How to edit front-matter (non-control data)?

[aj-stein-nist]

Hello, I am trying to use the trestle author ssp and trestle assemble ssp functionality to begin authoring a system security plan in OSCAL for a project. How can I define and update things in the beginning of a system security plan:

1. Information System Name
2. Impact Level
3. Information Types

Essentially, anything that is in the system-characteristics.

The website says to contact maintainers with questions , so ... @fsuits?

[fsuits]

Hi @aj-stein-nist -

There are multiple changes going on in the SSP workflow, but the quick answer is that markdown will only allow editing of a subset of the OSCAL models and other details will need to be edited directly in the JSON - possibly with help from other trestle functionality such as split and merge.

The additional pending change is that currently some of the -assemble tools will assemble into a fresh model, which means you would need to re-edit to add anything to it. That should be changed shortly so that -assemble will optionally take an existing JSON model and replace its relevant contents from markdown while keeping other things the same.

Some additional work may be needed to retain the info in SystemCharacteristics but I will raise an issue for that.

In summary - right now I think you would need to edit the json to update those things each time you assemble - but the goal is to edit json once and have the info retained.

I will raise the issue for this - so please add comments if needed.

Thanks!

[rahearn]

@fsuits is this answer still accurate today (I think the caveats about re-editing have been addressed in the meantime, at least)?

My goal is that any SSP content that a normal developer might find useful should live in a markdown file to be assembled into JSON with ssp-assemble. That would obviously include parts of SystemCharacteristics and SystemImplementation. Is extending ssp-generate and ssp-assemble to include those parts something that is either already on the roadmap or something that would be welcomed as a PR?

[AleJo2995]

Hi @rahearn ! Thanks for your reply in the first place. Just fyi, Frank Suits is no longer involved with the project, so feel free to start directing your questions to me whenever you want. So far we haven't got that considered to be part of the roadmap and it seems the issue never actually got created. We definitely encourage and welcome users to create PR's whenever they you fit a good use case. So, if you want to can make your case there and tag us as reviewers. @vikas-agarwal76 just tagging you in case you know about this behavior change?

[rahearn]

@AleJo2995 thanks - for now we're sticking with the tried and true split/merge/json editing workflow already supported, but if we have time to dive into tooling I'll be sure to open an issue for feedback on a proposed solution before I dive too deeply into an implementation.

[jpower432]

@rahearn This issue might be of interest to you - #1539. Is it smaller in scope than the requirement you brought forth, but I think that since it expands the capability of what trestle author commands will allows users to edit (i.e. not control driven data), they would be related and may have similar solutions.

[rahearn]

@jpower432 yes, 1539 looks to be going down exactly the same path I'm looking for for basically all of the major sections. Excited to see how this develops and find a place I can help out