diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature index 940766489..a077d5966 100644 --- a/features/fedramp_extensions.feature +++ b/features/fedramp_extensions.feature @@ -133,6 +133,8 @@ Examples: | resource-has-title-PASS.yaml | | response-point-FAIL.yaml | | response-point-PASS.yaml | + | responsible-party-is-person-FAIL.yaml | + | responsible-party-is-person-PASS.yaml | | role-defined-authorizing-official-poc-FAIL.yaml | | role-defined-authorizing-official-poc-PASS.yaml | | role-defined-information-system-security-officer-FAIL.yaml | @@ -221,6 +223,7 @@ Examples: | prop-response-point-has-cardinality-one | | resource-has-base64-or-rlink | | resource-has-title | + | responsible-party-is-person | | role-defined-authorizing-official-poc | | role-defined-information-system-security-officer | | role-defined-system-owner | diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml index 65ae0a7cf..a3a299a3a 100644 --- a/src/validations/constraints/content/ssp-all-VALID.xml +++ b/src/validations/constraints/content/ssp-all-VALID.xml @@ -33,6 +33,24 @@ Information System Security Officer (or Equivalent) + + Information System Management Point of Contact (POC) + +

The highest level manager who is responsible for system operation on behalf of the System Owner.

+
+
+ + Information System Technical Point of Contact + +

The individual or individuals leading the technical operation of the system.

+
+
+ + General Point of Contact (POC) + +

A general point of contact for the system, designated by the system owner.

+
+
@@ -63,6 +81,29 @@ 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + +

This SSP is an example for demonstration purposes.

diff --git a/src/validations/constraints/content/ssp-responsible-party-is-person-INVALID.xml b/src/validations/constraints/content/ssp-responsible-party-is-person-INVALID.xml new file mode 100644 index 000000000..321c778df --- /dev/null +++ b/src/validations/constraints/content/ssp-responsible-party-is-person-INVALID.xml @@ -0,0 +1,83 @@ + + + + Enhanced Example System Security Plan + 2024-08-01T14:30:00Z + 2024-08-01T14:30:00Z + 1.1 + 1.0.0 + SSP-2024-002 + + + Document Creator + + + Content Approver + + + System Administrator + + + Asset Owner + + + Information System Management Point of Contact (POC) + +

The highest level manager who responsible for system operation on behalf of the System Owner.

+
+
+ + Information System Technical Point of Contact + +

The individual or individuals leading the technical operation of the system.

+
+
+ + General Point of Contact (POC) + +

A general point of contact for the system, designated by the system owner.

+
+
+ +
+ US +
+ +
+ + Example Organization + ExOrg + +
+ + + Jane Doe + jane.doe@example.com +
+ + + + 11111111-0000-4000-9000-000000000001 + + + 22222222-0000-4000-9000-000000000002 + + + + 11111111-0000-4000-9000-000000000001 + + + 11111111-0000-4000-9000-000000000001 + + + 11111111-0000-4000-9000-000000000001 + + + +

This SSP is an example for demonstration purposes.

+
+ + \ No newline at end of file diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index dd1b78c23..9058088c6 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -181,6 +181,16 @@ There must be one or more alternate data center(s). + + Index of parties of type "person". + This index is a list of the UUIDs of all of the parties that are type "person" in the document. + + + + + + For roles 'system-owner' and 'information-system-security-officer', the responsible-role party must be a party of type 'person'. + A FedRAMP SSP must define the system owner role. diff --git a/src/validations/constraints/unit-tests/responsible-party-is-person-FAIL.yaml b/src/validations/constraints/unit-tests/responsible-party-is-person-FAIL.yaml new file mode 100644 index 000000000..3f2f521b1 --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-is-person-FAIL.yaml @@ -0,0 +1,8 @@ +# driver for the responsible party is person unit test +test-case: + name: Negative Test for responsible-party-is-person + description: This test case validates the behavior of constraint responsible-party-is-person + content: ssp-responsible-party-is-person-INVALID.xml + expectations: + - constraint-id: responsible-party-is-person + result: fail diff --git a/src/validations/constraints/unit-tests/responsible-party-is-person-PASS.yaml b/src/validations/constraints/unit-tests/responsible-party-is-person-PASS.yaml new file mode 100644 index 000000000..3ec84a236 --- /dev/null +++ b/src/validations/constraints/unit-tests/responsible-party-is-person-PASS.yaml @@ -0,0 +1,8 @@ +# driver for the responsible party is person unit test +test-case: + name: Positive Test for responsible-party-is-person + description: This test case validates the behavior of constraint responsible-party-is-person + content: ../content/ssp-all-VALID.xml + expectations: + - constraint-id: responsible-party-is-person + result: pass