsupported-security" ns="https://fedramp.gov/ns/oscal"/>
<status state="operational"/>
<responsible-role role-id="system-admin">
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
</responsible-role>
<remarks>
<p>This connection is used for secure data exchange with external systems.</p>
</remarks>
</component>

<inventory-item uuid="77777777-0000-4000-9000-000000000007">
<description>
<p>Primary database server</p>
</description>
<prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
<prop name="asset-type" value="database"/>
<prop name="allows-authenticated-scan" value="unsupported-scan"/>
<prop name="public" value="unsupported-public"/>
<prop name="virtual" value="unsupported-virtual"/>
<prop name="scan-type" value="unsupported-scan-type" ns="https://fedramp.gov/ns/oscal"/>
<responsible-party role-id="asset-owner">
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
</responsible-party>
<implemented-component component-uuid="55555555-0000-4000-9000-000000000005">
<prop name="asset-id" value="DB-001" ns="http://csrc.nist.gov/ns/oscal"/>
</implemented-component>
</inventory-item>
</system-implementation>

<control-implementation>
<description>
<p>Implementation of controls for the Enhanced Example System</p>
</description>
<implemented-requirement uuid="88888888-0000-4000-9000-000000000008" control-id="ac-1">
<prop name="control-origination" value="unsupported-origination" ns="https://fedramp.gov/ns/oscal"/>
<prop name="implementation-status" value="unsupported-status" ns="https://fedramp.gov/ns/oscal"/>
<statement statement-id="ac-1_stmt.a" uuid="99999999-0000-4000-9000-000000000009">
</statement>
</implemented-requirement>

<implemented-requirement uuid="bbbbbbbb-0000-4000-9000-00000000000b" control-id="cm-8">
<prop name="control-origination" value="unsupported-origination" ns="https://fedramp.gov/ns/oscal"/>
<statement statement-id="cm-8_stmt.a" uuid="cccccccc-0000-4000-9000-00000000000c">
</statement>
</implemented-requirement>
</control-implementation>

<back-matter>
<resource uuid="eeeeeeee-0000-4000-9000-00000000000e">
<!-- There is no <title/> to purposefully to trigger an error for negative testing. -->
<description>
<p>Detailed access control policy document</p>
</description>
<prop name="type" value="unsupported-type" ns="https://fedramp.gov/ns/oscal"/>
<!-- There is no <rlink/> to purposefully to trigger an error for negative testing. -->
</resource>
</back-matter>
</system-security-plan>
8 changes: 8 additions & 0 deletions src/validations/constraints/fedramp-external-constraints.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -170,4 +170,12 @@
</expect>
</constraints>
</context>
<context>
<metapath target="/system-security-plan/control-implementation"/>
<constraints>
<expect id="missing-response-components" target="implemented-requirement" test="count(./by-component) gt 0">
<message>Each implemented requirement must have at least one by-component reference to the source component implementing it.</message>
</expect>
</constraints>
</context>
</metaschema-meta-constraints>

0 comments on commit 5d331f0

Please sign in to comment.