From 645b2417965fedbd47ffa363115a69ce9b2fa56a Mon Sep 17 00:00:00 2001 From: Chris Compton <107055718+Compton-NIST@users.noreply.github.com> Date: Wed, 8 Mar 2023 09:16:46 -0600 Subject: [PATCH 1/2] Initiating an effort for customer responsibility model research. --- .../effort-responsibility-sharing/README.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 research-2023/effort-responsibility-sharing/README.md diff --git a/research-2023/effort-responsibility-sharing/README.md b/research-2023/effort-responsibility-sharing/README.md new file mode 100644 index 0000000..853ecf5 --- /dev/null +++ b/research-2023/effort-responsibility-sharing/README.md @@ -0,0 +1,25 @@ +# Define: An Approach to Communicating Responsibilities and Inheritance in OSCAL + +> Status: Initiation + +## Problem Statement + +OSCAL SSP authors need the ability to export content from a full SSP, suitable for customers to import into another SSP, without exposing all content of the full SSP. At a minimum, this exported content should include customer responsibility statements associated with components and control definition statements. When the SSP author uses optional syntax to define customer-consumable content about what is inherited, this content must also be included. + +- [Original Issue](https://github.com/usnistgov/OSCAL/issues/722) + +## Spirals + +- Not Started + +## Summary + +N/A + +## Presented + +N/A + +## Feedback + +N/A \ No newline at end of file From 4e41c79be5a7e58153c1c4e9fc029e830de0daa1 Mon Sep 17 00:00:00 2001 From: Chris Compton Date: Thu, 9 Mar 2023 07:39:20 -0600 Subject: [PATCH 2/2] Apply feedback for problem statement. --- research-2023/effort-responsibility-sharing/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/research-2023/effort-responsibility-sharing/README.md b/research-2023/effort-responsibility-sharing/README.md index 853ecf5..21c618d 100644 --- a/research-2023/effort-responsibility-sharing/README.md +++ b/research-2023/effort-responsibility-sharing/README.md @@ -4,7 +4,7 @@ ## Problem Statement -OSCAL SSP authors need the ability to export content from a full SSP, suitable for customers to import into another SSP, without exposing all content of the full SSP. At a minimum, this exported content should include customer responsibility statements associated with components and control definition statements. When the SSP author uses optional syntax to define customer-consumable content about what is inherited, this content must also be included. +OSCAL SSP authors need the ability to export particular content pertaining to controls that can be inherited by another system, without exposing all content of the full SSP or of those inheritable controls. This exported content must be suitable for customers to import into a new SSP of the system which inherits controls. - [Original Issue](https://github.com/usnistgov/OSCAL/issues/722)