From 645f03e694786ccb0d4c9eb1f20f295ddafc7712 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Thu, 16 May 2024 13:08:38 -0400
Subject: [PATCH 01/36] Fix team mentions

---
 .github/workflows/account_request_approve.yaml   | 2 +-
 .github/workflows/account_request_authorize.yaml | 2 +-
 .github/workflows/account_request_open.yaml      | 4 ++--
 .github/workflows/account_request_reject.yaml    | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index a729ebc..b34b17c 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -21,4 +21,4 @@ jobs:
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
             Account management request APPROVED by Blossom Management.
-            @blossom-sysdevs please review and submit Account Management Authorization Form.
\ No newline at end of file
+            @usnistgov/blossom-sysdevs please review, implement, and submit Account Management Authorization Form.
\ No newline at end of file
diff --git a/.github/workflows/account_request_authorize.yaml b/.github/workflows/account_request_authorize.yaml
index 4753e0a..45e0390 100644
--- a/.github/workflows/account_request_authorize.yaml
+++ b/.github/workflows/account_request_authorize.yaml
@@ -21,7 +21,7 @@ jobs:
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
-            Account management AUTHORIZED
+            @usnistgov/blossom-management An approved account modification has been implemented.
 
 
 # Contact AWS Cognito to show users
diff --git a/.github/workflows/account_request_open.yaml b/.github/workflows/account_request_open.yaml
index 35d4fa2..8071943 100644
--- a/.github/workflows/account_request_open.yaml
+++ b/.github/workflows/account_request_open.yaml
@@ -22,5 +22,5 @@ jobs:
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
             Account management request CREATED.
-            @blossom-management please review and approve/reject this request 
-            by adding ACCOUNT_APPROVED or ACCOUNT_REJECTED label.
\ No newline at end of file
+            @usnistgov/blossom-management please review and approve/reject this request 
+            by adding ACCOUNT_APPROVED or ACCOUNT_REJECTED label to this issue.
\ No newline at end of file
diff --git a/.github/workflows/account_request_reject.yaml b/.github/workflows/account_request_reject.yaml
index 5454ca2..ffc2812 100644
--- a/.github/workflows/account_request_reject.yaml
+++ b/.github/workflows/account_request_reject.yaml
@@ -14,7 +14,7 @@ jobs:
       issues: write
     steps:
       - name: Close rejected account request
-        run: gh issue close "$NUMBER" --comment "$COMMENT"
+        run: gh issue close "$NUMBER" --comment "$COMMENT" --reason "not planned"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}

From 742cc343e05b08ef96b1933be70beae026475beb Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Tue, 21 May 2024 16:40:43 -0400
Subject: [PATCH 02/36] Close approved account request

---
 .github/workflows/account_request_approve.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index b34b17c..a5fd078 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -14,11 +14,12 @@ jobs:
       issues: write
     steps:
       - name: Notify Blossom Sysdevs about Approved Account
-        run: gh issue comment "$NUMBER" --body "$BODY"
+        run: gh issue close "$NUMBER" --comment "$COMMENT" --reason "completed"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
-          BODY: >
+          COMMENT: >
             Account management request APPROVED by Blossom Management.
-            @usnistgov/blossom-sysdevs please review, implement, and submit Account Management Authorization Form.
\ No newline at end of file
+            @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.
+            Then submit the [Account Management Authorization Form](https://github.com/usnistgov/blossom-oscal/issues/new?assignees=&labels=ACCOUNT_AUTHORIZED_RECORD&projects=&template=account_management_authorization_form.yaml)
\ No newline at end of file

From 3d61e7ca2974c941856781638cc2f57361180a9f Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Tue, 21 May 2024 16:57:15 -0400
Subject: [PATCH 03/36] Change to ubuntu latest

---
 .github/workflows/account_request_approve.yaml   | 2 +-
 .github/workflows/account_request_authorize.yaml | 2 +-
 .github/workflows/account_request_open.yaml      | 2 +-
 .github/workflows/account_request_reject.yaml    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index a5fd078..8ba1569 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -9,7 +9,7 @@ jobs:
   # When ACCOUNT_APPROVED label is added to account management request
   request-approved:
     if: github.event.label.name == 'ACCOUNT_APPROVED'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:
diff --git a/.github/workflows/account_request_authorize.yaml b/.github/workflows/account_request_authorize.yaml
index 45e0390..3ea1a1b 100644
--- a/.github/workflows/account_request_authorize.yaml
+++ b/.github/workflows/account_request_authorize.yaml
@@ -10,7 +10,7 @@ jobs:
   # Label of account management request form is ACCOUNT_AUTHORIZED_RECORD
   request-authorized:
     if: github.event.label.name == 'ACCOUNT_AUTHORIZED_RECORD'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:
diff --git a/.github/workflows/account_request_open.yaml b/.github/workflows/account_request_open.yaml
index 8071943..aba78e1 100644
--- a/.github/workflows/account_request_open.yaml
+++ b/.github/workflows/account_request_open.yaml
@@ -10,7 +10,7 @@ jobs:
   # Label of account management request form is ACCOUNT_REQUEST_RECORD
   request-opened:
     if: github.event.label.name == 'ACCOUNT_REQUEST_RECORD'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:
diff --git a/.github/workflows/account_request_reject.yaml b/.github/workflows/account_request_reject.yaml
index ffc2812..c3bce19 100644
--- a/.github/workflows/account_request_reject.yaml
+++ b/.github/workflows/account_request_reject.yaml
@@ -9,7 +9,7 @@ jobs:
   # When ACCOUNT_REJECTED label is added to account management request
   request-rejected:
     if: github.event.label.name == 'ACCOUNT_REJECTED'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:

From 48d7488ecfb72371d1593927267697404f4f37c6 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Thu, 23 May 2024 11:20:08 -0400
Subject: [PATCH 04/36] Newline and close

---
 .github/workflows/account_request_approve.yaml | 4 ++--
 .github/workflows/account_request_open.yaml    | 2 +-
 .github/workflows/account_request_reject.yaml  | 4 ++--
 account_workflow.md                            | 8 ++++----
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index 8ba1569..a608be6 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -20,6 +20,6 @@ jobs:
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
           COMMENT: >
-            Account management request APPROVED by Blossom Management.
-            @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.
+            Account management request APPROVED by Blossom Management. Closing request as "completed".\
+            @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.\
             Then submit the [Account Management Authorization Form](https://github.com/usnistgov/blossom-oscal/issues/new?assignees=&labels=ACCOUNT_AUTHORIZED_RECORD&projects=&template=account_management_authorization_form.yaml)
\ No newline at end of file
diff --git a/.github/workflows/account_request_open.yaml b/.github/workflows/account_request_open.yaml
index aba78e1..983c73c 100644
--- a/.github/workflows/account_request_open.yaml
+++ b/.github/workflows/account_request_open.yaml
@@ -21,6 +21,6 @@ jobs:
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
-            Account management request CREATED.
+            Account management request CREATED.\
             @usnistgov/blossom-management please review and approve/reject this request 
             by adding ACCOUNT_APPROVED or ACCOUNT_REJECTED label to this issue.
\ No newline at end of file
diff --git a/.github/workflows/account_request_reject.yaml b/.github/workflows/account_request_reject.yaml
index c3bce19..c985068 100644
--- a/.github/workflows/account_request_reject.yaml
+++ b/.github/workflows/account_request_reject.yaml
@@ -20,5 +20,5 @@ jobs:
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
           COMMENT: >
-            Account management request REJECTED by Blossom Management.
-            Closing request.
+            Account management request REJECTED by Blossom Management.\
+            Closing request as "not planned".
diff --git a/account_workflow.md b/account_workflow.md
index f3f7244..b814f97 100644
--- a/account_workflow.md
+++ b/account_workflow.md
@@ -1,8 +1,8 @@
 # Account Management Workflow
 Document that explains the workflow of GitHub actions used to automate account management.
 
-The requester creates a new GitHub issue (Account Request Form) to request an account for the Account Holder.
-The Blossom Management group is automatically notified to review this request through GitHub.
-A Blossom Management member reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED
-If ACCOUNT_APPROVED, the Blossom Sysdevs group is automatically notified to implement the account and submit a new issue (Account Management Authorization Form) for the Account Holder.
+The requester creates a new GitHub issue (Account Request Form) to request an account for the Account Holder.\
+The Blossom Management group is automatically notified to review this request through GitHub.\
+A Blossom Management member reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED\
+If ACCOUNT_APPROVED, the Blossom Sysdevs group is automatically notified to implement the account and submit a new issue (Account Management Authorization Form) for the Account Holder.\
 If ACCOUNT_REJECTED, the account request issue is automatically closed.
\ No newline at end of file

From 50f24eede1bebf4a63d7a8add42f25edb17a2e22 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Tue, 4 Jun 2024 12:27:28 -0400
Subject: [PATCH 05/36] Revert back to Ubuntu 20.04

---
 .github/workflows/account_request_approve.yaml   | 2 +-
 .github/workflows/account_request_authorize.yaml | 2 +-
 .github/workflows/account_request_open.yaml      | 2 +-
 .github/workflows/account_request_reject.yaml    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index a608be6..fd0f4a3 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -9,7 +9,7 @@ jobs:
   # When ACCOUNT_APPROVED label is added to account management request
   request-approved:
     if: github.event.label.name == 'ACCOUNT_APPROVED'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     permissions:
       issues: write
     steps:
diff --git a/.github/workflows/account_request_authorize.yaml b/.github/workflows/account_request_authorize.yaml
index 3ea1a1b..45e0390 100644
--- a/.github/workflows/account_request_authorize.yaml
+++ b/.github/workflows/account_request_authorize.yaml
@@ -10,7 +10,7 @@ jobs:
   # Label of account management request form is ACCOUNT_AUTHORIZED_RECORD
   request-authorized:
     if: github.event.label.name == 'ACCOUNT_AUTHORIZED_RECORD'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     permissions:
       issues: write
     steps:
diff --git a/.github/workflows/account_request_open.yaml b/.github/workflows/account_request_open.yaml
index 983c73c..5640336 100644
--- a/.github/workflows/account_request_open.yaml
+++ b/.github/workflows/account_request_open.yaml
@@ -10,7 +10,7 @@ jobs:
   # Label of account management request form is ACCOUNT_REQUEST_RECORD
   request-opened:
     if: github.event.label.name == 'ACCOUNT_REQUEST_RECORD'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     permissions:
       issues: write
     steps:
diff --git a/.github/workflows/account_request_reject.yaml b/.github/workflows/account_request_reject.yaml
index c985068..a0e7e3b 100644
--- a/.github/workflows/account_request_reject.yaml
+++ b/.github/workflows/account_request_reject.yaml
@@ -9,7 +9,7 @@ jobs:
   # When ACCOUNT_REJECTED label is added to account management request
   request-rejected:
     if: github.event.label.name == 'ACCOUNT_REJECTED'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     permissions:
       issues: write
     steps:

From 0d0b1826c9456a6ef787db01613d23f26fa15019 Mon Sep 17 00:00:00 2001
From: Iorga <miorga@pn135438.campus.nist.gov>
Date: Tue, 4 Jun 2024 15:46:15 -0400
Subject: [PATCH 06/36] Fixed validation errors in AWS SSP.

---
 .gitignore                                    |   2 +
 ...moderate_profile_resolved_to_catalog.json} |   0
 .../ssp/aws_leveraged_authorization_ssp.json  | 192 +++++++++
 ..._moderate_profile_resolved_to_catalog.xml} |   9 +-
 .../ssp/aws_leveraged_authorization_ssp.xml   | 384 +++++++++---------
 .../xml/ssp/blossom_admin_member_ssp.xml      |   2 +-
 6 files changed, 392 insertions(+), 197 deletions(-)
 rename oscal-content/json/{profile/blossom_moderate_profile_resolved.json => catalog/blossom_moderate_profile_resolved_to_catalog.json} (100%)
 rename oscal-content/xml/{profile/blossom_moderate_profile_resolved.xml => catalog/blossom_moderate_profile_resolved_to_catalog.xml} (99%)

diff --git a/.gitignore b/.gitignore
index 3532e70..579c978 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,5 @@ draft-*
 .pyenv*
 .env*
 oscal-cli.txt
+# Ignore validation tool oscal-cli 
+build/oscal-cli
diff --git a/oscal-content/json/profile/blossom_moderate_profile_resolved.json b/oscal-content/json/catalog/blossom_moderate_profile_resolved_to_catalog.json
similarity index 100%
rename from oscal-content/json/profile/blossom_moderate_profile_resolved.json
rename to oscal-content/json/catalog/blossom_moderate_profile_resolved_to_catalog.json
diff --git a/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json b/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json
index bc38bf9..d06f9f7 100644
--- a/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json
+++ b/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json
@@ -224,6 +224,7 @@
         "information-types" : [ {
           "uuid" : "27e034c9-2164-47c1-ba0b-8eb56c941842",
           "title" : "Corrective Action (Policy/Regulation)",
+          "description" : "TBD",
           "categorizations" : [ {
             "system" : "https://doi.org/10.6028/NIST.SP.800-60v2r1",
             "information-type-ids" : [ "C.2.1.1" ]
@@ -251,11 +252,13 @@
         "state" : "operational"
       },
       "authorization-boundary" : {
+        "description" : "TBD",
         "diagrams" : [ {
           "uuid" : "1d92b6f3-1260-421c-9bda-5c4a7739f0d1"
         } ]
       },
       "network-architecture" : {
+        "description" : "TBD",
         "diagrams" : [ {
           "uuid" : "2d92b6f3-1260-421c-9bda-5c4a7739f0d2"
         } ]
@@ -384,6 +387,7 @@
             "uuid" : "1398d737-8041-4774-bed3-668d90617860",
             "description" : "TBD:",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f5c1b59c-04ff-4821-980a-e10c18e379a8",
                 "description" : "TBD:"
@@ -429,7 +433,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "fdecdd89-e6ce-40d7-97a9-55d3a57abb8c",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9c4a8b31-fe34-4b5f-933d-2a1c448a4ef2",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -447,7 +453,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2cd8b8e6-673a-4470-8534-13b5e2c9a240",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "bbeec595-6c96-4102-ac5d-a7675ed6c529",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -486,7 +494,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "8103b498-0f37-4106-92e0-d88886da6eb3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9678dd9d-6125-45b7-ba22-9fa41f03f72e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -504,7 +514,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "ea52159a-8bc8-4a7e-b552-6cfd49291a6b",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6b0ef9b2-6b7d-4178-b8e8-1f9ffc471045",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -522,7 +534,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "8ed49eba-7071-4d05-8a72-7170cd70e073",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9af6d025-089c-4b60-aa2a-f2301a1f4ba1",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -540,7 +554,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "aed2636d-73bc-4484-aa02-744c7d7766e3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "72a3d5fb-6021-4052-8b8d-645f445f1de9",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -558,7 +574,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "eaaf5c14-f217-4f73-9a05-6238ee9e2e00",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "63b1f1a3-ed64-4b3b-91f0-80255ccfdd80",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -576,7 +594,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d4182aa0-508a-4bf4-97d7-7c351b34f8c9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6ba7424b-ec07-494c-a937-315be22012df",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -605,7 +625,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "bd636006-e24a-48a6-826d-e140ce79688b",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "13f36d45-615b-41e2-9760-6731a543e3b5",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -633,7 +655,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "c938abfb-d25c-4810-acba-7676d2462a88",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c906e5b4-40ce-42e0-af33-6e70e2f93499",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -661,7 +685,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "17a3d2b4-9caa-405c-bfe3-ef4f43b7f7bf",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "dfa89026-ff35-47e6-8c3f-cc4b2b623dd6",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -696,7 +722,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7a32cdf4-0904-4c26-8f1d-9906d35ede53",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "ebfb1122-fd4b-49d2-acc2-349d54db3c51",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -714,7 +742,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "e06595df-f3b7-4ce5-a510-6ca8fe068b72",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6e8f46ce-8f4e-40f1-95a8-71430a769709",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -732,7 +762,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "cc0efa05-1f76-46d3-a974-3d96b3257d64",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "36d198cc-91e3-4f0b-a633-7cc256d29c42",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -750,7 +782,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "0702e1b5-f95a-47b8-8244-a66ab38b0908",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "78df87ae-283c-4626-981a-e14291a0c8dd",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -782,7 +816,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "a68e4b6a-b77e-485d-aa8a-e785fc158085",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "4d23c4d8-b0cb-4a8a-9d64-aa24da8ab619",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -800,7 +836,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "42c76696-a674-464a-9229-6c6c3efae55d",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "35ab73e0-937c-48c3-b02f-fc2d10b1a81e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -818,7 +856,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d6522c04-d78d-4672-b4d5-297e035a4a47",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "8b875c18-e130-40ef-9f54-479c9593dbb4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -836,7 +876,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "b2c30e47-7e20-4d8c-a8a5-76e14371f047",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "3486928c-60a9-4549-a090-1b56af560221",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -854,7 +896,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "a0710b8a-49a7-42f9-9c6b-c15345f3fbee",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f075f560-32f2-4ec6-bd12-868d3bdd2310",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -883,7 +927,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "c190a70f-74f3-4f4a-bf1b-b7a373816d48",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "d07af2dd-4725-4651-89d8-d732eb20fb22",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -914,7 +960,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "ffe84fd7-6541-4b14-b09e-dbd792d76ef3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "bbf26c5d-bb82-4d70-b4f2-882afe6d9bf4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -932,7 +980,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "747dc783-b19e-49bb-ab71-f095f7b3011f",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "faa72600-62e7-4440-b241-63ec94afd763",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -961,7 +1011,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "f42c46cb-443d-459e-9aae-8bbf3b82edaf",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "1d56cf05-5ccc-4491-b506-8cebae18963a",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -992,7 +1044,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d8cc5638-2afe-459d-a3cb-a01976aeac85",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "441dadf2-bef9-4e06-8f43-dd03b441acdd",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1010,7 +1064,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "96892541-9b58-440e-b44e-3998a4a7be84",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "627ba3bb-1a54-4cf5-ad56-7155247f5280",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1028,7 +1084,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "02655970-983a-4b85-a49f-587749ce3d19",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "245d3044-c5f1-4167-9a6e-2c29388bba5e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1060,7 +1118,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "24ee516c-0d3f-4960-90b7-afa66abc28a9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f4a058aa-a41c-4c58-9758-6c79f980fd18",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1078,7 +1138,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7fe0f375-88a4-4fb0-b38c-d4a500e3b1d9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "86b5fad1-4e75-43da-b257-9467fff7acfe",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1114,7 +1176,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "409c1e47-be79-43bf-aa2c-0fed0889c6d0",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c81f9919-29f5-455b-a40d-3240093a0be5",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1155,7 +1219,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "092bfd62-aa7b-4409-a875-5fff7d2975b5",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "32b76454-93db-4bd1-9222-9604e6c5f7c7",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1173,7 +1239,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d862d207-64d0-4d00-bcbe-097ea62ba6f5",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "b7367d62-0528-426b-8f97-f68a9530d619",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1209,7 +1277,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "9aaadee4-d49f-4de8-87ae-558fc6352e13",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "52572cd0-59ae-4248-8f07-68757ed538ec",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1247,7 +1317,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "3d05b563-2cb8-4e38-8f56-694f60a2453f",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "af8ae830-df78-443c-bf0f-dc164f0d90b3",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1265,7 +1337,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "bda847e5-11cc-4d9f-857a-45f8819fd230",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "ffc17fe4-0e82-4292-8fd0-493905941d48",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1304,7 +1378,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2e132311-f565-4aed-9614-ccc6a77158e2",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "a02735f9-5446-4ed4-8c26-5ab744ae1b04",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1322,7 +1398,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "91fa9408-1373-4254-9159-cb2695e615a8",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "70698d4a-e8c2-4b9c-9395-c0582d8b8022",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1361,7 +1439,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "c487bf9a-c8fc-4180-92dc-ee528ece1949",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6056c6b8-60b1-498b-acf4-3d6c6fe8830a",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1379,7 +1459,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "40d22136-bb9c-4366-889b-6e59f8332069",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "01fa8cff-5d8e-4e04-af66-9384ee9c3606",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1397,7 +1479,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "4c84e881-7969-45ce-be75-7b223d4d1be3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "03f61f6e-7c67-4701-a9cd-30563989a670",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1415,7 +1499,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "dee24e7a-a80e-4598-b281-e15f6d247e4d",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "769edda4-b4ed-4671-978d-85b16bfd564e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1444,7 +1530,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "902a1af4-6479-4833-8d22-3efdf7d30edc",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "f7c948c9-b471-4a53-a56a-af75ece5d75e",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1482,7 +1570,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7e5a2ff0-9bb8-4e96-b3ea-8ee6c7ae189e",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "80e0c1ad-0366-4d71-a228-e81f553daf70",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1500,7 +1590,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2f0f0bfa-fa0e-4245-b54a-926b349f5f6b",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "1b8d9da7-1c8e-4b05-af8c-b4887adcfe2a",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1529,7 +1621,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "3c52d224-4181-42e6-a477-96862a7547ea",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c803d36a-1e21-4f51-9380-29fdaca0c823",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1561,7 +1655,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "5bf37408-0101-487e-82d3-6aef883b259d",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "ad041938-5dff-484d-8ecd-3888b3f30781",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1593,7 +1689,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "f5ac2d2d-abeb-4ad5-be32-83225ff6a8da",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "373974c4-c109-4b09-81f7-bf16ab35794d",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1634,7 +1732,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "e93f9b10-7017-4bbb-beb2-c0c60a11570e",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c5ca7ce6-d6bd-4b15-bfff-222f9c04b23a",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1662,7 +1762,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4e1cfda5-3463-4dff-ab6f-ee82d4fc12d4",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "01a0d189-d163-42ef-971e-f483eb1a89e3",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1703,7 +1805,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "5f8020ca-afa5-41d3-8b8c-29372db8af1d",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "febe4d8a-4107-4e8f-9bca-c9a0c96d7cb0",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1721,7 +1825,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "5b81c845-e335-4854-9189-bbbdeeb8c220",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "920d4c86-6f4a-4b57-a991-3ec6c62a5cfd",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1757,7 +1863,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "c463ebb0-ec05-4bdf-af2e-b44b0ab9ed7e",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "5643f75d-672b-465b-869e-c6c80962c9be",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1775,7 +1883,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "0a8cdb94-3fbc-4c0e-a4a1-5bbbeb85aca2",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "3301e8bd-5cdc-4cc6-835e-ac8af07d7f5c",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1793,7 +1903,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "8b94c5b1-f4c9-47e4-b2e6-1b3ba3ff0808",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "cfeb89af-a484-49c4-9988-96237c86944e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1811,7 +1923,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2f9fe10b-ba9e-4291-98b5-13bb6fc0c58c",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "e7024325-6340-4e1f-a4b8-c741d1e36bb4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1871,7 +1985,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "3b3ecf6b-d4a9-499c-a5d1-2887b4987aca",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "542b2329-5497-456f-b117-746e798b9929",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1889,7 +2005,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "ead33ba5-eb15-48e3-900e-8a3e9cf289d9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "96ff07de-683f-4181-8813-ae4498d66f05",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1907,7 +2025,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "66ece908-ee7b-468b-a5b4-e900aa724ea1",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f4c09934-895b-40e8-b122-aa08ea9b50ba",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1925,7 +2045,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2db60ecd-c0a9-4be8-a6b5-c4bb45d9ec49",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "81660f14-0393-4219-98ac-9e2c8f7142f6",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1943,7 +2065,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "72dfa4c9-d24a-4ac2-8c66-46e0992e9158",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "0a453bbe-cb88-45c8-b6ae-5033bc09feff",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1961,7 +2085,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "27000dc4-4d7c-4e0c-aa8a-581babfe7745",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "e7799c91-b885-4d4e-b198-a7988c76c3ad",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1979,7 +2105,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2040d1a5-ddd0-405d-8edd-e58f77a59ad3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "92842d62-9ca0-46f9-a431-abf9e6b4f594",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2012,7 +2140,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "6d925c2b-0462-4a75-aa45-03b73c017307",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c2ac04dc-acb4-418a-84e5-b58730f01dee",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2047,7 +2177,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "bec2e74d-c33d-4232-a4ac-424abf2637ff",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "cd19a3a6-00e2-4a44-9c63-bf795f9c93d1",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2075,7 +2207,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4a99e9c6-ff33-4a37-abc9-b6b9ca7d4657",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "259c0c8f-3bb9-4e43-877b-c896a20aee7d",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2113,7 +2247,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "6fd8dba3-df21-4c25-9994-95a66c3c74be",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f5320fa1-6ce9-4ef6-a6a8-422f619a41f9",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2131,7 +2267,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "4d196aef-1385-4bf2-8b00-28258e22b677",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "b62d1197-e6c0-4b42-8f77-02b311b8faab",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2149,7 +2287,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "c148993e-862d-40b1-b670-f19db4114e95",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "25356503-3b18-4a0e-b97a-cf243e4e174c",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2178,7 +2318,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "70e9c839-37dc-48c9-ac6a-d34bf6dbaa17",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "e9a252ad-ff10-43ca-a790-024d5c8771ae",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2210,7 +2352,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "8727a64e-a367-4b17-86b1-742dada3a0c1",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "59b5f4ea-33eb-4000-a636-aaa4004e29b0",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2248,7 +2392,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "83d8d2e9-abb0-442a-a232-b6b3ade4040e",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9301b521-7676-45eb-9d3c-a7466b652b84",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2266,7 +2412,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "36ab955e-ac9b-4fd5-83a9-2cc35c5fa5b8",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "dc217439-df1e-4d91-ae4c-10b790b961e4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2295,7 +2443,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "5e212f76-bae7-47ce-b7bc-c093b7133dfc",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "2079e0b4-5fb6-403b-a69a-1f39fd96c0b7",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2323,7 +2473,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "476a42e2-6778-4b2b-8f9b-77aec5a538dd",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "20679a94-74fe-4055-b7d8-3a2014dcc049",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2358,7 +2510,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d1b09916-2698-4642-bddd-7e3f6b69e1e1",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f556c40b-a2d8-4f2a-bdaa-5a37073548fe",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2376,7 +2530,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7600b228-0413-4e7b-91ae-24537ad02f25",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "291bebf7-594a-401d-a2c0-d24d2aac6bf2",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2394,7 +2550,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "b8c7793c-8209-4280-97ec-8637c6e55fd3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "b37cec5a-2b40-477f-976d-f0e264dd2b8e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2427,7 +2585,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4e691a77-ec56-4ad4-b532-7ed71b9b08aa",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "01f1d712-a58c-40b5-aa5b-ea123f03d7dc",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2455,7 +2615,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "7a0ef9ab-66e7-47a6-b25a-3db8378d04f8",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "d6d16f6d-5ac5-4c94-8066-d9bc1c67eb82",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2483,7 +2645,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "7153a18a-1c44-43f9-b897-a7c51f024d40",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "956fb932-4841-402b-9b3d-3393ad295dfd",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2511,7 +2675,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "12f7481f-055d-46d3-bb53-86d7e3651e26",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "178d5628-b2fc-40ee-ad44-ba6b95888b99",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2546,7 +2712,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "d68dcfcc-48bd-440d-a7e0-8c0699449ad6",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "9f2515b3-e250-4449-9779-28bcd6faf77d",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2581,7 +2749,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4ede96a6-6cac-4dfb-9769-40f341192bea",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "e28bff74-96a4-454d-98d7-c59e122d63fb",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2609,7 +2779,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "47f93be9-2806-4939-b7cb-4dc13784717a",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "d7caf3b3-f81b-42ef-9afc-926cee762d34",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2647,7 +2819,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "bd8d9613-c072-44fe-8674-147d13925382",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "24d459a8-dd81-4881-ae25-6f69a155a174",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2665,7 +2839,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "e126ea00-6678-4b2d-a171-d75a0a0f3d9a",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9ff9038d-e1f7-4d3f-a5b0-ff301848eeaf",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2694,7 +2870,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "20c0da71-a712-46c1-84a2-856fd428f7f3",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "a1ef191c-a130-4145-82ca-fa1895af11dd",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2722,7 +2900,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "3b39a1d5-d58b-40cc-a800-126c564f7da4",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "ac93fa47-dd7d-445a-a407-cb93947580ca",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2754,7 +2934,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "00c98ea4-1a92-4f46-ad19-49934bbba173",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "7b581e32-56d2-4243-9057-8d57c7ec842e",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2786,7 +2968,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "f8d231f5-d9be-42cc-be78-dad690e480c1",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "4bb45439-3b70-4a5c-adcd-e4becd0b14c9",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2821,7 +3005,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "965e16bb-a4b1-4396-b523-baa8e0b9a5bc",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "311bf6f3-8920-44bf-a216-3aad35b27614",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2839,7 +3025,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7091b24c-1aa1-49d7-9ad6-bae60f88d0e3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "7fd2e269-a354-440d-bc52-6a158fb2dbd4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2857,7 +3045,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "4df3485f-407d-42b8-ab8e-8c634216c51b",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "81f4d2b6-91de-48eb-a0ad-8afe37eccd2d",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2890,7 +3080,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "15a1aa21-71d2-4728-9b0b-38fbe10f8b86",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "78a2ecba-1b3b-4aac-ad0b-f0ce572aea46",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
diff --git a/oscal-content/xml/profile/blossom_moderate_profile_resolved.xml b/oscal-content/xml/catalog/blossom_moderate_profile_resolved_to_catalog.xml
similarity index 99%
rename from oscal-content/xml/profile/blossom_moderate_profile_resolved.xml
rename to oscal-content/xml/catalog/blossom_moderate_profile_resolved_to_catalog.xml
index 145e83d..3f127d0 100644
--- a/oscal-content/xml/profile/blossom_moderate_profile_resolved.xml
+++ b/oscal-content/xml/catalog/blossom_moderate_profile_resolved_to_catalog.xml
@@ -1,12 +1,13 @@
-<?xml version="1.0" encoding="UTF-8"?> 
-<catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="b3a34ee2-d735-4ccd-81bb-a872163c015a">
+<?xml version="1.0" encoding="UTF-8"?>
+<catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="869579ff-2f43-4f60-9f88-d753858e6c01">
     <metadata>
         <title>NIST BloSS@M Tailored Moderate Baseline</title>
-        <last-modified>2024-03-20T21:24:47.769914Z</last-modified>
+        <last-modified>2024-05-30T18:28:59.688431Z</last-modified>
         <version>0.0.1</version>
         <oscal-version>1.1.2</oscal-version>
         <prop name="resolution-tool" value="libOSCAL-Java" />
-        <link href="./blossom_moderate_profile.xml"
+        <link
+            href="file:///Users/miorga/Desktop/ALL_PROJECTS/GH/blossom-oscal/oscal-content/xml/profile/blossom_moderate_profile.xml"
             rel="source-profile" />
     </metadata>
     <group id="ac" class="family">
diff --git a/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml b/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml
index 47ceebe..5aee1fa 100644
--- a/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml
+++ b/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml
@@ -181,7 +181,7 @@
       <prop name="sorn-id" ns="https://fedramp.gov/ns/oscal" value="n/a" class="pta" />
       <information-type uuid="27e034c9-2164-47c1-ba0b-8eb56c941842">
         <title>Corrective Action (Policy/Regulation)</title>
-        <description></description>
+        <description><p>TBD</p></description>
         <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
           <information-type-id>C.2.1.1</information-type-id>
         </categorization>
@@ -206,11 +206,11 @@
     </security-impact-level>
     <status state="operational" />
     <authorization-boundary>
-      <description></description>
+      <description><p>TBD</p></description>
       <diagram uuid="1d92b6f3-1260-421c-9bda-5c4a7739f0d1" />
     </authorization-boundary>
     <network-architecture>
-      <description></description>
+      <description><p>TBD</p></description>
       <diagram uuid="2d92b6f3-1260-421c-9bda-5c4a7739f0d2" />
     </network-architecture>
     <data-flow>
@@ -323,7 +323,7 @@
             <p>TBD:</p>
           </description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f5c1b59c-04ff-4821-980a-e10c18e379a8">
               <description>
                 <p>TBD:</p>
@@ -361,9 +361,9 @@
       <statement statement-id="ma-1_smt.a" uuid="75cb125e-62f9-4355-8ca0-02c8daefb2b4">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="fdecdd89-e6ce-40d7-97a9-55d3a57abb8c">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9c4a8b31-fe34-4b5f-933d-2a1c448a4ef2">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -387,9 +387,9 @@
       <statement statement-id="ma-1_smt.b" uuid="68b3a53d-4f77-4c50-9f2d-897204c315e9">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2cd8b8e6-673a-4470-8534-13b5e2c9a240">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="bbeec595-6c96-4102-ac5d-a7675ed6c529">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -426,9 +426,9 @@
       <statement statement-id="ma-2_smt.a" uuid="5f8dffe3-ae68-4f7c-8e70-b447eac788d3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="8103b498-0f37-4106-92e0-d88886da6eb3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9678dd9d-6125-45b7-ba22-9fa41f03f72e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -452,9 +452,9 @@
       <statement statement-id="ma-2_smt.b" uuid="60bf759d-9dcd-4fe1-bf65-8f280b5c7452">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="ea52159a-8bc8-4a7e-b552-6cfd49291a6b">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6b0ef9b2-6b7d-4178-b8e8-1f9ffc471045">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -478,9 +478,9 @@
       <statement statement-id="ma-2_smt.c" uuid="9eaab6a5-cacd-49a7-bd65-65486bbaeeac">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="8ed49eba-7071-4d05-8a72-7170cd70e073">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9af6d025-089c-4b60-aa2a-f2301a1f4ba1">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -504,9 +504,9 @@
       <statement statement-id="ma-2_smt.d" uuid="4b2754cf-3ec7-46e5-8db4-7f326758114a">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="aed2636d-73bc-4484-aa02-744c7d7766e3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="72a3d5fb-6021-4052-8b8d-645f445f1de9">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -530,9 +530,9 @@
       <statement statement-id="ma-2_smt.e" uuid="92384784-fa20-44c5-aa2d-b77fd67b5580">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="eaaf5c14-f217-4f73-9a05-6238ee9e2e00">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="63b1f1a3-ed64-4b3b-91f0-80255ccfdd80">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -556,9 +556,9 @@
       <statement statement-id="ma-2_smt.f" uuid="a6ce1628-0215-488b-bc98-5d2c880a9acc">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d4182aa0-508a-4bf4-97d7-7c351b34f8c9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6ba7424b-ec07-494c-a937-315be22012df">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -588,9 +588,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="bd636006-e24a-48a6-826d-e140ce79688b">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="13f36d45-615b-41e2-9760-6731a543e3b5">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -619,9 +619,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="c938abfb-d25c-4810-acba-7676d2462a88">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c906e5b4-40ce-42e0-af33-6e70e2f93499">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -650,9 +650,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="17a3d2b4-9caa-405c-bfe3-ef4f43b7f7bf">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="dfa89026-ff35-47e6-8c3f-cc4b2b623dd6">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -685,9 +685,9 @@
       <statement statement-id="ma-3.3_smt.a" uuid="ef1ee2f0-36e0-447d-8852-6d9180b7dba9">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7a32cdf4-0904-4c26-8f1d-9906d35ede53">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="ebfb1122-fd4b-49d2-acc2-349d54db3c51">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -711,9 +711,9 @@
       <statement statement-id="ma-3.3_smt.b" uuid="49974331-353f-49d8-9490-f631c913b7db">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="e06595df-f3b7-4ce5-a510-6ca8fe068b72">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6e8f46ce-8f4e-40f1-95a8-71430a769709">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -737,9 +737,9 @@
       <statement statement-id="ma-3.3_smt.c" uuid="068c726c-93af-480d-8573-0a787f01a62f">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="cc0efa05-1f76-46d3-a974-3d96b3257d64">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="36d198cc-91e3-4f0b-a633-7cc256d29c42">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -763,9 +763,9 @@
       <statement statement-id="ma-3.3_smt.d" uuid="8b03d644-f625-4c1d-a1ab-d3f63e4af9e3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="0702e1b5-f95a-47b8-8244-a66ab38b0908">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="78df87ae-283c-4626-981a-e14291a0c8dd">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -796,9 +796,9 @@
       <statement statement-id="ma-4_smt.a" uuid="534d9827-d24e-4d72-bd58-ca872339e2ea">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="a68e4b6a-b77e-485d-aa8a-e785fc158085">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="4d23c4d8-b0cb-4a8a-9d64-aa24da8ab619">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -822,9 +822,9 @@
       <statement statement-id="ma-4_smt.b" uuid="fce5db07-1512-46ca-bbcc-1bee7566e9bf">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="42c76696-a674-464a-9229-6c6c3efae55d">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="35ab73e0-937c-48c3-b02f-fc2d10b1a81e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -848,9 +848,9 @@
       <statement statement-id="ma-4_smt.c" uuid="e221ff63-592d-4fc2-bc91-2c3e4aa835f3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d6522c04-d78d-4672-b4d5-297e035a4a47">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="8b875c18-e130-40ef-9f54-479c9593dbb4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -874,9 +874,9 @@
       <statement statement-id="ma-4_smt.d" uuid="bc1e4825-edc4-4135-a8f9-f44728e7bfb3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="b2c30e47-7e20-4d8c-a8a5-76e14371f047">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="3486928c-60a9-4549-a090-1b56af560221">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -900,9 +900,9 @@
       <statement statement-id="ma-4_smt.e" uuid="103a952c-8e5c-4460-bc18-209aafc7e638">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="a0710b8a-49a7-42f9-9c6b-c15345f3fbee">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f075f560-32f2-4ec6-bd12-868d3bdd2310">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -932,9 +932,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="c190a70f-74f3-4f4a-bf1b-b7a373816d48">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="d07af2dd-4725-4651-89d8-d732eb20fb22">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -964,9 +964,9 @@
       <statement statement-id="ma-4.3_smt.a" uuid="b042ccd2-364d-4b56-bca6-6c60e8345daf">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="ffe84fd7-6541-4b14-b09e-dbd792d76ef3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="bbf26c5d-bb82-4d70-b4f2-882afe6d9bf4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -990,9 +990,9 @@
       <statement statement-id="ma-4.3_smt.b" uuid="96e6369a-1a61-43a5-8a2d-90434fcde3f1">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="747dc783-b19e-49bb-ab71-f095f7b3011f">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="faa72600-62e7-4440-b241-63ec94afd763">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1022,9 +1022,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="f42c46cb-443d-459e-9aae-8bbf3b82edaf">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="1d56cf05-5ccc-4491-b506-8cebae18963a">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1054,9 +1054,9 @@
       <statement statement-id="ma-5_smt.a" uuid="667a498d-4506-4e12-877f-1ba358af0429">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d8cc5638-2afe-459d-a3cb-a01976aeac85">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="441dadf2-bef9-4e06-8f43-dd03b441acdd">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1080,9 +1080,9 @@
       <statement statement-id="ma-5_smt.b" uuid="a1260a7d-8d8f-4c96-a7e6-96356d7de2dd">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="96892541-9b58-440e-b44e-3998a4a7be84">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="627ba3bb-1a54-4cf5-ad56-7155247f5280">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1106,9 +1106,9 @@
       <statement statement-id="ma-5_smt.c" uuid="074b97bf-22ed-4ea4-bb3f-ff513fd72b10">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="02655970-983a-4b85-a49f-587749ce3d19">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="245d3044-c5f1-4167-9a6e-2c29388bba5e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1139,9 +1139,9 @@
       <statement statement-id="ma-5.1_smt.a" uuid="c7880006-48e7-4695-9cd8-c2baea2beb9b">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="24ee516c-0d3f-4960-90b7-afa66abc28a9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f4a058aa-a41c-4c58-9758-6c79f980fd18">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1165,9 +1165,9 @@
       <statement statement-id="ma-5.1_smt.b" uuid="9261d0ff-39df-495c-890d-222266da9e46">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7fe0f375-88a4-4fb0-b38c-d4a500e3b1d9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="86b5fad1-4e75-43da-b257-9467fff7acfe">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1203,9 +1203,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="409c1e47-be79-43bf-aa2c-0fed0889c6d0">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c81f9919-29f5-455b-a40d-3240093a0be5">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1244,9 +1244,9 @@
       <statement statement-id="mp-1_smt.a" uuid="d6c5e233-9c58-4995-b066-ae0096db33b6">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="092bfd62-aa7b-4409-a875-5fff7d2975b5">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="32b76454-93db-4bd1-9222-9604e6c5f7c7">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1270,9 +1270,9 @@
       <statement statement-id="mp-1_smt.b" uuid="55367813-21da-4944-ade8-e5bfa51158fc">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d862d207-64d0-4d00-bcbe-097ea62ba6f5">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="b7367d62-0528-426b-8f97-f68a9530d619">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1308,9 +1308,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="9aaadee4-d49f-4de8-87ae-558fc6352e13">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="52572cd0-59ae-4248-8f07-68757ed538ec">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1346,9 +1346,9 @@
       <statement statement-id="mp-3_smt.a" uuid="a12cc57f-73c6-46f7-96c5-1d7569dc7b16">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="3d05b563-2cb8-4e38-8f56-694f60a2453f">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="af8ae830-df78-443c-bf0f-dc164f0d90b3">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1372,9 +1372,9 @@
       <statement statement-id="mp-3_smt.b" uuid="a70fb01b-23b1-4114-b7cd-3167170fa844">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="bda847e5-11cc-4d9f-857a-45f8819fd230">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="ffc17fe4-0e82-4292-8fd0-493905941d48">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1411,9 +1411,9 @@
       <statement statement-id="mp-4_smt.a" uuid="062d392a-53e1-4246-b740-b15bb9e2e03d">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2e132311-f565-4aed-9614-ccc6a77158e2">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="a02735f9-5446-4ed4-8c26-5ab744ae1b04">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1437,9 +1437,9 @@
       <statement statement-id="mp-4_smt.b" uuid="db618aa6-8036-4926-b0a6-e4b2eb4a96f1">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="91fa9408-1373-4254-9159-cb2695e615a8">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="70698d4a-e8c2-4b9c-9395-c0582d8b8022">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1476,9 +1476,9 @@
       <statement statement-id="mp-5_smt.a" uuid="f8cec15a-d299-414c-9c64-73e7246e02ad">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="c487bf9a-c8fc-4180-92dc-ee528ece1949">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6056c6b8-60b1-498b-acf4-3d6c6fe8830a">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1502,9 +1502,9 @@
       <statement statement-id="mp-5_smt.b" uuid="c3ee7827-ea71-45ec-a42f-e57861475613">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="40d22136-bb9c-4366-889b-6e59f8332069">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="01fa8cff-5d8e-4e04-af66-9384ee9c3606">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1528,9 +1528,9 @@
       <statement statement-id="mp-5_smt.c" uuid="0bf36497-e148-4a90-91c4-7a2ea27f9fce">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="4c84e881-7969-45ce-be75-7b223d4d1be3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="03f61f6e-7c67-4701-a9cd-30563989a670">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1554,9 +1554,9 @@
       <statement statement-id="mp-5_smt.d" uuid="83e4d0bf-9026-4e65-b154-3e032ee5333e">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="dee24e7a-a80e-4598-b281-e15f6d247e4d">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="769edda4-b4ed-4671-978d-85b16bfd564e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1586,9 +1586,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="902a1af4-6479-4833-8d22-3efdf7d30edc">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="f7c948c9-b471-4a53-a56a-af75ece5d75e">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1624,9 +1624,9 @@
       <statement statement-id="mp-6_smt.a" uuid="d10d7dbd-0aa8-4231-a0d2-125b5773d41b">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7e5a2ff0-9bb8-4e96-b3ea-8ee6c7ae189e">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="80e0c1ad-0366-4d71-a228-e81f553daf70">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1650,9 +1650,9 @@
       <statement statement-id="mp-6_smt.b" uuid="57d24452-7cf3-4f65-813d-94d5bbf06199">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2f0f0bfa-fa0e-4245-b54a-926b349f5f6b">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="1b8d9da7-1c8e-4b05-af8c-b4887adcfe2a">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1682,9 +1682,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="3c52d224-4181-42e6-a477-96862a7547ea">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c803d36a-1e21-4f51-9380-29fdaca0c823">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1716,9 +1716,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="5bf37408-0101-487e-82d3-6aef883b259d">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="ad041938-5dff-484d-8ecd-3888b3f30781">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1750,9 +1750,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="f5ac2d2d-abeb-4ad5-be32-83225ff6a8da">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="373974c4-c109-4b09-81f7-bf16ab35794d">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1793,9 +1793,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="e93f9b10-7017-4bbb-beb2-c0c60a11570e">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c5ca7ce6-d6bd-4b15-bfff-222f9c04b23a">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1824,9 +1824,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4e1cfda5-3463-4dff-ab6f-ee82d4fc12d4">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="01a0d189-d163-42ef-971e-f483eb1a89e3">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1865,9 +1865,9 @@
       <statement statement-id="pe-1_smt.a" uuid="b5a77d0d-138f-4589-b1a4-b377fd1375ec">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="5f8020ca-afa5-41d3-8b8c-29372db8af1d">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="febe4d8a-4107-4e8f-9bca-c9a0c96d7cb0">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1891,9 +1891,9 @@
       <statement statement-id="pe-1_smt.b" uuid="be60b9f4-b8bc-4bb1-b16d-ecbd0bc20a72">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="5b81c845-e335-4854-9189-bbbdeeb8c220">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="920d4c86-6f4a-4b57-a991-3ec6c62a5cfd">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1927,9 +1927,9 @@
       <statement statement-id="pe-2_smt.a" uuid="0c63729b-9915-4b8d-8351-a4451962d905">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="c463ebb0-ec05-4bdf-af2e-b44b0ab9ed7e">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="5643f75d-672b-465b-869e-c6c80962c9be">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1953,9 +1953,9 @@
       <statement statement-id="pe-2_smt.b" uuid="a7ea7ab6-02ed-436d-8f69-9161826386ab">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="0a8cdb94-3fbc-4c0e-a4a1-5bbbeb85aca2">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="3301e8bd-5cdc-4cc6-835e-ac8af07d7f5c">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1979,9 +1979,9 @@
       <statement statement-id="pe-2_smt.c" uuid="a6fb6a64-b831-42cc-a56b-6c59bc5d5a72">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="8b94c5b1-f4c9-47e4-b2e6-1b3ba3ff0808">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="cfeb89af-a484-49c4-9988-96237c86944e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2005,9 +2005,9 @@
       <statement statement-id="pe-2_smt.d" uuid="e3f2df89-19bf-4027-b560-67dc9424bd28">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2f9fe10b-ba9e-4291-98b5-13bb6fc0c58c">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="e7024325-6340-4e1f-a4b8-c741d1e36bb4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2065,9 +2065,9 @@
       <statement statement-id="pe-3_smt.a" uuid="27e29dda-49f9-40e3-a3fa-fd488a7ad3a0">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="3b3ecf6b-d4a9-499c-a5d1-2887b4987aca">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="542b2329-5497-456f-b117-746e798b9929">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2091,9 +2091,9 @@
       <statement statement-id="pe-3_smt.b" uuid="f734a63b-e2fe-4ce0-a7c5-693e79622d3d">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="ead33ba5-eb15-48e3-900e-8a3e9cf289d9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="96ff07de-683f-4181-8813-ae4498d66f05">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2117,9 +2117,9 @@
       <statement statement-id="pe-3_smt.c" uuid="39f7c51b-a622-4dfd-91db-6f0e334e8b78">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="66ece908-ee7b-468b-a5b4-e900aa724ea1">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f4c09934-895b-40e8-b122-aa08ea9b50ba">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2143,9 +2143,9 @@
       <statement statement-id="pe-3_smt.d" uuid="7e392408-98ff-4769-9de1-03d4323a1385">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2db60ecd-c0a9-4be8-a6b5-c4bb45d9ec49">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="81660f14-0393-4219-98ac-9e2c8f7142f6">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2169,9 +2169,9 @@
       <statement statement-id="pe-3_smt.e" uuid="145b751f-7073-49b2-bc08-165465d34fe3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="72dfa4c9-d24a-4ac2-8c66-46e0992e9158">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="0a453bbe-cb88-45c8-b6ae-5033bc09feff">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2195,9 +2195,9 @@
       <statement statement-id="pe-3_smt.f" uuid="6a119ed5-0b0a-4b86-92b7-a8f94dd785b9">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="27000dc4-4d7c-4e0c-aa8a-581babfe7745">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="e7799c91-b885-4d4e-b198-a7988c76c3ad">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2221,9 +2221,9 @@
       <statement statement-id="pe-3_smt.g" uuid="1144efba-4812-442c-8fa3-b031018fdd74">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2040d1a5-ddd0-405d-8edd-e58f77a59ad3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="92842d62-9ca0-46f9-a431-abf9e6b4f594">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2256,9 +2256,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="6d925c2b-0462-4a75-aa45-03b73c017307">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c2ac04dc-acb4-418a-84e5-b58730f01dee">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2293,9 +2293,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="bec2e74d-c33d-4232-a4ac-424abf2637ff">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="cd19a3a6-00e2-4a44-9c63-bf795f9c93d1">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2324,9 +2324,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4a99e9c6-ff33-4a37-abc9-b6b9ca7d4657">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="259c0c8f-3bb9-4e43-877b-c896a20aee7d">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2362,9 +2362,9 @@
       <statement statement-id="pe-6_smt.a" uuid="ab2e243e-38e6-46e4-a95f-3dcc2c1572ba">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="6fd8dba3-df21-4c25-9994-95a66c3c74be">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f5320fa1-6ce9-4ef6-a6a8-422f619a41f9">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2388,9 +2388,9 @@
       <statement statement-id="pe-6_smt.b" uuid="36a84be2-8ef6-4a2b-a339-e8f8ab398ea3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="4d196aef-1385-4bf2-8b00-28258e22b677">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="b62d1197-e6c0-4b42-8f77-02b311b8faab">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2414,9 +2414,9 @@
       <statement statement-id="pe-6_smt.c" uuid="779dd08e-58f0-4763-8744-0da98254e3ac">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="c148993e-862d-40b1-b670-f19db4114e95">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="25356503-3b18-4a0e-b97a-cf243e4e174c">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2446,9 +2446,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="70e9c839-37dc-48c9-ac6a-d34bf6dbaa17">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="e9a252ad-ff10-43ca-a790-024d5c8771ae">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2480,9 +2480,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="8727a64e-a367-4b17-86b1-742dada3a0c1">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="59b5f4ea-33eb-4000-a636-aaa4004e29b0">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2518,9 +2518,9 @@
       <statement statement-id="pe-8_smt.a" uuid="04cb6129-5768-45ea-9c73-ef570eb7adc7">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="83d8d2e9-abb0-442a-a232-b6b3ade4040e">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9301b521-7676-45eb-9d3c-a7466b652b84">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2544,9 +2544,9 @@
       <statement statement-id="pe-8_smt.b" uuid="2336cea0-410f-43b5-ae7b-a29b99ec0589">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="36ab955e-ac9b-4fd5-83a9-2cc35c5fa5b8">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="dc217439-df1e-4d91-ae4c-10b790b961e4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2576,9 +2576,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="5e212f76-bae7-47ce-b7bc-c093b7133dfc">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="2079e0b4-5fb6-403b-a69a-1f39fd96c0b7">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2607,9 +2607,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="476a42e2-6778-4b2b-8f9b-77aec5a538dd">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="20679a94-74fe-4055-b7d8-3a2014dcc049">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2642,9 +2642,9 @@
       <statement statement-id="pe-10_smt.a" uuid="02b0b8c7-777b-47ce-869b-d5cccc151d99">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d1b09916-2698-4642-bddd-7e3f6b69e1e1">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f556c40b-a2d8-4f2a-bdaa-5a37073548fe">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2668,9 +2668,9 @@
       <statement statement-id="pe-10_smt.b" uuid="44948122-7c33-4405-a59c-38b61dd749e8">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7600b228-0413-4e7b-91ae-24537ad02f25">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="291bebf7-594a-401d-a2c0-d24d2aac6bf2">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2694,9 +2694,9 @@
       <statement statement-id="pe-10_smt.c" uuid="8dbf42f3-959a-4a1e-83b9-24e0b50034bc">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="b8c7793c-8209-4280-97ec-8637c6e55fd3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="b37cec5a-2b40-477f-976d-f0e264dd2b8e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2729,9 +2729,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4e691a77-ec56-4ad4-b532-7ed71b9b08aa">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="01f1d712-a58c-40b5-aa5b-ea123f03d7dc">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2760,9 +2760,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="7a0ef9ab-66e7-47a6-b25a-3db8378d04f8">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="d6d16f6d-5ac5-4c94-8066-d9bc1c67eb82">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2791,9 +2791,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="7153a18a-1c44-43f9-b897-a7c51f024d40">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="956fb932-4841-402b-9b3d-3393ad295dfd">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2822,9 +2822,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="12f7481f-055d-46d3-bb53-86d7e3651e26">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="178d5628-b2fc-40ee-ad44-ba6b95888b99">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2859,9 +2859,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="d68dcfcc-48bd-440d-a7e0-8c0699449ad6">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="9f2515b3-e250-4449-9779-28bcd6faf77d">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2896,9 +2896,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4ede96a6-6cac-4dfb-9769-40f341192bea">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="e28bff74-96a4-454d-98d7-c59e122d63fb">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2927,9 +2927,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="47f93be9-2806-4939-b7cb-4dc13784717a">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="d7caf3b3-f81b-42ef-9afc-926cee762d34">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2965,9 +2965,9 @@
       <statement statement-id="pe-14_smt.a" uuid="9d92c32b-1310-4f6a-a2fd-b26ddc9dc213">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="bd8d9613-c072-44fe-8674-147d13925382">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="24d459a8-dd81-4881-ae25-6f69a155a174">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2991,9 +2991,9 @@
       <statement statement-id="pe-14_smt.b" uuid="350236fb-96f3-4638-acfe-ad8168e789f3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="e126ea00-6678-4b2d-a171-d75a0a0f3d9a">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9ff9038d-e1f7-4d3f-a5b0-ff301848eeaf">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3023,9 +3023,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="20c0da71-a712-46c1-84a2-856fd428f7f3">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="a1ef191c-a130-4145-82ca-fa1895af11dd">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3054,9 +3054,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="3b39a1d5-d58b-40cc-a800-126c564f7da4">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="ac93fa47-dd7d-445a-a407-cb93947580ca">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3088,9 +3088,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="00c98ea4-1a92-4f46-ad19-49934bbba173">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="7b581e32-56d2-4243-9057-8d57c7ec842e">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3122,9 +3122,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="f8d231f5-d9be-42cc-be78-dad690e480c1">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="4bb45439-3b70-4a5c-adcd-e4becd0b14c9">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3157,9 +3157,9 @@
       <statement statement-id="pe-17_smt.a" uuid="d963c814-c496-4547-b9dc-6c3559cd34ce">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="965e16bb-a4b1-4396-b523-baa8e0b9a5bc">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="311bf6f3-8920-44bf-a216-3aad35b27614">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3183,9 +3183,9 @@
       <statement statement-id="pe-17_smt.b" uuid="3dae23b7-cb0e-4c94-becf-24a6fd9e1670">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7091b24c-1aa1-49d7-9ad6-bae60f88d0e3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="7fd2e269-a354-440d-bc52-6a158fb2dbd4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3209,9 +3209,9 @@
       <statement statement-id="pe-17_smt.c" uuid="15ffd4f8-6e97-4eb7-8764-4e155be417d7">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="4df3485f-407d-42b8-ab8e-8c634216c51b">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="81f4d2b6-91de-48eb-a0ad-8afe37eccd2d">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3244,9 +3244,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="15a1aa21-71d2-4728-9b0b-38fbe10f8b86">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="78a2ecba-1b3b-4aac-ad0b-f0ce572aea46">
             <description>
               <p>This control associated with hardware components within AWS is generally either
diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index 8531014..00bfaa2 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -581,7 +581,7 @@
     </system-implementation>
     <control-implementation>
         <description>
-            <p>FedRAMP SSP Template Section 13</p>
+            <p>This is a palceholder for the FedRAMP SSP Template Section 13</p>
             <p>This description field is required by OSCAL.</p>
             <p>FedRAMP does not require any specific information here.</p>
         </description>

From 876051a099170afcefdddbc8c734b2bd6b5f49ff Mon Sep 17 00:00:00 2001
From: Iorga <miorga@pn135438.lan>
Date: Wed, 5 Jun 2024 07:45:54 -0400
Subject: [PATCH 07/36] Update of account_workflow document

---
 .gitignore          |  1 +
 account_workflow.md | 27 +++++++++++++++++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 579c978..29ffb99 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 .DS_Store
 .vscode/*
+.history/*
 *.pyc
 __pycache__/
 draft-*
diff --git a/account_workflow.md b/account_workflow.md
index b814f97..f51ead5 100644
--- a/account_workflow.md
+++ b/account_workflow.md
@@ -1,8 +1,23 @@
 # Account Management Workflow
-Document that explains the workflow of GitHub actions used to automate account management.
 
-The requester creates a new GitHub issue (Account Request Form) to request an account for the Account Holder.\
-The Blossom Management group is automatically notified to review this request through GitHub.\
-A Blossom Management member reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED\
-If ACCOUNT_APPROVED, the Blossom Sysdevs group is automatically notified to implement the account and submit a new issue (Account Management Authorization Form) for the Account Holder.\
-If ACCOUNT_REJECTED, the account request issue is automatically closed.
\ No newline at end of file
+This document explains the workflow of GitHub actions used to automate Blossom service's accounts management.
+
+## Account Request and Creation
+-[ ] The requester requests an account for the Account Holder by creating a new GitHub issue using the Account Request Form.
+-[ ] The Blossom Management group is automatically notified to review the request through GitHub.
+-[ ] One of the Blossom Management (a member of the Blossom Management group) reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED
+-[ ] If the account is approved and the label ACCOUNT_APPROVED is added, the Blossom Sysdevs group is automatically notified to implement the account.
+-[ ] Upon completion of creating the account requested, the Blossom Sysdev submits a new GitHub issue using the Account Management Authorization Form for the Account Holder.
+-[ ] If ACCOUNT_REJECTED, the account request issue is automatically closed.
+
+## Account Disable
+[TBD]
+
+## Account Enable
+[TBD]
+
+## Account Change
+[TBD]
+
+## Account Deletion
+[TBD]

From fc61406cb16c2c5850b4899b778343132de7f883 Mon Sep 17 00:00:00 2001
From: Iorga <miorga@pn135438.campus.nist.gov>
Date: Tue, 4 Jun 2024 15:46:15 -0400
Subject: [PATCH 08/36] Fixed validation errors in AWS SSP.

---
 .gitignore                                    |   2 +
 ...moderate_profile_resolved_to_catalog.json} |   0
 .../ssp/aws_leveraged_authorization_ssp.json  | 192 +++++++++
 ..._moderate_profile_resolved_to_catalog.xml} |   9 +-
 .../ssp/aws_leveraged_authorization_ssp.xml   | 384 +++++++++---------
 .../xml/ssp/blossom_admin_member_ssp.xml      |   2 +-
 6 files changed, 392 insertions(+), 197 deletions(-)
 rename oscal-content/json/{profile/blossom_moderate_profile_resolved.json => catalog/blossom_moderate_profile_resolved_to_catalog.json} (100%)
 rename oscal-content/xml/{profile/blossom_moderate_profile_resolved.xml => catalog/blossom_moderate_profile_resolved_to_catalog.xml} (99%)

diff --git a/.gitignore b/.gitignore
index 3532e70..579c978 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,5 @@ draft-*
 .pyenv*
 .env*
 oscal-cli.txt
+# Ignore validation tool oscal-cli 
+build/oscal-cli
diff --git a/oscal-content/json/profile/blossom_moderate_profile_resolved.json b/oscal-content/json/catalog/blossom_moderate_profile_resolved_to_catalog.json
similarity index 100%
rename from oscal-content/json/profile/blossom_moderate_profile_resolved.json
rename to oscal-content/json/catalog/blossom_moderate_profile_resolved_to_catalog.json
diff --git a/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json b/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json
index bc38bf9..d06f9f7 100644
--- a/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json
+++ b/oscal-content/json/ssp/aws_leveraged_authorization_ssp.json
@@ -224,6 +224,7 @@
         "information-types" : [ {
           "uuid" : "27e034c9-2164-47c1-ba0b-8eb56c941842",
           "title" : "Corrective Action (Policy/Regulation)",
+          "description" : "TBD",
           "categorizations" : [ {
             "system" : "https://doi.org/10.6028/NIST.SP.800-60v2r1",
             "information-type-ids" : [ "C.2.1.1" ]
@@ -251,11 +252,13 @@
         "state" : "operational"
       },
       "authorization-boundary" : {
+        "description" : "TBD",
         "diagrams" : [ {
           "uuid" : "1d92b6f3-1260-421c-9bda-5c4a7739f0d1"
         } ]
       },
       "network-architecture" : {
+        "description" : "TBD",
         "diagrams" : [ {
           "uuid" : "2d92b6f3-1260-421c-9bda-5c4a7739f0d2"
         } ]
@@ -384,6 +387,7 @@
             "uuid" : "1398d737-8041-4774-bed3-668d90617860",
             "description" : "TBD:",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f5c1b59c-04ff-4821-980a-e10c18e379a8",
                 "description" : "TBD:"
@@ -429,7 +433,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "fdecdd89-e6ce-40d7-97a9-55d3a57abb8c",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9c4a8b31-fe34-4b5f-933d-2a1c448a4ef2",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -447,7 +453,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2cd8b8e6-673a-4470-8534-13b5e2c9a240",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "bbeec595-6c96-4102-ac5d-a7675ed6c529",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -486,7 +494,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "8103b498-0f37-4106-92e0-d88886da6eb3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9678dd9d-6125-45b7-ba22-9fa41f03f72e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -504,7 +514,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "ea52159a-8bc8-4a7e-b552-6cfd49291a6b",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6b0ef9b2-6b7d-4178-b8e8-1f9ffc471045",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -522,7 +534,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "8ed49eba-7071-4d05-8a72-7170cd70e073",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9af6d025-089c-4b60-aa2a-f2301a1f4ba1",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -540,7 +554,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "aed2636d-73bc-4484-aa02-744c7d7766e3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "72a3d5fb-6021-4052-8b8d-645f445f1de9",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -558,7 +574,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "eaaf5c14-f217-4f73-9a05-6238ee9e2e00",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "63b1f1a3-ed64-4b3b-91f0-80255ccfdd80",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -576,7 +594,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d4182aa0-508a-4bf4-97d7-7c351b34f8c9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6ba7424b-ec07-494c-a937-315be22012df",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -605,7 +625,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "bd636006-e24a-48a6-826d-e140ce79688b",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "13f36d45-615b-41e2-9760-6731a543e3b5",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -633,7 +655,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "c938abfb-d25c-4810-acba-7676d2462a88",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c906e5b4-40ce-42e0-af33-6e70e2f93499",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -661,7 +685,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "17a3d2b4-9caa-405c-bfe3-ef4f43b7f7bf",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "dfa89026-ff35-47e6-8c3f-cc4b2b623dd6",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -696,7 +722,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7a32cdf4-0904-4c26-8f1d-9906d35ede53",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "ebfb1122-fd4b-49d2-acc2-349d54db3c51",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -714,7 +742,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "e06595df-f3b7-4ce5-a510-6ca8fe068b72",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6e8f46ce-8f4e-40f1-95a8-71430a769709",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -732,7 +762,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "cc0efa05-1f76-46d3-a974-3d96b3257d64",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "36d198cc-91e3-4f0b-a633-7cc256d29c42",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -750,7 +782,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "0702e1b5-f95a-47b8-8244-a66ab38b0908",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "78df87ae-283c-4626-981a-e14291a0c8dd",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -782,7 +816,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "a68e4b6a-b77e-485d-aa8a-e785fc158085",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "4d23c4d8-b0cb-4a8a-9d64-aa24da8ab619",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -800,7 +836,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "42c76696-a674-464a-9229-6c6c3efae55d",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "35ab73e0-937c-48c3-b02f-fc2d10b1a81e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -818,7 +856,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d6522c04-d78d-4672-b4d5-297e035a4a47",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "8b875c18-e130-40ef-9f54-479c9593dbb4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -836,7 +876,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "b2c30e47-7e20-4d8c-a8a5-76e14371f047",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "3486928c-60a9-4549-a090-1b56af560221",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -854,7 +896,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "a0710b8a-49a7-42f9-9c6b-c15345f3fbee",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f075f560-32f2-4ec6-bd12-868d3bdd2310",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -883,7 +927,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "c190a70f-74f3-4f4a-bf1b-b7a373816d48",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "d07af2dd-4725-4651-89d8-d732eb20fb22",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -914,7 +960,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "ffe84fd7-6541-4b14-b09e-dbd792d76ef3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "bbf26c5d-bb82-4d70-b4f2-882afe6d9bf4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -932,7 +980,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "747dc783-b19e-49bb-ab71-f095f7b3011f",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "faa72600-62e7-4440-b241-63ec94afd763",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -961,7 +1011,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "f42c46cb-443d-459e-9aae-8bbf3b82edaf",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "1d56cf05-5ccc-4491-b506-8cebae18963a",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -992,7 +1044,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d8cc5638-2afe-459d-a3cb-a01976aeac85",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "441dadf2-bef9-4e06-8f43-dd03b441acdd",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1010,7 +1064,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "96892541-9b58-440e-b44e-3998a4a7be84",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "627ba3bb-1a54-4cf5-ad56-7155247f5280",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1028,7 +1084,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "02655970-983a-4b85-a49f-587749ce3d19",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "245d3044-c5f1-4167-9a6e-2c29388bba5e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1060,7 +1118,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "24ee516c-0d3f-4960-90b7-afa66abc28a9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f4a058aa-a41c-4c58-9758-6c79f980fd18",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1078,7 +1138,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7fe0f375-88a4-4fb0-b38c-d4a500e3b1d9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "86b5fad1-4e75-43da-b257-9467fff7acfe",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1114,7 +1176,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "409c1e47-be79-43bf-aa2c-0fed0889c6d0",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c81f9919-29f5-455b-a40d-3240093a0be5",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1155,7 +1219,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "092bfd62-aa7b-4409-a875-5fff7d2975b5",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "32b76454-93db-4bd1-9222-9604e6c5f7c7",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1173,7 +1239,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d862d207-64d0-4d00-bcbe-097ea62ba6f5",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "b7367d62-0528-426b-8f97-f68a9530d619",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1209,7 +1277,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "9aaadee4-d49f-4de8-87ae-558fc6352e13",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "52572cd0-59ae-4248-8f07-68757ed538ec",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1247,7 +1317,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "3d05b563-2cb8-4e38-8f56-694f60a2453f",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "af8ae830-df78-443c-bf0f-dc164f0d90b3",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1265,7 +1337,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "bda847e5-11cc-4d9f-857a-45f8819fd230",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "ffc17fe4-0e82-4292-8fd0-493905941d48",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1304,7 +1378,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2e132311-f565-4aed-9614-ccc6a77158e2",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "a02735f9-5446-4ed4-8c26-5ab744ae1b04",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1322,7 +1398,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "91fa9408-1373-4254-9159-cb2695e615a8",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "70698d4a-e8c2-4b9c-9395-c0582d8b8022",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1361,7 +1439,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "c487bf9a-c8fc-4180-92dc-ee528ece1949",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "6056c6b8-60b1-498b-acf4-3d6c6fe8830a",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1379,7 +1459,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "40d22136-bb9c-4366-889b-6e59f8332069",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "01fa8cff-5d8e-4e04-af66-9384ee9c3606",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1397,7 +1479,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "4c84e881-7969-45ce-be75-7b223d4d1be3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "03f61f6e-7c67-4701-a9cd-30563989a670",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1415,7 +1499,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "dee24e7a-a80e-4598-b281-e15f6d247e4d",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "769edda4-b4ed-4671-978d-85b16bfd564e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1444,7 +1530,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "902a1af4-6479-4833-8d22-3efdf7d30edc",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "f7c948c9-b471-4a53-a56a-af75ece5d75e",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1482,7 +1570,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7e5a2ff0-9bb8-4e96-b3ea-8ee6c7ae189e",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "80e0c1ad-0366-4d71-a228-e81f553daf70",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1500,7 +1590,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2f0f0bfa-fa0e-4245-b54a-926b349f5f6b",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "1b8d9da7-1c8e-4b05-af8c-b4887adcfe2a",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1529,7 +1621,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "3c52d224-4181-42e6-a477-96862a7547ea",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c803d36a-1e21-4f51-9380-29fdaca0c823",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1561,7 +1655,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "5bf37408-0101-487e-82d3-6aef883b259d",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "ad041938-5dff-484d-8ecd-3888b3f30781",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1593,7 +1689,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "f5ac2d2d-abeb-4ad5-be32-83225ff6a8da",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "373974c4-c109-4b09-81f7-bf16ab35794d",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1634,7 +1732,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "e93f9b10-7017-4bbb-beb2-c0c60a11570e",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c5ca7ce6-d6bd-4b15-bfff-222f9c04b23a",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1662,7 +1762,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4e1cfda5-3463-4dff-ab6f-ee82d4fc12d4",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "01a0d189-d163-42ef-971e-f483eb1a89e3",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1703,7 +1805,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "5f8020ca-afa5-41d3-8b8c-29372db8af1d",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "febe4d8a-4107-4e8f-9bca-c9a0c96d7cb0",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1721,7 +1825,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "5b81c845-e335-4854-9189-bbbdeeb8c220",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "920d4c86-6f4a-4b57-a991-3ec6c62a5cfd",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1757,7 +1863,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "c463ebb0-ec05-4bdf-af2e-b44b0ab9ed7e",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "5643f75d-672b-465b-869e-c6c80962c9be",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1775,7 +1883,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "0a8cdb94-3fbc-4c0e-a4a1-5bbbeb85aca2",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "3301e8bd-5cdc-4cc6-835e-ac8af07d7f5c",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1793,7 +1903,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "8b94c5b1-f4c9-47e4-b2e6-1b3ba3ff0808",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "cfeb89af-a484-49c4-9988-96237c86944e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1811,7 +1923,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2f9fe10b-ba9e-4291-98b5-13bb6fc0c58c",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "e7024325-6340-4e1f-a4b8-c741d1e36bb4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1871,7 +1985,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "3b3ecf6b-d4a9-499c-a5d1-2887b4987aca",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "542b2329-5497-456f-b117-746e798b9929",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1889,7 +2005,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "ead33ba5-eb15-48e3-900e-8a3e9cf289d9",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "96ff07de-683f-4181-8813-ae4498d66f05",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1907,7 +2025,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "66ece908-ee7b-468b-a5b4-e900aa724ea1",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f4c09934-895b-40e8-b122-aa08ea9b50ba",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1925,7 +2045,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2db60ecd-c0a9-4be8-a6b5-c4bb45d9ec49",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "81660f14-0393-4219-98ac-9e2c8f7142f6",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1943,7 +2065,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "72dfa4c9-d24a-4ac2-8c66-46e0992e9158",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "0a453bbe-cb88-45c8-b6ae-5033bc09feff",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1961,7 +2085,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "27000dc4-4d7c-4e0c-aa8a-581babfe7745",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "e7799c91-b885-4d4e-b198-a7988c76c3ad",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -1979,7 +2105,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "2040d1a5-ddd0-405d-8edd-e58f77a59ad3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "92842d62-9ca0-46f9-a431-abf9e6b4f594",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2012,7 +2140,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "6d925c2b-0462-4a75-aa45-03b73c017307",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "c2ac04dc-acb4-418a-84e5-b58730f01dee",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2047,7 +2177,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "bec2e74d-c33d-4232-a4ac-424abf2637ff",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "cd19a3a6-00e2-4a44-9c63-bf795f9c93d1",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2075,7 +2207,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4a99e9c6-ff33-4a37-abc9-b6b9ca7d4657",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "259c0c8f-3bb9-4e43-877b-c896a20aee7d",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2113,7 +2247,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "6fd8dba3-df21-4c25-9994-95a66c3c74be",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f5320fa1-6ce9-4ef6-a6a8-422f619a41f9",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2131,7 +2267,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "4d196aef-1385-4bf2-8b00-28258e22b677",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "b62d1197-e6c0-4b42-8f77-02b311b8faab",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2149,7 +2287,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "c148993e-862d-40b1-b670-f19db4114e95",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "25356503-3b18-4a0e-b97a-cf243e4e174c",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2178,7 +2318,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "70e9c839-37dc-48c9-ac6a-d34bf6dbaa17",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "e9a252ad-ff10-43ca-a790-024d5c8771ae",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2210,7 +2352,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "8727a64e-a367-4b17-86b1-742dada3a0c1",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "59b5f4ea-33eb-4000-a636-aaa4004e29b0",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2248,7 +2392,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "83d8d2e9-abb0-442a-a232-b6b3ade4040e",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9301b521-7676-45eb-9d3c-a7466b652b84",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2266,7 +2412,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "36ab955e-ac9b-4fd5-83a9-2cc35c5fa5b8",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "dc217439-df1e-4d91-ae4c-10b790b961e4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2295,7 +2443,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "5e212f76-bae7-47ce-b7bc-c093b7133dfc",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "2079e0b4-5fb6-403b-a69a-1f39fd96c0b7",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2323,7 +2473,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "476a42e2-6778-4b2b-8f9b-77aec5a538dd",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "20679a94-74fe-4055-b7d8-3a2014dcc049",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2358,7 +2510,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "d1b09916-2698-4642-bddd-7e3f6b69e1e1",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "f556c40b-a2d8-4f2a-bdaa-5a37073548fe",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2376,7 +2530,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7600b228-0413-4e7b-91ae-24537ad02f25",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "291bebf7-594a-401d-a2c0-d24d2aac6bf2",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2394,7 +2550,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "b8c7793c-8209-4280-97ec-8637c6e55fd3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "b37cec5a-2b40-477f-976d-f0e264dd2b8e",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2427,7 +2585,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4e691a77-ec56-4ad4-b532-7ed71b9b08aa",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "01f1d712-a58c-40b5-aa5b-ea123f03d7dc",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2455,7 +2615,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "7a0ef9ab-66e7-47a6-b25a-3db8378d04f8",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "d6d16f6d-5ac5-4c94-8066-d9bc1c67eb82",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2483,7 +2645,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "7153a18a-1c44-43f9-b897-a7c51f024d40",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "956fb932-4841-402b-9b3d-3393ad295dfd",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2511,7 +2675,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "12f7481f-055d-46d3-bb53-86d7e3651e26",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "178d5628-b2fc-40ee-ad44-ba6b95888b99",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2546,7 +2712,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "d68dcfcc-48bd-440d-a7e0-8c0699449ad6",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "9f2515b3-e250-4449-9779-28bcd6faf77d",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2581,7 +2749,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "4ede96a6-6cac-4dfb-9769-40f341192bea",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "e28bff74-96a4-454d-98d7-c59e122d63fb",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2609,7 +2779,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "47f93be9-2806-4939-b7cb-4dc13784717a",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "d7caf3b3-f81b-42ef-9afc-926cee762d34",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2647,7 +2819,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "bd8d9613-c072-44fe-8674-147d13925382",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "24d459a8-dd81-4881-ae25-6f69a155a174",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2665,7 +2839,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "e126ea00-6678-4b2d-a171-d75a0a0f3d9a",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "9ff9038d-e1f7-4d3f-a5b0-ff301848eeaf",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2694,7 +2870,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "20c0da71-a712-46c1-84a2-856fd428f7f3",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "a1ef191c-a130-4145-82ca-fa1895af11dd",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2722,7 +2900,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "3b39a1d5-d58b-40cc-a800-126c564f7da4",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "ac93fa47-dd7d-445a-a407-cb93947580ca",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2754,7 +2934,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "00c98ea4-1a92-4f46-ad19-49934bbba173",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "7b581e32-56d2-4243-9057-8d57c7ec842e",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2786,7 +2968,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "f8d231f5-d9be-42cc-be78-dad690e480c1",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "4bb45439-3b70-4a5c-adcd-e4becd0b14c9",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2821,7 +3005,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "965e16bb-a4b1-4396-b523-baa8e0b9a5bc",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "311bf6f3-8920-44bf-a216-3aad35b27614",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2839,7 +3025,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "7091b24c-1aa1-49d7-9ad6-bae60f88d0e3",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "7fd2e269-a354-440d-bc52-6a158fb2dbd4",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2857,7 +3045,9 @@
           "by-components" : [ {
             "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
             "uuid" : "4df3485f-407d-42b8-ab8e-8c634216c51b",
+            "description" : "TBD",
             "export" : {
+              "description" : "TBD",
               "provided" : [ {
                 "uuid" : "81f4d2b6-91de-48eb-a0ad-8afe37eccd2d",
                 "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
@@ -2890,7 +3080,9 @@
         "by-components" : [ {
           "component-uuid" : "463e6979-b660-4e61-b475-90777d228307",
           "uuid" : "15a1aa21-71d2-4728-9b0b-38fbe10f8b86",
+          "description" : "TBD",
           "export" : {
+            "description" : "TBD",
             "provided" : [ {
               "uuid" : "78a2ecba-1b3b-4aac-ad0b-f0ce572aea46",
               "description" : "This control associated with hardware components within AWS is generally either partially or fully inherited from the AWS physical infrastructure. For the U.S. East, U.S. West, and GovCloud regions, this control is inherited from pre-existing Agency Authority to Operate (ATO) or JAB provisional Authority to Operate."
diff --git a/oscal-content/xml/profile/blossom_moderate_profile_resolved.xml b/oscal-content/xml/catalog/blossom_moderate_profile_resolved_to_catalog.xml
similarity index 99%
rename from oscal-content/xml/profile/blossom_moderate_profile_resolved.xml
rename to oscal-content/xml/catalog/blossom_moderate_profile_resolved_to_catalog.xml
index 145e83d..3f127d0 100644
--- a/oscal-content/xml/profile/blossom_moderate_profile_resolved.xml
+++ b/oscal-content/xml/catalog/blossom_moderate_profile_resolved_to_catalog.xml
@@ -1,12 +1,13 @@
-<?xml version="1.0" encoding="UTF-8"?> 
-<catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="b3a34ee2-d735-4ccd-81bb-a872163c015a">
+<?xml version="1.0" encoding="UTF-8"?>
+<catalog xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="869579ff-2f43-4f60-9f88-d753858e6c01">
     <metadata>
         <title>NIST BloSS@M Tailored Moderate Baseline</title>
-        <last-modified>2024-03-20T21:24:47.769914Z</last-modified>
+        <last-modified>2024-05-30T18:28:59.688431Z</last-modified>
         <version>0.0.1</version>
         <oscal-version>1.1.2</oscal-version>
         <prop name="resolution-tool" value="libOSCAL-Java" />
-        <link href="./blossom_moderate_profile.xml"
+        <link
+            href="file:///Users/miorga/Desktop/ALL_PROJECTS/GH/blossom-oscal/oscal-content/xml/profile/blossom_moderate_profile.xml"
             rel="source-profile" />
     </metadata>
     <group id="ac" class="family">
diff --git a/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml b/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml
index 47ceebe..5aee1fa 100644
--- a/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml
+++ b/oscal-content/xml/ssp/aws_leveraged_authorization_ssp.xml
@@ -181,7 +181,7 @@
       <prop name="sorn-id" ns="https://fedramp.gov/ns/oscal" value="n/a" class="pta" />
       <information-type uuid="27e034c9-2164-47c1-ba0b-8eb56c941842">
         <title>Corrective Action (Policy/Regulation)</title>
-        <description></description>
+        <description><p>TBD</p></description>
         <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
           <information-type-id>C.2.1.1</information-type-id>
         </categorization>
@@ -206,11 +206,11 @@
     </security-impact-level>
     <status state="operational" />
     <authorization-boundary>
-      <description></description>
+      <description><p>TBD</p></description>
       <diagram uuid="1d92b6f3-1260-421c-9bda-5c4a7739f0d1" />
     </authorization-boundary>
     <network-architecture>
-      <description></description>
+      <description><p>TBD</p></description>
       <diagram uuid="2d92b6f3-1260-421c-9bda-5c4a7739f0d2" />
     </network-architecture>
     <data-flow>
@@ -323,7 +323,7 @@
             <p>TBD:</p>
           </description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f5c1b59c-04ff-4821-980a-e10c18e379a8">
               <description>
                 <p>TBD:</p>
@@ -361,9 +361,9 @@
       <statement statement-id="ma-1_smt.a" uuid="75cb125e-62f9-4355-8ca0-02c8daefb2b4">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="fdecdd89-e6ce-40d7-97a9-55d3a57abb8c">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9c4a8b31-fe34-4b5f-933d-2a1c448a4ef2">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -387,9 +387,9 @@
       <statement statement-id="ma-1_smt.b" uuid="68b3a53d-4f77-4c50-9f2d-897204c315e9">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2cd8b8e6-673a-4470-8534-13b5e2c9a240">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="bbeec595-6c96-4102-ac5d-a7675ed6c529">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -426,9 +426,9 @@
       <statement statement-id="ma-2_smt.a" uuid="5f8dffe3-ae68-4f7c-8e70-b447eac788d3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="8103b498-0f37-4106-92e0-d88886da6eb3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9678dd9d-6125-45b7-ba22-9fa41f03f72e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -452,9 +452,9 @@
       <statement statement-id="ma-2_smt.b" uuid="60bf759d-9dcd-4fe1-bf65-8f280b5c7452">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="ea52159a-8bc8-4a7e-b552-6cfd49291a6b">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6b0ef9b2-6b7d-4178-b8e8-1f9ffc471045">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -478,9 +478,9 @@
       <statement statement-id="ma-2_smt.c" uuid="9eaab6a5-cacd-49a7-bd65-65486bbaeeac">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="8ed49eba-7071-4d05-8a72-7170cd70e073">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9af6d025-089c-4b60-aa2a-f2301a1f4ba1">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -504,9 +504,9 @@
       <statement statement-id="ma-2_smt.d" uuid="4b2754cf-3ec7-46e5-8db4-7f326758114a">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="aed2636d-73bc-4484-aa02-744c7d7766e3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="72a3d5fb-6021-4052-8b8d-645f445f1de9">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -530,9 +530,9 @@
       <statement statement-id="ma-2_smt.e" uuid="92384784-fa20-44c5-aa2d-b77fd67b5580">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="eaaf5c14-f217-4f73-9a05-6238ee9e2e00">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="63b1f1a3-ed64-4b3b-91f0-80255ccfdd80">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -556,9 +556,9 @@
       <statement statement-id="ma-2_smt.f" uuid="a6ce1628-0215-488b-bc98-5d2c880a9acc">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d4182aa0-508a-4bf4-97d7-7c351b34f8c9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6ba7424b-ec07-494c-a937-315be22012df">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -588,9 +588,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="bd636006-e24a-48a6-826d-e140ce79688b">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="13f36d45-615b-41e2-9760-6731a543e3b5">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -619,9 +619,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="c938abfb-d25c-4810-acba-7676d2462a88">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c906e5b4-40ce-42e0-af33-6e70e2f93499">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -650,9 +650,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="17a3d2b4-9caa-405c-bfe3-ef4f43b7f7bf">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="dfa89026-ff35-47e6-8c3f-cc4b2b623dd6">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -685,9 +685,9 @@
       <statement statement-id="ma-3.3_smt.a" uuid="ef1ee2f0-36e0-447d-8852-6d9180b7dba9">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7a32cdf4-0904-4c26-8f1d-9906d35ede53">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="ebfb1122-fd4b-49d2-acc2-349d54db3c51">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -711,9 +711,9 @@
       <statement statement-id="ma-3.3_smt.b" uuid="49974331-353f-49d8-9490-f631c913b7db">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="e06595df-f3b7-4ce5-a510-6ca8fe068b72">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6e8f46ce-8f4e-40f1-95a8-71430a769709">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -737,9 +737,9 @@
       <statement statement-id="ma-3.3_smt.c" uuid="068c726c-93af-480d-8573-0a787f01a62f">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="cc0efa05-1f76-46d3-a974-3d96b3257d64">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="36d198cc-91e3-4f0b-a633-7cc256d29c42">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -763,9 +763,9 @@
       <statement statement-id="ma-3.3_smt.d" uuid="8b03d644-f625-4c1d-a1ab-d3f63e4af9e3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="0702e1b5-f95a-47b8-8244-a66ab38b0908">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="78df87ae-283c-4626-981a-e14291a0c8dd">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -796,9 +796,9 @@
       <statement statement-id="ma-4_smt.a" uuid="534d9827-d24e-4d72-bd58-ca872339e2ea">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="a68e4b6a-b77e-485d-aa8a-e785fc158085">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="4d23c4d8-b0cb-4a8a-9d64-aa24da8ab619">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -822,9 +822,9 @@
       <statement statement-id="ma-4_smt.b" uuid="fce5db07-1512-46ca-bbcc-1bee7566e9bf">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="42c76696-a674-464a-9229-6c6c3efae55d">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="35ab73e0-937c-48c3-b02f-fc2d10b1a81e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -848,9 +848,9 @@
       <statement statement-id="ma-4_smt.c" uuid="e221ff63-592d-4fc2-bc91-2c3e4aa835f3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d6522c04-d78d-4672-b4d5-297e035a4a47">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="8b875c18-e130-40ef-9f54-479c9593dbb4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -874,9 +874,9 @@
       <statement statement-id="ma-4_smt.d" uuid="bc1e4825-edc4-4135-a8f9-f44728e7bfb3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="b2c30e47-7e20-4d8c-a8a5-76e14371f047">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="3486928c-60a9-4549-a090-1b56af560221">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -900,9 +900,9 @@
       <statement statement-id="ma-4_smt.e" uuid="103a952c-8e5c-4460-bc18-209aafc7e638">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="a0710b8a-49a7-42f9-9c6b-c15345f3fbee">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f075f560-32f2-4ec6-bd12-868d3bdd2310">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -932,9 +932,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="c190a70f-74f3-4f4a-bf1b-b7a373816d48">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="d07af2dd-4725-4651-89d8-d732eb20fb22">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -964,9 +964,9 @@
       <statement statement-id="ma-4.3_smt.a" uuid="b042ccd2-364d-4b56-bca6-6c60e8345daf">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="ffe84fd7-6541-4b14-b09e-dbd792d76ef3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="bbf26c5d-bb82-4d70-b4f2-882afe6d9bf4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -990,9 +990,9 @@
       <statement statement-id="ma-4.3_smt.b" uuid="96e6369a-1a61-43a5-8a2d-90434fcde3f1">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="747dc783-b19e-49bb-ab71-f095f7b3011f">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="faa72600-62e7-4440-b241-63ec94afd763">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1022,9 +1022,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="f42c46cb-443d-459e-9aae-8bbf3b82edaf">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="1d56cf05-5ccc-4491-b506-8cebae18963a">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1054,9 +1054,9 @@
       <statement statement-id="ma-5_smt.a" uuid="667a498d-4506-4e12-877f-1ba358af0429">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d8cc5638-2afe-459d-a3cb-a01976aeac85">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="441dadf2-bef9-4e06-8f43-dd03b441acdd">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1080,9 +1080,9 @@
       <statement statement-id="ma-5_smt.b" uuid="a1260a7d-8d8f-4c96-a7e6-96356d7de2dd">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="96892541-9b58-440e-b44e-3998a4a7be84">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="627ba3bb-1a54-4cf5-ad56-7155247f5280">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1106,9 +1106,9 @@
       <statement statement-id="ma-5_smt.c" uuid="074b97bf-22ed-4ea4-bb3f-ff513fd72b10">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="02655970-983a-4b85-a49f-587749ce3d19">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="245d3044-c5f1-4167-9a6e-2c29388bba5e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1139,9 +1139,9 @@
       <statement statement-id="ma-5.1_smt.a" uuid="c7880006-48e7-4695-9cd8-c2baea2beb9b">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="24ee516c-0d3f-4960-90b7-afa66abc28a9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f4a058aa-a41c-4c58-9758-6c79f980fd18">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1165,9 +1165,9 @@
       <statement statement-id="ma-5.1_smt.b" uuid="9261d0ff-39df-495c-890d-222266da9e46">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7fe0f375-88a4-4fb0-b38c-d4a500e3b1d9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="86b5fad1-4e75-43da-b257-9467fff7acfe">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1203,9 +1203,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="409c1e47-be79-43bf-aa2c-0fed0889c6d0">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c81f9919-29f5-455b-a40d-3240093a0be5">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1244,9 +1244,9 @@
       <statement statement-id="mp-1_smt.a" uuid="d6c5e233-9c58-4995-b066-ae0096db33b6">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="092bfd62-aa7b-4409-a875-5fff7d2975b5">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="32b76454-93db-4bd1-9222-9604e6c5f7c7">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1270,9 +1270,9 @@
       <statement statement-id="mp-1_smt.b" uuid="55367813-21da-4944-ade8-e5bfa51158fc">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d862d207-64d0-4d00-bcbe-097ea62ba6f5">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="b7367d62-0528-426b-8f97-f68a9530d619">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1308,9 +1308,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="9aaadee4-d49f-4de8-87ae-558fc6352e13">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="52572cd0-59ae-4248-8f07-68757ed538ec">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1346,9 +1346,9 @@
       <statement statement-id="mp-3_smt.a" uuid="a12cc57f-73c6-46f7-96c5-1d7569dc7b16">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="3d05b563-2cb8-4e38-8f56-694f60a2453f">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="af8ae830-df78-443c-bf0f-dc164f0d90b3">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1372,9 +1372,9 @@
       <statement statement-id="mp-3_smt.b" uuid="a70fb01b-23b1-4114-b7cd-3167170fa844">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="bda847e5-11cc-4d9f-857a-45f8819fd230">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="ffc17fe4-0e82-4292-8fd0-493905941d48">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1411,9 +1411,9 @@
       <statement statement-id="mp-4_smt.a" uuid="062d392a-53e1-4246-b740-b15bb9e2e03d">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2e132311-f565-4aed-9614-ccc6a77158e2">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="a02735f9-5446-4ed4-8c26-5ab744ae1b04">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1437,9 +1437,9 @@
       <statement statement-id="mp-4_smt.b" uuid="db618aa6-8036-4926-b0a6-e4b2eb4a96f1">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="91fa9408-1373-4254-9159-cb2695e615a8">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="70698d4a-e8c2-4b9c-9395-c0582d8b8022">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1476,9 +1476,9 @@
       <statement statement-id="mp-5_smt.a" uuid="f8cec15a-d299-414c-9c64-73e7246e02ad">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="c487bf9a-c8fc-4180-92dc-ee528ece1949">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="6056c6b8-60b1-498b-acf4-3d6c6fe8830a">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1502,9 +1502,9 @@
       <statement statement-id="mp-5_smt.b" uuid="c3ee7827-ea71-45ec-a42f-e57861475613">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="40d22136-bb9c-4366-889b-6e59f8332069">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="01fa8cff-5d8e-4e04-af66-9384ee9c3606">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1528,9 +1528,9 @@
       <statement statement-id="mp-5_smt.c" uuid="0bf36497-e148-4a90-91c4-7a2ea27f9fce">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="4c84e881-7969-45ce-be75-7b223d4d1be3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="03f61f6e-7c67-4701-a9cd-30563989a670">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1554,9 +1554,9 @@
       <statement statement-id="mp-5_smt.d" uuid="83e4d0bf-9026-4e65-b154-3e032ee5333e">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="dee24e7a-a80e-4598-b281-e15f6d247e4d">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="769edda4-b4ed-4671-978d-85b16bfd564e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1586,9 +1586,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="902a1af4-6479-4833-8d22-3efdf7d30edc">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="f7c948c9-b471-4a53-a56a-af75ece5d75e">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1624,9 +1624,9 @@
       <statement statement-id="mp-6_smt.a" uuid="d10d7dbd-0aa8-4231-a0d2-125b5773d41b">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7e5a2ff0-9bb8-4e96-b3ea-8ee6c7ae189e">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="80e0c1ad-0366-4d71-a228-e81f553daf70">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1650,9 +1650,9 @@
       <statement statement-id="mp-6_smt.b" uuid="57d24452-7cf3-4f65-813d-94d5bbf06199">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2f0f0bfa-fa0e-4245-b54a-926b349f5f6b">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="1b8d9da7-1c8e-4b05-af8c-b4887adcfe2a">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1682,9 +1682,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="3c52d224-4181-42e6-a477-96862a7547ea">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c803d36a-1e21-4f51-9380-29fdaca0c823">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1716,9 +1716,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="5bf37408-0101-487e-82d3-6aef883b259d">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="ad041938-5dff-484d-8ecd-3888b3f30781">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1750,9 +1750,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="f5ac2d2d-abeb-4ad5-be32-83225ff6a8da">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="373974c4-c109-4b09-81f7-bf16ab35794d">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1793,9 +1793,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="e93f9b10-7017-4bbb-beb2-c0c60a11570e">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c5ca7ce6-d6bd-4b15-bfff-222f9c04b23a">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1824,9 +1824,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4e1cfda5-3463-4dff-ab6f-ee82d4fc12d4">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="01a0d189-d163-42ef-971e-f483eb1a89e3">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -1865,9 +1865,9 @@
       <statement statement-id="pe-1_smt.a" uuid="b5a77d0d-138f-4589-b1a4-b377fd1375ec">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="5f8020ca-afa5-41d3-8b8c-29372db8af1d">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="febe4d8a-4107-4e8f-9bca-c9a0c96d7cb0">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1891,9 +1891,9 @@
       <statement statement-id="pe-1_smt.b" uuid="be60b9f4-b8bc-4bb1-b16d-ecbd0bc20a72">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="5b81c845-e335-4854-9189-bbbdeeb8c220">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="920d4c86-6f4a-4b57-a991-3ec6c62a5cfd">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1927,9 +1927,9 @@
       <statement statement-id="pe-2_smt.a" uuid="0c63729b-9915-4b8d-8351-a4451962d905">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="c463ebb0-ec05-4bdf-af2e-b44b0ab9ed7e">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="5643f75d-672b-465b-869e-c6c80962c9be">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1953,9 +1953,9 @@
       <statement statement-id="pe-2_smt.b" uuid="a7ea7ab6-02ed-436d-8f69-9161826386ab">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="0a8cdb94-3fbc-4c0e-a4a1-5bbbeb85aca2">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="3301e8bd-5cdc-4cc6-835e-ac8af07d7f5c">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -1979,9 +1979,9 @@
       <statement statement-id="pe-2_smt.c" uuid="a6fb6a64-b831-42cc-a56b-6c59bc5d5a72">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="8b94c5b1-f4c9-47e4-b2e6-1b3ba3ff0808">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="cfeb89af-a484-49c4-9988-96237c86944e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2005,9 +2005,9 @@
       <statement statement-id="pe-2_smt.d" uuid="e3f2df89-19bf-4027-b560-67dc9424bd28">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2f9fe10b-ba9e-4291-98b5-13bb6fc0c58c">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="e7024325-6340-4e1f-a4b8-c741d1e36bb4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2065,9 +2065,9 @@
       <statement statement-id="pe-3_smt.a" uuid="27e29dda-49f9-40e3-a3fa-fd488a7ad3a0">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="3b3ecf6b-d4a9-499c-a5d1-2887b4987aca">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="542b2329-5497-456f-b117-746e798b9929">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2091,9 +2091,9 @@
       <statement statement-id="pe-3_smt.b" uuid="f734a63b-e2fe-4ce0-a7c5-693e79622d3d">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="ead33ba5-eb15-48e3-900e-8a3e9cf289d9">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="96ff07de-683f-4181-8813-ae4498d66f05">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2117,9 +2117,9 @@
       <statement statement-id="pe-3_smt.c" uuid="39f7c51b-a622-4dfd-91db-6f0e334e8b78">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="66ece908-ee7b-468b-a5b4-e900aa724ea1">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f4c09934-895b-40e8-b122-aa08ea9b50ba">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2143,9 +2143,9 @@
       <statement statement-id="pe-3_smt.d" uuid="7e392408-98ff-4769-9de1-03d4323a1385">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2db60ecd-c0a9-4be8-a6b5-c4bb45d9ec49">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="81660f14-0393-4219-98ac-9e2c8f7142f6">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2169,9 +2169,9 @@
       <statement statement-id="pe-3_smt.e" uuid="145b751f-7073-49b2-bc08-165465d34fe3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="72dfa4c9-d24a-4ac2-8c66-46e0992e9158">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="0a453bbe-cb88-45c8-b6ae-5033bc09feff">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2195,9 +2195,9 @@
       <statement statement-id="pe-3_smt.f" uuid="6a119ed5-0b0a-4b86-92b7-a8f94dd785b9">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="27000dc4-4d7c-4e0c-aa8a-581babfe7745">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="e7799c91-b885-4d4e-b198-a7988c76c3ad">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2221,9 +2221,9 @@
       <statement statement-id="pe-3_smt.g" uuid="1144efba-4812-442c-8fa3-b031018fdd74">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="2040d1a5-ddd0-405d-8edd-e58f77a59ad3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="92842d62-9ca0-46f9-a431-abf9e6b4f594">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2256,9 +2256,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="6d925c2b-0462-4a75-aa45-03b73c017307">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="c2ac04dc-acb4-418a-84e5-b58730f01dee">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2293,9 +2293,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="bec2e74d-c33d-4232-a4ac-424abf2637ff">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="cd19a3a6-00e2-4a44-9c63-bf795f9c93d1">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2324,9 +2324,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4a99e9c6-ff33-4a37-abc9-b6b9ca7d4657">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="259c0c8f-3bb9-4e43-877b-c896a20aee7d">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2362,9 +2362,9 @@
       <statement statement-id="pe-6_smt.a" uuid="ab2e243e-38e6-46e4-a95f-3dcc2c1572ba">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="6fd8dba3-df21-4c25-9994-95a66c3c74be">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f5320fa1-6ce9-4ef6-a6a8-422f619a41f9">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2388,9 +2388,9 @@
       <statement statement-id="pe-6_smt.b" uuid="36a84be2-8ef6-4a2b-a339-e8f8ab398ea3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="4d196aef-1385-4bf2-8b00-28258e22b677">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="b62d1197-e6c0-4b42-8f77-02b311b8faab">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2414,9 +2414,9 @@
       <statement statement-id="pe-6_smt.c" uuid="779dd08e-58f0-4763-8744-0da98254e3ac">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="c148993e-862d-40b1-b670-f19db4114e95">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="25356503-3b18-4a0e-b97a-cf243e4e174c">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2446,9 +2446,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="70e9c839-37dc-48c9-ac6a-d34bf6dbaa17">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="e9a252ad-ff10-43ca-a790-024d5c8771ae">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2480,9 +2480,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="8727a64e-a367-4b17-86b1-742dada3a0c1">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="59b5f4ea-33eb-4000-a636-aaa4004e29b0">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2518,9 +2518,9 @@
       <statement statement-id="pe-8_smt.a" uuid="04cb6129-5768-45ea-9c73-ef570eb7adc7">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="83d8d2e9-abb0-442a-a232-b6b3ade4040e">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9301b521-7676-45eb-9d3c-a7466b652b84">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2544,9 +2544,9 @@
       <statement statement-id="pe-8_smt.b" uuid="2336cea0-410f-43b5-ae7b-a29b99ec0589">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="36ab955e-ac9b-4fd5-83a9-2cc35c5fa5b8">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="dc217439-df1e-4d91-ae4c-10b790b961e4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2576,9 +2576,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="5e212f76-bae7-47ce-b7bc-c093b7133dfc">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="2079e0b4-5fb6-403b-a69a-1f39fd96c0b7">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2607,9 +2607,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="476a42e2-6778-4b2b-8f9b-77aec5a538dd">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="20679a94-74fe-4055-b7d8-3a2014dcc049">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2642,9 +2642,9 @@
       <statement statement-id="pe-10_smt.a" uuid="02b0b8c7-777b-47ce-869b-d5cccc151d99">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="d1b09916-2698-4642-bddd-7e3f6b69e1e1">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="f556c40b-a2d8-4f2a-bdaa-5a37073548fe">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2668,9 +2668,9 @@
       <statement statement-id="pe-10_smt.b" uuid="44948122-7c33-4405-a59c-38b61dd749e8">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7600b228-0413-4e7b-91ae-24537ad02f25">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="291bebf7-594a-401d-a2c0-d24d2aac6bf2">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2694,9 +2694,9 @@
       <statement statement-id="pe-10_smt.c" uuid="8dbf42f3-959a-4a1e-83b9-24e0b50034bc">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="b8c7793c-8209-4280-97ec-8637c6e55fd3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="b37cec5a-2b40-477f-976d-f0e264dd2b8e">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2729,9 +2729,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4e691a77-ec56-4ad4-b532-7ed71b9b08aa">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="01f1d712-a58c-40b5-aa5b-ea123f03d7dc">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2760,9 +2760,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="7a0ef9ab-66e7-47a6-b25a-3db8378d04f8">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="d6d16f6d-5ac5-4c94-8066-d9bc1c67eb82">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2791,9 +2791,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="7153a18a-1c44-43f9-b897-a7c51f024d40">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="956fb932-4841-402b-9b3d-3393ad295dfd">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2822,9 +2822,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="12f7481f-055d-46d3-bb53-86d7e3651e26">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="178d5628-b2fc-40ee-ad44-ba6b95888b99">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2859,9 +2859,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="d68dcfcc-48bd-440d-a7e0-8c0699449ad6">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="9f2515b3-e250-4449-9779-28bcd6faf77d">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2896,9 +2896,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="4ede96a6-6cac-4dfb-9769-40f341192bea">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="e28bff74-96a4-454d-98d7-c59e122d63fb">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2927,9 +2927,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="47f93be9-2806-4939-b7cb-4dc13784717a">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="d7caf3b3-f81b-42ef-9afc-926cee762d34">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -2965,9 +2965,9 @@
       <statement statement-id="pe-14_smt.a" uuid="9d92c32b-1310-4f6a-a2fd-b26ddc9dc213">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="bd8d9613-c072-44fe-8674-147d13925382">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="24d459a8-dd81-4881-ae25-6f69a155a174">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -2991,9 +2991,9 @@
       <statement statement-id="pe-14_smt.b" uuid="350236fb-96f3-4638-acfe-ad8168e789f3">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="e126ea00-6678-4b2d-a171-d75a0a0f3d9a">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="9ff9038d-e1f7-4d3f-a5b0-ff301848eeaf">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3023,9 +3023,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="20c0da71-a712-46c1-84a2-856fd428f7f3">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="a1ef191c-a130-4145-82ca-fa1895af11dd">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3054,9 +3054,9 @@
       <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="organization" />
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="3b39a1d5-d58b-40cc-a800-126c564f7da4">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="ac93fa47-dd7d-445a-a407-cb93947580ca">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3088,9 +3088,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="00c98ea4-1a92-4f46-ad19-49934bbba173">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="7b581e32-56d2-4243-9057-8d57c7ec842e">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3122,9 +3122,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="f8d231f5-d9be-42cc-be78-dad690e480c1">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="4bb45439-3b70-4a5c-adcd-e4becd0b14c9">
             <description>
               <p>This control associated with hardware components within AWS is generally either
@@ -3157,9 +3157,9 @@
       <statement statement-id="pe-17_smt.a" uuid="d963c814-c496-4547-b9dc-6c3559cd34ce">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="965e16bb-a4b1-4396-b523-baa8e0b9a5bc">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="311bf6f3-8920-44bf-a216-3aad35b27614">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3183,9 +3183,9 @@
       <statement statement-id="pe-17_smt.b" uuid="3dae23b7-cb0e-4c94-becf-24a6fd9e1670">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="7091b24c-1aa1-49d7-9ad6-bae60f88d0e3">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="7fd2e269-a354-440d-bc52-6a158fb2dbd4">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3209,9 +3209,9 @@
       <statement statement-id="pe-17_smt.c" uuid="15ffd4f8-6e97-4eb7-8764-4e155be417d7">
         <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
           uuid="4df3485f-407d-42b8-ab8e-8c634216c51b">
-          <description></description>
+          <description><p>TBD</p></description>
           <export>
-            <description></description>
+            <description><p>TBD</p></description>
             <provided uuid="81f4d2b6-91de-48eb-a0ad-8afe37eccd2d">
               <description>
                 <p>This control associated with hardware components within AWS is generally either
@@ -3244,9 +3244,9 @@
       </set-parameter>
       <by-component component-uuid="463e6979-b660-4e61-b475-90777d228307"
         uuid="15a1aa21-71d2-4728-9b0b-38fbe10f8b86">
-        <description></description>
+        <description><p>TBD</p></description>
         <export>
-          <description></description>
+          <description><p>TBD</p></description>
           <provided uuid="78a2ecba-1b3b-4aac-ad0b-f0ce572aea46">
             <description>
               <p>This control associated with hardware components within AWS is generally either
diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index 8531014..00bfaa2 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -581,7 +581,7 @@
     </system-implementation>
     <control-implementation>
         <description>
-            <p>FedRAMP SSP Template Section 13</p>
+            <p>This is a palceholder for the FedRAMP SSP Template Section 13</p>
             <p>This description field is required by OSCAL.</p>
             <p>FedRAMP does not require any specific information here.</p>
         </description>

From 7561d636003b759662c0a36fa1ec8e9f25394bca Mon Sep 17 00:00:00 2001
From: Iorga <miorga@pn135438.lan>
Date: Wed, 5 Jun 2024 07:45:54 -0400
Subject: [PATCH 09/36] Update of account_workflow document

---
 .gitignore          |  1 +
 account_workflow.md | 27 +++++++++++++++++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/.gitignore b/.gitignore
index 579c978..29ffb99 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 .DS_Store
 .vscode/*
+.history/*
 *.pyc
 __pycache__/
 draft-*
diff --git a/account_workflow.md b/account_workflow.md
index b814f97..f51ead5 100644
--- a/account_workflow.md
+++ b/account_workflow.md
@@ -1,8 +1,23 @@
 # Account Management Workflow
-Document that explains the workflow of GitHub actions used to automate account management.
 
-The requester creates a new GitHub issue (Account Request Form) to request an account for the Account Holder.\
-The Blossom Management group is automatically notified to review this request through GitHub.\
-A Blossom Management member reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED\
-If ACCOUNT_APPROVED, the Blossom Sysdevs group is automatically notified to implement the account and submit a new issue (Account Management Authorization Form) for the Account Holder.\
-If ACCOUNT_REJECTED, the account request issue is automatically closed.
\ No newline at end of file
+This document explains the workflow of GitHub actions used to automate Blossom service's accounts management.
+
+## Account Request and Creation
+-[ ] The requester requests an account for the Account Holder by creating a new GitHub issue using the Account Request Form.
+-[ ] The Blossom Management group is automatically notified to review the request through GitHub.
+-[ ] One of the Blossom Management (a member of the Blossom Management group) reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED
+-[ ] If the account is approved and the label ACCOUNT_APPROVED is added, the Blossom Sysdevs group is automatically notified to implement the account.
+-[ ] Upon completion of creating the account requested, the Blossom Sysdev submits a new GitHub issue using the Account Management Authorization Form for the Account Holder.
+-[ ] If ACCOUNT_REJECTED, the account request issue is automatically closed.
+
+## Account Disable
+[TBD]
+
+## Account Enable
+[TBD]
+
+## Account Change
+[TBD]
+
+## Account Deletion
+[TBD]

From f00644d5e7ccf704d0a9d5b7e2eb37498c78d93a Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Wed, 12 Jun 2024 13:47:45 -0400
Subject: [PATCH 10/36] Removed authorization form

---
 ...account_management_authorization_form.yaml | 81 -------------------
 .../workflows/account_request_approve.yaml    | 10 +--
 .../workflows/account_request_authorize.yaml  | 28 -------
 .github/workflows/account_request_open.yaml   |  2 +-
 .github/workflows/account_request_reject.yaml |  2 +-
 account_workflow.md                           | 15 ++--
 6 files changed, 16 insertions(+), 122 deletions(-)
 delete mode 100644 .github/ISSUE_TEMPLATE/account_management_authorization_form.yaml
 delete mode 100644 .github/workflows/account_request_authorize.yaml

diff --git a/.github/ISSUE_TEMPLATE/account_management_authorization_form.yaml b/.github/ISSUE_TEMPLATE/account_management_authorization_form.yaml
deleted file mode 100644
index 2d26f8e..0000000
--- a/.github/ISSUE_TEMPLATE/account_management_authorization_form.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-name: Account Management Authorization Form
-description: Submit an account related authorization
-labels: ['ACCOUNT_AUTHORIZED_RECORD']
-body:
-  - type: input
-    id: account-holder-full-name
-    attributes:
-      label: Account holder full name
-      placeholder: Type here account holder full name as it appears in his/her ID.
-    validations:
-      required: true
-  - type: dropdown
-    id: account-type
-    attributes:
-      label: What role/attribute is requested for the account holder
-      description: Select the action from the drop-down
-      options:
-        - System Owner
-        - License Owner
-        - Authorizing Official
-        - System Sec Assessor
-        - System Administrator
-        - Technical Point of Contact
-      multiple: false
-    validations:
-      required: true
-  - type: dropdown
-    id: account-privilege
-    attributes:
-      label: What account privilege is requested
-      description: Select the action from the drop-down
-      options:
-        - non-privileged (user:read/write)
-        - privileged (root:read/write/execute)
-      multiple: false
-    validations:
-      required: true
-  - type: dropdown
-    id: account-created
-    attributes:
-      label: Account creation
-      description: Select the action from the drop-down
-      options:
-        - Created
-        - Modified
-        - Disabled
-        - Enabled
-        - Deleted
-        - Not done
-      multiple: false
-    validations:
-      required: true
-  - type: dropdown
-    id: account-created-by
-    attributes:
-      label: Account creation by
-      description: Select the action from the drop-down
-      options:
-        - System Administrator
-        - Accounts Manager
-      multiple: false
-    validations:
-      required: true
-  - type: dropdown
-    id: account-approved-by
-    attributes:
-      label: Account approved by
-      description: Select the action from the drop-down
-      options:
-        - Program Manager (for privileged accounts)
-        - System Owner (for non-privileged accounts)
-      multiple: false
-    validations:
-      required: true
-  - type: textarea
-    id: comments
-    attributes:
-      label: Comments
-      placeholder: (optional) Type in here any additional information related to this authorization.
-    validations:
-      required: false
diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index fd0f4a3..e7fb304 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -14,12 +14,12 @@ jobs:
       issues: write
     steps:
       - name: Notify Blossom Sysdevs about Approved Account
-        run: gh issue close "$NUMBER" --comment "$COMMENT" --reason "completed"
+        run: gh issue comment "$NUMBER" --body "$BODY"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
-          COMMENT: >
-            Account management request APPROVED by Blossom Management. Closing request as "completed".\
-            @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.\
-            Then submit the [Account Management Authorization Form](https://github.com/usnistgov/blossom-oscal/issues/new?assignees=&labels=ACCOUNT_AUTHORIZED_RECORD&projects=&template=account_management_authorization_form.yaml)
\ No newline at end of file
+          BODY: >
+            Account management request APPROVED by Blossom Management.
+            @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.
+            Link this account request issue to the PR with the implementation.
\ No newline at end of file
diff --git a/.github/workflows/account_request_authorize.yaml b/.github/workflows/account_request_authorize.yaml
deleted file mode 100644
index 45e0390..0000000
--- a/.github/workflows/account_request_authorize.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: Account Request Authorize
-
-on:
-  issues:
-    types:
-      - labeled
-
-jobs:
-  # When an issue is created by account management authorization form
-  # Label of account management request form is ACCOUNT_AUTHORIZED_RECORD
-  request-authorized:
-    if: github.event.label.name == 'ACCOUNT_AUTHORIZED_RECORD'
-    runs-on: ubuntu-20.04
-    permissions:
-      issues: write
-    steps:
-      - name: Add comment
-        run: gh issue comment "$NUMBER" --body "$BODY"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          NUMBER: ${{ github.event.issue.number }}
-          BODY: >
-            @usnistgov/blossom-management An approved account modification has been implemented.
-
-
-# Contact AWS Cognito to show users
-# Check is user contained in ACL is in AWS response with grep
diff --git a/.github/workflows/account_request_open.yaml b/.github/workflows/account_request_open.yaml
index 5640336..8071943 100644
--- a/.github/workflows/account_request_open.yaml
+++ b/.github/workflows/account_request_open.yaml
@@ -21,6 +21,6 @@ jobs:
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
-            Account management request CREATED.\
+            Account management request CREATED.
             @usnistgov/blossom-management please review and approve/reject this request 
             by adding ACCOUNT_APPROVED or ACCOUNT_REJECTED label to this issue.
\ No newline at end of file
diff --git a/.github/workflows/account_request_reject.yaml b/.github/workflows/account_request_reject.yaml
index a0e7e3b..cd74553 100644
--- a/.github/workflows/account_request_reject.yaml
+++ b/.github/workflows/account_request_reject.yaml
@@ -20,5 +20,5 @@ jobs:
           GH_REPO: ${{ github.repository }}
           NUMBER: ${{ github.event.issue.number }}
           COMMENT: >
-            Account management request REJECTED by Blossom Management.\
+            Account management request REJECTED by Blossom Management.
             Closing request as "not planned".
diff --git a/account_workflow.md b/account_workflow.md
index f51ead5..3df13d4 100644
--- a/account_workflow.md
+++ b/account_workflow.md
@@ -3,12 +3,15 @@
 This document explains the workflow of GitHub actions used to automate Blossom service's accounts management.
 
 ## Account Request and Creation
--[ ] The requester requests an account for the Account Holder by creating a new GitHub issue using the Account Request Form.
--[ ] The Blossom Management group is automatically notified to review the request through GitHub.
--[ ] One of the Blossom Management (a member of the Blossom Management group) reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED
--[ ] If the account is approved and the label ACCOUNT_APPROVED is added, the Blossom Sysdevs group is automatically notified to implement the account.
--[ ] Upon completion of creating the account requested, the Blossom Sysdev submits a new GitHub issue using the Account Management Authorization Form for the Account Holder.
--[ ] If ACCOUNT_REJECTED, the account request issue is automatically closed.
+- [ ] The requester requests an account for the Account Holder by creating a new GitHub issue using the Account Request Form.
+- [ ] The Blossom Management group is automatically notified to review the request through GitHub.
+- [ ] One of the Blossom Management (a member of the Blossom Management group) reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED
+- [ ] If ACCOUNT_REJECTED, the account request issue is automatically closed.
+- [ ] If the account is approved and the label ACCOUNT_APPROVED is added, the Blossom Sysdevs group is automatically notified to implement the account.
+- [ ] Upon completion of creating the account requested, the Blossom Sysdev links the Account Request issue to the Pull Request that implements the account.
+- [ ] Upon merging the Pull Request that implements the account, the relevant updated controls are re-assessed automatically. The Blossom Assessors group is then notified to monitor the automated assessment.
+- [ ] TBD: STEPS FOR AUTOMATED ASSESSMENT
+
 
 ## Account Disable
 [TBD]

From f3b5863516a0d9be2aecc25abe1350d5d7d00fbb Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Mon, 17 Jun 2024 11:17:05 -0400
Subject: [PATCH 11/36] Add actions for implement and assessment

---
 .../workflows/account_request_approve.yaml    |  3 ++-
 .../workflows/account_request_assessment.yaml | 21 ++++++++++++++++
 .../workflows/account_request_implement.yaml  | 24 +++++++++++++++++++
 3 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/account_request_assessment.yaml
 create mode 100644 .github/workflows/account_request_implement.yaml

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index e7fb304..ddbafb4 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -22,4 +22,5 @@ jobs:
           BODY: >
             Account management request APPROVED by Blossom Management.
             @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.
-            Link this account request issue to the PR with the implementation.
\ No newline at end of file
+            When implemented, add the ACCOUNT_IMPLEMENTED label and 
+            link this account request issue to the PR with the implementation.
\ No newline at end of file
diff --git a/.github/workflows/account_request_assessment.yaml b/.github/workflows/account_request_assessment.yaml
new file mode 100644
index 0000000..de52e40
--- /dev/null
+++ b/.github/workflows/account_request_assessment.yaml
@@ -0,0 +1,21 @@
+name: Account Request Assessment
+
+on:
+  pull_request:
+    types:
+      - closed
+    paths:
+      - 'blossom_admin_member_ssp.xml'
+
+# If a Pull Request updating the SSP is merged
+jobs:
+  if_merged:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-20.04
+    permissions:
+      issues: write
+    steps:
+    - name: Run automated assessment
+      run: echo "assessment"
+      # 1. dump empty file to s3 bucket, to initiate connection
+      # 2. query chaincode, code to execute on chaincode for list of supported roles, API command
diff --git a/.github/workflows/account_request_implement.yaml b/.github/workflows/account_request_implement.yaml
new file mode 100644
index 0000000..5f300a2
--- /dev/null
+++ b/.github/workflows/account_request_implement.yaml
@@ -0,0 +1,24 @@
+name: Account Request Implement
+
+on:
+  issues:
+    types:
+      - labeled
+
+jobs:
+  # When ACCOUNT_IMPLEMENTED label is added to account management request
+  request-implemented:
+    if: github.event.label.name == 'ACCOUNT_IMPLEMENTED'
+    runs-on: ubuntu-20.04
+    permissions:
+      issues: write
+    steps:
+      - name: Notify Blossom Assessors about Implemented Account
+        run: gh issue comment "$NUMBER" --body "$BODY"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          NUMBER: ${{ github.event.issue.number }}
+          BODY: >
+            @usnistgov/blossom-assessors An edit to the ACL and/or SSP has been implemented.
+            Please monitor the automated assessment.
\ No newline at end of file

From 5eaa3619fa425f2096e828eddf9021d304e74bcc Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Mon, 24 Jun 2024 23:32:37 -0400
Subject: [PATCH 12/36] Add a simulation directory

---
 .sims/acl.xml | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 .sims/acl.xml

diff --git a/.sims/acl.xml b/.sims/acl.xml
new file mode 100644
index 0000000..c6e0889
--- /dev/null
+++ b/.sims/acl.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Owner>
+    <ID>Owner-canonical-user-ID</ID>
+    <DisplayName>System Owner (SO)</DisplayName>
+  </Owner>
+  <AccessControlList>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>Owner-canonical-user-ID</ID>
+        <DisplayName>System Owner (SO)</DisplayName>
+      </Grantee>
+      <Permission>FULL_CONTROL</Permission>
+    </Grant>   
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>user1-canonical-user-ID</ID>
+        <DisplayName>System Administrator (SA)</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+          <ID>user1-canonical-user-ID</ID>
+          <DisplayName>System Administrator (SA)</DisplayName>
+        </Grantee>
+        <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+          <ID>user1-canonical-user-ID</ID>
+          <DisplayName>Authorizing Official (AO)</DisplayName>
+        </Grantee>
+        <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+          <ID>user1-canonical-user-ID</ID>
+          <DisplayName>System Security Assessor (SSA)</DisplayName>
+        </Grantee>
+        <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
+        <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI> 
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
+        <URI>http://acs.amazonaws.com/groups/s3/LogDelivery</URI>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+  </AccessControlList>
+</AccessControlPolicy>
\ No newline at end of file

From 6e16e7d54ac11e2fb18e5170718614dae3f0ee21 Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Tue, 2 Jul 2024 15:59:11 -0400
Subject: [PATCH 13/36] Created ATO support directories.

---
 .sims/{acl.xml => acl-ato.xml} | 0
 ato/oscal-artifacts/README.md  | 3 +++
 ato/secops/README.md           | 2 ++
 3 files changed, 5 insertions(+)
 rename .sims/{acl.xml => acl-ato.xml} (100%)
 create mode 100644 ato/oscal-artifacts/README.md
 create mode 100644 ato/secops/README.md

diff --git a/.sims/acl.xml b/.sims/acl-ato.xml
similarity index 100%
rename from .sims/acl.xml
rename to .sims/acl-ato.xml
diff --git a/ato/oscal-artifacts/README.md b/ato/oscal-artifacts/README.md
new file mode 100644
index 0000000..1058ac2
--- /dev/null
+++ b/ato/oscal-artifacts/README.md
@@ -0,0 +1,3 @@
+# blossom-oscal
+This directory contains OSCAL artifacts created during automatic assessment process. 
+
diff --git a/ato/secops/README.md b/ato/secops/README.md
new file mode 100644
index 0000000..041f7a7
--- /dev/null
+++ b/ato/secops/README.md
@@ -0,0 +1,2 @@
+# Blossom Security Operations
+This directory contains operational artifacts created to automate the system security assessment and authorization (A&A) processes and ATO issuance. 

From e8f2075e62dd4a6a4f1ea691f725a0e638d8c9dd Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Tue, 2 Jul 2024 16:04:33 -0400
Subject: [PATCH 14/36] Updated readme file in the oscal-artifact directory.

---
 ato/oscal-artifacts/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ato/oscal-artifacts/README.md b/ato/oscal-artifacts/README.md
index 1058ac2..afe6d21 100644
--- a/ato/oscal-artifacts/README.md
+++ b/ato/oscal-artifacts/README.md
@@ -1,3 +1,3 @@
-# blossom-oscal
+# Blossom ATO Artifacts in OSCAL
 This directory contains OSCAL artifacts created during automatic assessment process. 
 

From 128541cb6906db3c3148d0b2dc2985e077d0069e Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Mon, 24 Jun 2024 23:32:37 -0400
Subject: [PATCH 15/36] Add a simulation directory

---
 .sims/acl.xml | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 .sims/acl.xml

diff --git a/.sims/acl.xml b/.sims/acl.xml
new file mode 100644
index 0000000..c6e0889
--- /dev/null
+++ b/.sims/acl.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Owner>
+    <ID>Owner-canonical-user-ID</ID>
+    <DisplayName>System Owner (SO)</DisplayName>
+  </Owner>
+  <AccessControlList>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>Owner-canonical-user-ID</ID>
+        <DisplayName>System Owner (SO)</DisplayName>
+      </Grantee>
+      <Permission>FULL_CONTROL</Permission>
+    </Grant>   
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>user1-canonical-user-ID</ID>
+        <DisplayName>System Administrator (SA)</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+          <ID>user1-canonical-user-ID</ID>
+          <DisplayName>System Administrator (SA)</DisplayName>
+        </Grantee>
+        <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+          <ID>user1-canonical-user-ID</ID>
+          <DisplayName>Authorizing Official (AO)</DisplayName>
+        </Grantee>
+        <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+          <ID>user1-canonical-user-ID</ID>
+          <DisplayName>System Security Assessor (SSA)</DisplayName>
+        </Grantee>
+        <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
+        <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI> 
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
+        <URI>http://acs.amazonaws.com/groups/s3/LogDelivery</URI>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+  </AccessControlList>
+</AccessControlPolicy>
\ No newline at end of file

From fee26b10a3cb83a04e8603ce3056b40f1b65fbce Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Tue, 2 Jul 2024 15:59:11 -0400
Subject: [PATCH 16/36] Created ATO support directories.

---
 .sims/{acl.xml => acl-ato.xml} | 0
 ato/oscal-artifacts/README.md  | 3 +++
 ato/secops/README.md           | 2 ++
 3 files changed, 5 insertions(+)
 rename .sims/{acl.xml => acl-ato.xml} (100%)
 create mode 100644 ato/oscal-artifacts/README.md
 create mode 100644 ato/secops/README.md

diff --git a/.sims/acl.xml b/.sims/acl-ato.xml
similarity index 100%
rename from .sims/acl.xml
rename to .sims/acl-ato.xml
diff --git a/ato/oscal-artifacts/README.md b/ato/oscal-artifacts/README.md
new file mode 100644
index 0000000..1058ac2
--- /dev/null
+++ b/ato/oscal-artifacts/README.md
@@ -0,0 +1,3 @@
+# blossom-oscal
+This directory contains OSCAL artifacts created during automatic assessment process. 
+
diff --git a/ato/secops/README.md b/ato/secops/README.md
new file mode 100644
index 0000000..041f7a7
--- /dev/null
+++ b/ato/secops/README.md
@@ -0,0 +1,2 @@
+# Blossom Security Operations
+This directory contains operational artifacts created to automate the system security assessment and authorization (A&A) processes and ATO issuance. 

From b1c51ba2e5a597bba309cf88a3699fb261eb6d9f Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Tue, 2 Jul 2024 16:04:33 -0400
Subject: [PATCH 17/36] Updated readme file in the oscal-artifact directory.

---
 ato/oscal-artifacts/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ato/oscal-artifacts/README.md b/ato/oscal-artifacts/README.md
index 1058ac2..afe6d21 100644
--- a/ato/oscal-artifacts/README.md
+++ b/ato/oscal-artifacts/README.md
@@ -1,3 +1,3 @@
-# blossom-oscal
+# Blossom ATO Artifacts in OSCAL
 This directory contains OSCAL artifacts created during automatic assessment process. 
 

From fa8386602d7959d360986b52e67990f0f6ba7170 Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Wed, 3 Jul 2024 22:22:40 -0400
Subject: [PATCH 18/36] More progress made witht the SSP and ACL artifacts

---
 .sims/acl.xml                                 | 117 +++++
 .../xml/ssp/blossom_admin_member_ssp.xml      | 409 +++++++++++++-----
 2 files changed, 407 insertions(+), 119 deletions(-)
 create mode 100644 .sims/acl.xml

diff --git a/.sims/acl.xml b/.sims/acl.xml
new file mode 100644
index 0000000..6370f3c
--- /dev/null
+++ b/.sims/acl.xml
@@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Owner>
+    <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+    <DisplayName>System Owner</DisplayName>
+  </Owner>
+  <Owner>
+    <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+    <DisplayName>System Owner</DisplayName>
+  </Owner>
+  <AccessControlList>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>WRITE_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>132953a9-640c-46f7-9de9-3fa15ec99361</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>132953a9-640c-46f7-9de9-3fa15ec99361</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>user1-canonical-user-ID</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>user1-canonical-user-ID</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
+        <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+  </AccessControlList>
+</AccessControlPolicy>
\ No newline at end of file
diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index 00bfaa2..a1762b7 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -10,39 +10,58 @@
         <role id="system-owner">
             <title>System Owner (SO)</title>
             <description>
-                <p>The individual within the organization who is ultimately accountable for everything related to the deployment, assessemnt, authorization and operations of the Blossom Member which provides the software assets leasing service (here in known as "this system").</p>
-            </description>
-        </role>
-        <role id="license-owner">
-            <title>License Owner (LO)</title>
-            <description>
-                <p>The individual within the service provider organization who is accountable for managing the pool of software resources made available for leasing to USG agencies.</p>
-                <p>The License Owner role exists only within the service provider agency.</p>
+                <p>The individual within the organization who is ultimately accountable for
+                    everything related to the deployment, assessemnt, authorization and operations
+                    of the Blossom Member which provides the software assets leasing service (here
+                    in known as "this system").</p>
             </description>
         </role>
         <role id="authorizing-official">
             <title>Authorizing Official</title>
             <description>
-                <p>The individual or individuals who are ultimatly accountable for reviewing the assessemnt package, discuss with the SO the findings and grant an authorization to operate (ATO) to "this system".</p>
-                <p>The Authorizing Official is the only entity responsible for the security posture of the system that gets access to the ATO channel (chainecode). The AO signs the MOU on behalf of the agency.</p>
+                <p>The individual or individuals who are ultimatly accountable for reviewing the
+                    assessemnt package, discuss with the SO the findings and grant an authorization
+                    to operate (ATO) to "this system".</p>
+                <p>The Authorizing Official is the only entity responsible for the security posture
+                    of the system that gets access to the ATO channel (chainecode). The AO signs the
+                    MOU on behalf of the agency.</p>
             </description>
         </role>
         <role id="sys-sec-assessor">
             <title>System Security Assessor (SSA)</title>
             <description>
-                <p>The individual accountable for assessing the security posture of the system on behalf of the system owner.</p>
+                <p>The individual accountable for assessing the security posture of the system on
+                    behalf of the system owner.</p>
             </description>
         </role>
         <role id="tpoc">
             <title>Technical Point of Contact (TPOC)</title>
             <description>
-                <p>The individual accountable for managing leased licenses (checkout, install, uninstall, return).</p>
+                <p>The individual accountable for managing leased licenses (checkout, install,
+                    uninstall, return).</p>
             </description>
         </role>
         <role id="system-administrator">
             <title>System Administrator (SA)</title>
             <description>
-                <p>The individual accountable for the deployment, configuration, testing and operations of the system on behalf of the System Owner.</p>
+                <p>The individual accountable for the deployment, configuration, testing and
+                    operations of the system on behalf of the System Owner.</p>
+            </description>
+        </role>
+        <role id="license-owner">
+            <title>License Owner (LO)</title>
+            <description>
+                <p>The individual within the service provider organization who is accountable for
+                    managing the pool of software resources made available for leasing to USG
+                    agencies.</p>
+                <p>The License Owner role exists only within the service provider agency.</p>
+            </description>
+        </role>
+        <role id="acquisition-officer">
+            <title>Acquisition Officer</title>
+            <description>
+                <p>The individual within the Agency which is responsible for approving and 
+                    processing the payment of the leased pool of software licenses.</p>
             </description>
         </role>
         <location uuid="1ef39fd9-d184-44c4-8ef4-36d2dbad70a2">
@@ -86,18 +105,22 @@
         <party uuid="09ad840f-aa79-43aa-9f22-25182c2ab11b" type="person">
             <name>Stan Owens</name>
             <prop name="job-title" value="System Owner" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="51588d7c-aa79-43aa-9f22-25182c2cd22d" type="person">
-            <name>Licenta Owens</name>
-            <prop name="job-title" value="License Owner" />
+        <party uuid="551b9706-d6a4-4d25-8207-f2ccec541016" type="person">
+            <name>ManoGiana Bloom</name>
+            <prop name="job-title" value="Blossom Program Manager" />
             <email-address>blossom@nist.gov</email-address>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
-            <name>Aurelian Officman</name>
-            <prop name="job-title" value="Authorizing Official" />
+        <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
+            <name>Simmon Admino</name>
+            <prop name="job-title" value="System Administrator" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
@@ -105,59 +128,99 @@
         <party uuid="132953a9-640c-46f7-9de9-3fa15ec99361" type="person">
             <name>Steve S. Asesoro</name>
             <prop name="job-title" value="System Security Assessor" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
             <email-address>blossom@nist.gov</email-address>
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="c46e27d1-7a65-47ea-bd76-df574fded5fd" type="person">
-            <name>Tom Poc</name>
-            <prop name="job-title" value="Technical Point of Contact" />
+        <!-- The UUIDs of the following parties need to be registered in Cognito first
+          and the UUID generated by Cognito needs to be used as the party's UUID.
+          Any update in Cognito will have to trigger an update of the SSP -->
+        <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
+            <name>Aurelian Officeman</name>
+            <prop name="job-title" value="Authorizing Official" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
-            <name>Simon Admino</name>
-            <prop name="job-title" value="System Administrator" />
+        <party uuid="51588d7c-aa79-43aa-9f22-25182c2cd22d" type="person">
+            <name>Licenta Owens</name>
+            <prop name="job-title" value="License Owner" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
-            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="551b9706-d6a4-4d25-8207-f2ccec541016" type="person">
-            <name>ManoGiana Bloom</name>
-            <prop name="job-title" value="Blossom PM" />
+        <party uuid="7380b1a3-5f04-4b6a-bada-ee13a1d78f3a" type="person">
+            <name>Acquia Officiale</name>
+            <prop name="job-title" value="Acquisition Officer" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
             <email-address>blossom@nist.gov</email-address>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
+        <party uuid="c46e27d1-7a65-47ea-bd76-df574fded5fd" type="person">
+            <name>Tom Pock</name>
+            <prop name="job-title" value="Technical Point of Contact" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <!-- ###
+             Entities with access to the infrastructure
+         ### -->
+         <!-- Privileged Roles -->
         <responsible-party role-id="system-owner">
             <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
             <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
         </responsible-party>
-        <responsible-party role-id="license-owner">
-            <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
-            <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
-        </responsible-party>
-        <responsible-party role-id="authorizing-official">
-            <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
+        <responsible-party role-id="system-administrator">
+            <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
+            <remarks>
+                <p>This party has development, deployment, configuration and operations
+                    responsibilities for "this system" supporting the system owner.</p>
+            </remarks>
         </responsible-party>
+        <!-- Non-Privileged Roles -->
         <responsible-party role-id="sys-sec-assessor">
             <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
             <remarks>
-                <p>The party responsible to assess the security controls on behalf of the system owner.</p>
+                <p>The party responsible to assess the security controls on behalf of the system
+                    owner.</p>
             </remarks>
         </responsible-party>
+        <!-- ###
+             Entities with access to the assets/business private channel 
+         ### -->
+         <!-- Privileged Roles -->
+        <responsible-party role-id="license-owner">
+            <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
+        </responsible-party>
+         <!-- Non-Privileged Roles -->
         <responsible-party role-id="tpoc">
             <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
             <remarks>
-                <p>Manages leased liceses for the agency and is responsible to checkout, install, uninstall and return licenses to the pool for each order the agency places.</p>
+                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
             </remarks>
         </responsible-party>
-        <responsible-party role-id="system-administrator">
-            <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
+        <responsible-party role-id="acquisition-officer">
+            <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
             <remarks>
-                <p>This party has development, deployment, configuration and operations responsibilities for "this system" supporting the system owner.</p>
+                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
             </remarks>
         </responsible-party>
+        <!-- ###
+            Entities with access to the Authorization private channel 
+         ### -->
+         <!-- Privileged Roles -->
+        <responsible-party role-id="authorizing-official">
+            <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
+        </responsible-party>
         <remarks>
             <p>This SSP was created using a simplified version of OSCAL-based FedRAMP SSP Template
                 for the FedRAMP Low, Moderate, and High baselines.</p>
@@ -508,7 +571,8 @@
                 <description>
                     <p>A diagram-specific explanation.</p>
                 </description>
-                <!--TBD: needds fixing link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" / -->
+                <!--TBD:
+                needds fixing link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" / -->
                 <caption>Data Flow Diagram</caption>
             </diagram>
         </data-flow>
@@ -516,7 +580,7 @@
     <system-implementation>
         <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
             <title>AWS Managed Blockchain (AMB)</title>
-            <link href="./aws_leveraged_authorization_ssp.xml"/>
+            <link href="./aws_leveraged_authorization_ssp.xml" />
             <!-- The Leveraged Authorization POC is the AMB's Authorizing Official in this case. -->
             <party-uuid>e63e870d-bf43-40dc-98a0-37d5e39b2dd1</party-uuid>
             <date-authorized>2024-01-01</date-authorized>
@@ -534,18 +598,45 @@
         </leveraged-authorization>
         <user uuid="9cb0fab0-78bd-44ba-bcb8-3e9801cc952f">
             <title>System Administrator</title>
-            <prop name="sensitivity" ns="https://fedramp.gov/ns/oscal" value="high" />
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
             <prop name="privilege-level" value="privileged" />
             <prop name="type" value="internal" />
             <role-id>system-administrator</role-id>
             <authorized-privilege>
                 <title>Full administrative access rights</title>
-                <function-performed>add and remove users and hardware</function-performed>
+                <function-performed>add and remove users, software-name and hardware</function-performed>
                 <function-performed>install and configure deployments</function-performed>
                 <function-performed>system updates, patches and hotfixes</function-performed>
                 <function-performed>perform backups</function-performed>
             </authorized-privilege>
         </user>
+        <user uuid="046ea806-2220-4ab4-9de0-1304f6be0b66">
+            <title>System Owner</title>
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
+            <prop name="privilege-level" value="privileged" />
+            <prop name="type" value="internal" />
+            <role-id>system-owner</role-id>
+            <authorized-privilege>
+                <title>Privileged access rights</title>
+                <function-performed>add and remove users, software-name and hardware</function-performed>
+                <function-performed>install and configure deployments</function-performed>
+                <function-performed>system updates, patches and hotfixes</function-performed>
+                <function-performed>perform backups</function-performed>
+            </authorized-privilege>
+        </user>
+        <user uuid="f93d5a58-0688-4e48-8aaa-0c4d20c57f9b">
+            <title>System Security Assessor</title>
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
+            <prop name="privilege-level" value="non-privileged" />
+            <prop name="type" value="internal" />
+            <role-id>sys-sec-assessor</role-id>
+            <authorized-privilege>
+                <title>Non-privileged access rights (read only)</title>
+                <function-performed>review system documentation and security configurations</function-performed>
+                <function-performed>review if system updates, patches and hotfixes are documented and successfully completed</function-performed>
+                <function-performed>review disaster recovery procedures and system backups existance</function-performed>
+            </authorized-privilege>
+        </user>
         <component uuid="60f92bcf-f353-4236-9803-2a5d41751010" type="this-system">
             <title>This System</title>
             <description>
@@ -562,7 +653,9 @@
             </description>
             <prop name="leveraged-authorization-uuid" value="5a9c98ab-8e5e-433d-a7bd-515c07cd1497" />
             <prop name="implementation-point" value="external" />
-            <!-- The value of inherited-uuid is the uuid of the component of the leveraged system which provides the control implementation. In thsi case will be the AMB's "this-system"-->
+            <!-- The value of inherited-uuid is the uuid of the component of the leveraged system
+            which provides the control implementation. In thsi case will be the AMB's
+            "this-system"-->
             <prop name="inherited-uuid" value="73a7ca56-ac02-43b9-8664-62bcb05a7e91" />
             <status state="operational" />
         </component>
@@ -586,7 +679,8 @@
             <p>FedRAMP does not require any specific information here.</p>
         </description>
         <!-- ####
-            AC-1 is not in our profile. If we include it, we meed to correct the errors (AC-1.b does not have a b.1 and b.2, but it has b and c) 
+            AC-1 is not in our profile. If we include it, we meed to correct the errors (AC-1.b does not have a
+        b.1 and b.2, but it has b and c) 
             #### -->
         <!-- AC-1 will not be implemented now. 
         <implemented-requirement uuid="eee8697a-bc39-45aa-accc-d3e534932efb" control-id="ac-1">
@@ -686,74 +780,104 @@
             AC-2
             ######  -->
         <implemented-requirement uuid="7a36cf53-156d-4d1f-9a8b-433f61cc57b7" control-id="ac-2">
-            <!-- TBD: The following <prop>s must be reviewed, updated and only one option kept based on AC-2 implementation of the inherited control for manageing the Authorizing Official's account -->
-            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal" value="2024/05/30" />
+            <!-- TBD: The following <prop>s must be reviewed, updated and only one option kept based
+            on AC-2 implementation of the inherited control for manageing the Authorizing Official's
+            account -->
+            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal"
+                value="2024/05/30" />
             <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="partial">
                 <remarks>
-                    <p>AMB provides access control to the infrastracter for the entities identified below. The Consumer's responsibility is to update the ACL ith the identities authorized to access the resource.</p>
+                    <p>Per the documentation available in the Blossom Wiki, the AWS Managed
+                        Blockchain (AMB) provides access control to the infrastracture for the
+                        entities identified below which require access to IaaS to maintain and
+                        deploy system components. The blockchain's chaincode is implementing Next
+                        Generation Access Control (NGAC) standard to manage the access to resources
+                        for the roles docuemnted in the Blossom specification. Access control policy
+                        machines are implemented for the two private channels of the AMB: the ATO or
+                        "Authorization" channel and the "Businness" channel.</p>
                 </remarks>
             </prop>
-            <!-- NOT APPLICABLE VALUES - TO BE REMOVED AT THE END
-            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="planned">
+            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="implemented">
                 <remarks>
-                    <p>TBD: Describe the portion of the control that is not satisfied.</p>
+                    <p>The policy machines are controling the access to the two chaincodes
+                        (Authorization and Business) used by the system.</p>
                 </remarks>
             </prop>
+            <!-- Use this prop for not applicable controls
             <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable">
                 <remarks>
                     <p>TBD: Describe the justification for marking this control Not Applicable.</p>
                 </remarks>
             </prop>  
-            -->        
-            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged-system" />
+            -->
+            <!-- Control origination varies per role. See by-component under ac-2_smt
+            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
+                value="leveraged-system" />
             <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
                 value="customer-configured">
                 <remarks>
-                    <p>TBD: Describe any customer-configured requirements for satisfying this control.</p>
+                    <p>TBD: Describe any customer-configured requirements for satisfying this
+                        control.</p>
                 </remarks>
             </prop>
+            -->
+            <link rel="documentation" href="#c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c" />
+            <set-parameter param-id="ac-2_prm_1">
+                <value>business need</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_2">
+                <value>business need</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_3">
+                <value>System Owner (SO)</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_4">
+                <value>Types of User Accounts for Blossom</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_5">
+                <value>System Owner (SO)</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_6">
+                <value>1 business day</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_7">
+                <value>1 business day</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_8">
+                <value>1 business day</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_9">
+                <value>System Owner (SO)</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_10">
+                <value>every 6 months</value>
+            </set-parameter>
             <responsible-role role-id="system-administrator">
                 <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
             </responsible-role>
             <responsible-role role-id="system-owner">
                 <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
             </responsible-role>
-            <statement statement-id="ac-2_smt" uuid="4a2428eb-41eb-447a-81db-4f6d98a003ce">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="eb710146-1ede-4876-9a3b-02c18408e506">
+            <statement statement-id="ac-2_smt" uuid="4facc265-ba1d-4d66-afc7-6385984b6a1e">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010" uuid="9d06a5a6-0c30-43cb-a18a-baabd616ddfb">
                     <description>
-                        <p>The NGAC implementation in the two chaincodes manages the access control for the Blossom business layer users and the BC Member's ATO-related accounts.</p>
+                        <p>For the IAM entities that have a business need, and which have accounts created in Cognito, the Policy machines which implement NGAC in the two chaincodes are managing the access control for the Blossom business layer users and the BC Member's Authorizing Official that is uploading the ATO Attestation to the Authorization channel.</p>
                     </description>
-                    <set-parameter param-id="ac-2_prm_1">
-                        <value>business need</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_2">
-                        <value>business need</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_3">
-                        <value>System Owner (SO)</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_4">
-                        <value>Types of User Accounts for Blossom</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_5">
-                        <value>System Owner (SO)</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_6">
-                        <value>1 business day</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_7">
-                        <value>1 business day</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_8">
-                        <value>1 business day</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_9">
-                        <value>System Owner (SO)</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_10">
-                        <value>every 6 months</value>
-                    </set-parameter>
+                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="customer-configured">
+                        <remarks>
+                            <p>The Blossom system System Owner and System Administrator are repsonsible for approving, creating and managing access by maintainit accurate information in Cognito and updating the access control policies in the chaincode for each channel.</p>
+                        </remarks>
+                    </prop>
+                </by-component>
+                <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" uuid="eb710146-1ede-4876-9a3b-02c18408e506">
+                    <description>
+                        <p>AWS provide access to the system to approved entities, for deployment, maintenance, and operations.</p>
+                    </description>
+                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged">
+                        <remarks>
+                            <p>Keep the ACL list current at all times.</p>
+                        </remarks>
+                    </prop>
                 </by-component>
             </statement>
             <statement statement-id="ac-2_smt.a" uuid="24a85abb-25ad-4686-850c-5c0e8ab69a0c">
@@ -764,18 +888,21 @@
                         <p>These accounts are managed by the NGAC implementation in the chaincodes for the ATO and for the assets management (business) processes.</p>
                         <p>The following accounts are supported for the business operations (assets management):</p>
                         <ul>
-                            <li>Privileged accounts:
-                                <ul>License Owner (LO)</ul>
+                            <li>Privileged accounts: 
+                                <ul>License Owner</ul>
                             </li>
-                            <li>Non-Privileged accounts:
-                                <ul>Acquisition Officer (ACQ)</ul>
-                                <ul>Technical Point of Contact (TPOC)</ul>
+                            <li>Non-Privileged accounts: 
+                                <ul>Acquisition Officer</ul>
+                                <ul>Technical Point of Contact</ul>
                             </li>
                         </ul>
-                        <p>The following account is supported for the ATO process (ATO attestation submission and review of other Blossom members):</p>
+                        <p>The Authorizing Official is responsible for reviewing the ATO package prepared by the System Owner and signing/authorizing the system to operate.</p>
+                        <p>The System Owner remains the custodian of all system ATO related artifacts.</p>
+                        <p>Upon approval, teh AO is responsible for generating automatically the ATO attestation and upload it to the ATO channel.</p>
+                        <p>The following account is supported for the ATO processes. :</p>
                         <ul>
-                            <li>Non-Privileged accounts:
-                                <ul>Authorizing Official (AO)</ul>
+                            <li>Privileged accounts:
+                                 <ul>Authorizing Official</ul>
                             </li>
                         </ul>
                     </description>
@@ -784,15 +911,20 @@
                 <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65"
                     uuid="84de735f-ba37-4bb4-b784-79760f986a40">
                     <description>
-                        <p>The accounts of the Blossom Member managed by the Leveraged AWS IaaS are:</p>
+                        <p>The following accounts of the Blossom System of NIST Member managed by the Leveraged AWS IaaS are:</p>
                         <ul>
-                            <li>Privileged accounts:
-                                <ul>System Owner (SO)</ul>
-                                <ul>System Administrator (SA)</ul>
+                            <li>Privileged accounts: 
+                                <ul>System Owner</ul>
+                                <ul>System Administrator</ul>
                             </li>
-                            <li>Non-Privileged accounts:
-                                <ul>System Security Assessor (SSA)</ul>
-                                <ul>Authorizing Official (AO)</ul>
+                            <li>Non-Privileged accounts: 
+                                <ul>System Security Assessor</ul>
+                                <!-- 
+                                NOTE: Authorizing Official will not have access to the infrastructure. 
+                                 System Owner is responsible to prepare the ATO package in collaboration 
+                                 with the System Security Assessor. Removing the AO from this list.
+                                <ul>Authorizing Official</ul>
+                                -->
                             </li>
                         </ul>
                     </description>
@@ -800,13 +932,21 @@
                         provided-uuid="11111111-0000-4000-9009-002001002001">
                         <description>
                             <p>TBD: provided-uuid needs to match the one in the AWS' SSP.</p>
-                            <p>All privileged and non-privileged accounts that are granted access to the AWS infrastructure and are responsible for the Blossom member (this sysstem), are managed by the AWS IaaS (leveraged ATO system) which uses an Access Control List (ACL) for the NIST employees assigned Blossom roles.</p>
+                            <p>All privileged and non-privileged accounts that are granted access to
+                                the AWS infrastructure and are responsible for the Blossom System deployment and maintenance
+                                (this system), are managed by the AWS IaaS (leveraged ATO system)
+                                which uses an Access Control List (ACL) for the NIST employees
+                                assigned Blossom roles.</p>
                         </description>
                     </inherited>
                     <satisfied uuid="6486f725-1372-434f-9b1b-7cf3f50c32d1"
                         responsibility-uuid="11111111-0000-4000-9009-002001002002">
                         <description>
-                            <p>For all responsible parties with roles managed by the AWS IaaS system, accounts creation/deletion are requested, approved/revoked by the System Owner or the Blossom PM and are added to or delete from the ACL list.</p>
+                            <p>The Access Control List (ACL) updates are Blossom system's responsibility (as customers of AWS)
+                                For all roles listed above which are managed by the AWS IaaS
+                                system, account creation/revokation/deletion requests are approved
+                                by the Blossom system's System Owner or the Blossom PM and are added to or delete
+                                from the ACL list by the System Administrator.</p>
                         </description>
                     </satisfied>
                 </by-component>
@@ -815,7 +955,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="d52db118-3e6f-4b39-8fd9-a3a65dfcb6b1">
                     <description>
-                        <p>Assign account managers</p>
+                        <p>For this system, the entity with the System Administratore role
+                             acts as the Accounts Manager and is responsible for creating, 
+                             revoking, delete accounts per decissions made by the System Owner.</p>
                     </description>
                 </by-component>
             </statement>
@@ -823,7 +965,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c72b52e1-1943-4a52-be48-7bcce7df2f6d">
                     <description>
-                        <p>Require <insert type="param" id-ref="ac-2_prm_1" />[Assignment: organization-defined prerequisites and criteria] for group and role membership;</p>
+                        <p>Require <insert type="param" id-ref="ac-2_prm_1" />[Assignment:
+                            organization-defined prerequisites and criteria] for group and role
+                            membership;</p>
                     </description>
                 </by-component>
             </statement>
@@ -856,7 +1000,8 @@
                     uuid="37e94c9b-acb8-458f-8a95-c1d110ead856">
                     <description>
                         <p>Access authorizations (i.e., privileges) and <insert type="param"
-                            id-ref="ac-2_prm_2" />[Assignment: organization-defined attributes (as required)] for each account;</p>
+                                id-ref="ac-2_prm_2" />[Assignment: organization-defined attributes
+                            (as required)] for each account;</p>
                     </description>
                 </by-component>
             </statement>
@@ -864,7 +1009,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="40d40fbc-aed0-4323-9846-2ed3dc0f321e">
                     <description>
-                        <p>Require approvals by <insert type="param" id-ref="ac-2_prm_3" />[Assignment: organization-defined personnel or roles] for requests to create accounts;</p>
+                        <p>Require approvals by <insert type="param" id-ref="ac-2_prm_3" />[Assignment:
+                            organization-defined personnel or roles] for requests to create
+                            accounts;</p>
                     </description>
                 </by-component>
             </statement>
@@ -873,7 +1020,8 @@
                     uuid="02d4c648-5a86-4155-bd73-02c3439262b4">
                     <description>
                         <p>Create, enable, modify, disable, and remove accounts in accordance with <insert
-                            type="param" id-ref="ac-2_prm_4" />[Assignment: organization-defined policy, procedures, prerequisites, and criteria];</p>
+                                type="param" id-ref="ac-2_prm_4" />[Assignment: organization-defined
+                            policy, procedures, prerequisites, and criteria];</p>
                     </description>
                 </by-component>
             </statement>
@@ -889,7 +1037,8 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c555e31a-7b0d-437a-b415-e9ba5f2e1ef0">
                     <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment: organization-defined personnel or roles] within:</p>
+                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment:
+                            organization-defined personnel or roles] within:</p>
                     </description>
                 </by-component>
             </statement>
@@ -897,7 +1046,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="f1606d4f-3c5e-4c25-9649-94a12edbc113">
                     <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment: system owner] within:<insert type="param" id-ref="ac-2_prm_6" />[Assignment: 1 business day] when accounts are no longer required;</p>
+                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment:
+                            system owner] within:<insert type="param" id-ref="ac-2_prm_6" />[Assignment:
+                            1 business day] when accounts are no longer required;</p>
                     </description>
                 </by-component>
             </statement>
@@ -905,7 +1056,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c5a6312a-6123-4aa4-8097-3b4e30e70b72">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_7" />[Assignment: organization-defined time period] when users are terminated or transferred; </p>
+                        <p><insert type="param" id-ref="ac-2_prm_7" />[Assignment:
+                            organization-defined time period] when users are terminated or
+                            transferred; </p>
                     </description>
                 </by-component>
             </statement>
@@ -913,7 +1066,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="1d085fa3-94d9-4f4c-a62b-963cc4640f12">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_8" />[Assignment: organization-defined time period] when system usage or need-to-know changes for an individual;</p>
+                        <p><insert type="param" id-ref="ac-2_prm_8" />[Assignment:
+                            organization-defined time period] when system usage or need-to-know
+                            changes for an individual;</p>
                     </description>
                 </by-component>
             </statement>
@@ -945,7 +1100,8 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="587c32c5-701a-4e5c-83a7-2438ab3d71b1">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_9" />[Assignment: organization-defined attributes (as required)];</p>
+                        <p><insert type="param" id-ref="ac-2_prm_9" />[Assignment:
+                            organization-defined attributes (as required)];</p>
                     </description>
                 </by-component>
             </statement>
@@ -954,7 +1110,8 @@
                     uuid="b7932e43-9aa3-4bba-86a8-439a74e1e79a">
                     <description>
                         <p>Review accounts for compliance with account management requirements <insert
-                            type="param" id-ref="ac-2_prm_10" />[Assignment: organization-defined frequency];</p>
+                                type="param" id-ref="ac-2_prm_10" />[Assignment:
+                            organization-defined frequency];</p>
                     </description>
                 </by-component>
             </statement>
@@ -962,7 +1119,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="d0cdfbc2-aef5-418e-94dc-9906341bcc12">
                     <description>
-                        <p>Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group;</p>
+                        <p>Establish and implement a process for changing shared or group account
+                            authenticators (if deployed) when individuals are removed from the
+                            group;</p>
                     </description>
                 </by-component>
             </statement>
@@ -970,13 +1129,25 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="f23d55dd-1204-42f9-862e-2a07200b5c6e">
                     <description>
-                        <p>Align account management processes with personnel termination and transfer processes.</p>
+                        <p>Align account management processes with personnel termination and
+                            transfer processes.</p>
                     </description>
                 </by-component>
             </statement>
         </implemented-requirement>
     </control-implementation>
     <back-matter>
+        <resource uuid="c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c">
+            <description>
+                <p>Blossom Wiki</p>
+            </description>
+            <rlink
+                href="https://github.com/usnistgov/blossom-nist-member/wiki"
+                media-type="multipart/alternative" />
+            <remarks>
+                <p>Project's Wiki which provides descriptions for the ATO and business processes.</p>
+            </remarks>
+        </resource>
         <resource uuid="006babc9-4f57-4ab0-9941-15fcb65e0387">
             <description>
                 <p>National Institute of Standards and Technology's Logo</p>

From 6e2b6b7dbd4973096a418800f845465cfe7ab68d Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Wed, 3 Jul 2024 22:22:40 -0400
Subject: [PATCH 19/36] More progress made witht the SSP and ACL artifacts

---
 .sims/acl.xml                                 | 117 +++++
 .../xml/ssp/blossom_admin_member_ssp.xml      | 409 +++++++++++++-----
 2 files changed, 407 insertions(+), 119 deletions(-)
 create mode 100644 .sims/acl.xml

diff --git a/.sims/acl.xml b/.sims/acl.xml
new file mode 100644
index 0000000..6370f3c
--- /dev/null
+++ b/.sims/acl.xml
@@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Owner>
+    <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+    <DisplayName>System Owner</DisplayName>
+  </Owner>
+  <Owner>
+    <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+    <DisplayName>System Owner</DisplayName>
+  </Owner>
+  <AccessControlList>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
+        <DisplayName>System Owner</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>WRITE</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>4fded5fd-7a65-47ea-bd76-df57c46e27d1</ID>
+        <DisplayName>System Administrator</DisplayName>
+      </Grantee>
+      <Permission>WRITE_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>132953a9-640c-46f7-9de9-3fa15ec99361</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>132953a9-640c-46f7-9de9-3fa15ec99361</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>user1-canonical-user-ID</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
+        <ID>user1-canonical-user-ID</ID>
+        <DisplayName>System Security Assessor</DisplayName>
+      </Grantee>
+      <Permission>READ_ACP</Permission>
+    </Grant>
+    <Grant>
+      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
+        <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
+      </Grantee>
+      <Permission>READ</Permission>
+    </Grant>
+  </AccessControlList>
+</AccessControlPolicy>
\ No newline at end of file
diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index 00bfaa2..a1762b7 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -10,39 +10,58 @@
         <role id="system-owner">
             <title>System Owner (SO)</title>
             <description>
-                <p>The individual within the organization who is ultimately accountable for everything related to the deployment, assessemnt, authorization and operations of the Blossom Member which provides the software assets leasing service (here in known as "this system").</p>
-            </description>
-        </role>
-        <role id="license-owner">
-            <title>License Owner (LO)</title>
-            <description>
-                <p>The individual within the service provider organization who is accountable for managing the pool of software resources made available for leasing to USG agencies.</p>
-                <p>The License Owner role exists only within the service provider agency.</p>
+                <p>The individual within the organization who is ultimately accountable for
+                    everything related to the deployment, assessemnt, authorization and operations
+                    of the Blossom Member which provides the software assets leasing service (here
+                    in known as "this system").</p>
             </description>
         </role>
         <role id="authorizing-official">
             <title>Authorizing Official</title>
             <description>
-                <p>The individual or individuals who are ultimatly accountable for reviewing the assessemnt package, discuss with the SO the findings and grant an authorization to operate (ATO) to "this system".</p>
-                <p>The Authorizing Official is the only entity responsible for the security posture of the system that gets access to the ATO channel (chainecode). The AO signs the MOU on behalf of the agency.</p>
+                <p>The individual or individuals who are ultimatly accountable for reviewing the
+                    assessemnt package, discuss with the SO the findings and grant an authorization
+                    to operate (ATO) to "this system".</p>
+                <p>The Authorizing Official is the only entity responsible for the security posture
+                    of the system that gets access to the ATO channel (chainecode). The AO signs the
+                    MOU on behalf of the agency.</p>
             </description>
         </role>
         <role id="sys-sec-assessor">
             <title>System Security Assessor (SSA)</title>
             <description>
-                <p>The individual accountable for assessing the security posture of the system on behalf of the system owner.</p>
+                <p>The individual accountable for assessing the security posture of the system on
+                    behalf of the system owner.</p>
             </description>
         </role>
         <role id="tpoc">
             <title>Technical Point of Contact (TPOC)</title>
             <description>
-                <p>The individual accountable for managing leased licenses (checkout, install, uninstall, return).</p>
+                <p>The individual accountable for managing leased licenses (checkout, install,
+                    uninstall, return).</p>
             </description>
         </role>
         <role id="system-administrator">
             <title>System Administrator (SA)</title>
             <description>
-                <p>The individual accountable for the deployment, configuration, testing and operations of the system on behalf of the System Owner.</p>
+                <p>The individual accountable for the deployment, configuration, testing and
+                    operations of the system on behalf of the System Owner.</p>
+            </description>
+        </role>
+        <role id="license-owner">
+            <title>License Owner (LO)</title>
+            <description>
+                <p>The individual within the service provider organization who is accountable for
+                    managing the pool of software resources made available for leasing to USG
+                    agencies.</p>
+                <p>The License Owner role exists only within the service provider agency.</p>
+            </description>
+        </role>
+        <role id="acquisition-officer">
+            <title>Acquisition Officer</title>
+            <description>
+                <p>The individual within the Agency which is responsible for approving and 
+                    processing the payment of the leased pool of software licenses.</p>
             </description>
         </role>
         <location uuid="1ef39fd9-d184-44c4-8ef4-36d2dbad70a2">
@@ -86,18 +105,22 @@
         <party uuid="09ad840f-aa79-43aa-9f22-25182c2ab11b" type="person">
             <name>Stan Owens</name>
             <prop name="job-title" value="System Owner" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="51588d7c-aa79-43aa-9f22-25182c2cd22d" type="person">
-            <name>Licenta Owens</name>
-            <prop name="job-title" value="License Owner" />
+        <party uuid="551b9706-d6a4-4d25-8207-f2ccec541016" type="person">
+            <name>ManoGiana Bloom</name>
+            <prop name="job-title" value="Blossom Program Manager" />
             <email-address>blossom@nist.gov</email-address>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
-            <name>Aurelian Officman</name>
-            <prop name="job-title" value="Authorizing Official" />
+        <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
+            <name>Simmon Admino</name>
+            <prop name="job-title" value="System Administrator" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
@@ -105,59 +128,99 @@
         <party uuid="132953a9-640c-46f7-9de9-3fa15ec99361" type="person">
             <name>Steve S. Asesoro</name>
             <prop name="job-title" value="System Security Assessor" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
             <email-address>blossom@nist.gov</email-address>
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="c46e27d1-7a65-47ea-bd76-df574fded5fd" type="person">
-            <name>Tom Poc</name>
-            <prop name="job-title" value="Technical Point of Contact" />
+        <!-- The UUIDs of the following parties need to be registered in Cognito first
+          and the UUID generated by Cognito needs to be used as the party's UUID.
+          Any update in Cognito will have to trigger an update of the SSP -->
+        <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
+            <name>Aurelian Officeman</name>
+            <prop name="job-title" value="Authorizing Official" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
-            <name>Simon Admino</name>
-            <prop name="job-title" value="System Administrator" />
+        <party uuid="51588d7c-aa79-43aa-9f22-25182c2cd22d" type="person">
+            <name>Licenta Owens</name>
+            <prop name="job-title" value="License Owner" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
             <email-address>blossom@nist.gov</email-address>
-            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <party uuid="551b9706-d6a4-4d25-8207-f2ccec541016" type="person">
-            <name>ManoGiana Bloom</name>
-            <prop name="job-title" value="Blossom PM" />
+        <party uuid="7380b1a3-5f04-4b6a-bada-ee13a1d78f3a" type="person">
+            <name>Acquia Officiale</name>
+            <prop name="job-title" value="Acquisition Officer" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
             <email-address>blossom@nist.gov</email-address>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
+        <party uuid="c46e27d1-7a65-47ea-bd76-df574fded5fd" type="person">
+            <name>Tom Pock</name>
+            <prop name="job-title" value="Technical Point of Contact" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <!-- ###
+             Entities with access to the infrastructure
+         ### -->
+         <!-- Privileged Roles -->
         <responsible-party role-id="system-owner">
             <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
             <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
         </responsible-party>
-        <responsible-party role-id="license-owner">
-            <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
-            <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
-        </responsible-party>
-        <responsible-party role-id="authorizing-official">
-            <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
+        <responsible-party role-id="system-administrator">
+            <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
+            <remarks>
+                <p>This party has development, deployment, configuration and operations
+                    responsibilities for "this system" supporting the system owner.</p>
+            </remarks>
         </responsible-party>
+        <!-- Non-Privileged Roles -->
         <responsible-party role-id="sys-sec-assessor">
             <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
             <remarks>
-                <p>The party responsible to assess the security controls on behalf of the system owner.</p>
+                <p>The party responsible to assess the security controls on behalf of the system
+                    owner.</p>
             </remarks>
         </responsible-party>
+        <!-- ###
+             Entities with access to the assets/business private channel 
+         ### -->
+         <!-- Privileged Roles -->
+        <responsible-party role-id="license-owner">
+            <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
+        </responsible-party>
+         <!-- Non-Privileged Roles -->
         <responsible-party role-id="tpoc">
             <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
             <remarks>
-                <p>Manages leased liceses for the agency and is responsible to checkout, install, uninstall and return licenses to the pool for each order the agency places.</p>
+                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
             </remarks>
         </responsible-party>
-        <responsible-party role-id="system-administrator">
-            <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
+        <responsible-party role-id="acquisition-officer">
+            <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
             <remarks>
-                <p>This party has development, deployment, configuration and operations responsibilities for "this system" supporting the system owner.</p>
+                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
             </remarks>
         </responsible-party>
+        <!-- ###
+            Entities with access to the Authorization private channel 
+         ### -->
+         <!-- Privileged Roles -->
+        <responsible-party role-id="authorizing-official">
+            <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
+        </responsible-party>
         <remarks>
             <p>This SSP was created using a simplified version of OSCAL-based FedRAMP SSP Template
                 for the FedRAMP Low, Moderate, and High baselines.</p>
@@ -508,7 +571,8 @@
                 <description>
                     <p>A diagram-specific explanation.</p>
                 </description>
-                <!--TBD: needds fixing link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" / -->
+                <!--TBD:
+                needds fixing link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" / -->
                 <caption>Data Flow Diagram</caption>
             </diagram>
         </data-flow>
@@ -516,7 +580,7 @@
     <system-implementation>
         <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
             <title>AWS Managed Blockchain (AMB)</title>
-            <link href="./aws_leveraged_authorization_ssp.xml"/>
+            <link href="./aws_leveraged_authorization_ssp.xml" />
             <!-- The Leveraged Authorization POC is the AMB's Authorizing Official in this case. -->
             <party-uuid>e63e870d-bf43-40dc-98a0-37d5e39b2dd1</party-uuid>
             <date-authorized>2024-01-01</date-authorized>
@@ -534,18 +598,45 @@
         </leveraged-authorization>
         <user uuid="9cb0fab0-78bd-44ba-bcb8-3e9801cc952f">
             <title>System Administrator</title>
-            <prop name="sensitivity" ns="https://fedramp.gov/ns/oscal" value="high" />
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
             <prop name="privilege-level" value="privileged" />
             <prop name="type" value="internal" />
             <role-id>system-administrator</role-id>
             <authorized-privilege>
                 <title>Full administrative access rights</title>
-                <function-performed>add and remove users and hardware</function-performed>
+                <function-performed>add and remove users, software-name and hardware</function-performed>
                 <function-performed>install and configure deployments</function-performed>
                 <function-performed>system updates, patches and hotfixes</function-performed>
                 <function-performed>perform backups</function-performed>
             </authorized-privilege>
         </user>
+        <user uuid="046ea806-2220-4ab4-9de0-1304f6be0b66">
+            <title>System Owner</title>
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
+            <prop name="privilege-level" value="privileged" />
+            <prop name="type" value="internal" />
+            <role-id>system-owner</role-id>
+            <authorized-privilege>
+                <title>Privileged access rights</title>
+                <function-performed>add and remove users, software-name and hardware</function-performed>
+                <function-performed>install and configure deployments</function-performed>
+                <function-performed>system updates, patches and hotfixes</function-performed>
+                <function-performed>perform backups</function-performed>
+            </authorized-privilege>
+        </user>
+        <user uuid="f93d5a58-0688-4e48-8aaa-0c4d20c57f9b">
+            <title>System Security Assessor</title>
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
+            <prop name="privilege-level" value="non-privileged" />
+            <prop name="type" value="internal" />
+            <role-id>sys-sec-assessor</role-id>
+            <authorized-privilege>
+                <title>Non-privileged access rights (read only)</title>
+                <function-performed>review system documentation and security configurations</function-performed>
+                <function-performed>review if system updates, patches and hotfixes are documented and successfully completed</function-performed>
+                <function-performed>review disaster recovery procedures and system backups existance</function-performed>
+            </authorized-privilege>
+        </user>
         <component uuid="60f92bcf-f353-4236-9803-2a5d41751010" type="this-system">
             <title>This System</title>
             <description>
@@ -562,7 +653,9 @@
             </description>
             <prop name="leveraged-authorization-uuid" value="5a9c98ab-8e5e-433d-a7bd-515c07cd1497" />
             <prop name="implementation-point" value="external" />
-            <!-- The value of inherited-uuid is the uuid of the component of the leveraged system which provides the control implementation. In thsi case will be the AMB's "this-system"-->
+            <!-- The value of inherited-uuid is the uuid of the component of the leveraged system
+            which provides the control implementation. In thsi case will be the AMB's
+            "this-system"-->
             <prop name="inherited-uuid" value="73a7ca56-ac02-43b9-8664-62bcb05a7e91" />
             <status state="operational" />
         </component>
@@ -586,7 +679,8 @@
             <p>FedRAMP does not require any specific information here.</p>
         </description>
         <!-- ####
-            AC-1 is not in our profile. If we include it, we meed to correct the errors (AC-1.b does not have a b.1 and b.2, but it has b and c) 
+            AC-1 is not in our profile. If we include it, we meed to correct the errors (AC-1.b does not have a
+        b.1 and b.2, but it has b and c) 
             #### -->
         <!-- AC-1 will not be implemented now. 
         <implemented-requirement uuid="eee8697a-bc39-45aa-accc-d3e534932efb" control-id="ac-1">
@@ -686,74 +780,104 @@
             AC-2
             ######  -->
         <implemented-requirement uuid="7a36cf53-156d-4d1f-9a8b-433f61cc57b7" control-id="ac-2">
-            <!-- TBD: The following <prop>s must be reviewed, updated and only one option kept based on AC-2 implementation of the inherited control for manageing the Authorizing Official's account -->
-            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal" value="2024/05/30" />
+            <!-- TBD: The following <prop>s must be reviewed, updated and only one option kept based
+            on AC-2 implementation of the inherited control for manageing the Authorizing Official's
+            account -->
+            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal"
+                value="2024/05/30" />
             <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="partial">
                 <remarks>
-                    <p>AMB provides access control to the infrastracter for the entities identified below. The Consumer's responsibility is to update the ACL ith the identities authorized to access the resource.</p>
+                    <p>Per the documentation available in the Blossom Wiki, the AWS Managed
+                        Blockchain (AMB) provides access control to the infrastracture for the
+                        entities identified below which require access to IaaS to maintain and
+                        deploy system components. The blockchain's chaincode is implementing Next
+                        Generation Access Control (NGAC) standard to manage the access to resources
+                        for the roles docuemnted in the Blossom specification. Access control policy
+                        machines are implemented for the two private channels of the AMB: the ATO or
+                        "Authorization" channel and the "Businness" channel.</p>
                 </remarks>
             </prop>
-            <!-- NOT APPLICABLE VALUES - TO BE REMOVED AT THE END
-            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="planned">
+            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="implemented">
                 <remarks>
-                    <p>TBD: Describe the portion of the control that is not satisfied.</p>
+                    <p>The policy machines are controling the access to the two chaincodes
+                        (Authorization and Business) used by the system.</p>
                 </remarks>
             </prop>
+            <!-- Use this prop for not applicable controls
             <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable">
                 <remarks>
                     <p>TBD: Describe the justification for marking this control Not Applicable.</p>
                 </remarks>
             </prop>  
-            -->        
-            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged-system" />
+            -->
+            <!-- Control origination varies per role. See by-component under ac-2_smt
+            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
+                value="leveraged-system" />
             <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
                 value="customer-configured">
                 <remarks>
-                    <p>TBD: Describe any customer-configured requirements for satisfying this control.</p>
+                    <p>TBD: Describe any customer-configured requirements for satisfying this
+                        control.</p>
                 </remarks>
             </prop>
+            -->
+            <link rel="documentation" href="#c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c" />
+            <set-parameter param-id="ac-2_prm_1">
+                <value>business need</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_2">
+                <value>business need</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_3">
+                <value>System Owner (SO)</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_4">
+                <value>Types of User Accounts for Blossom</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_5">
+                <value>System Owner (SO)</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_6">
+                <value>1 business day</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_7">
+                <value>1 business day</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_8">
+                <value>1 business day</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_9">
+                <value>System Owner (SO)</value>
+            </set-parameter>
+            <set-parameter param-id="ac-2_prm_10">
+                <value>every 6 months</value>
+            </set-parameter>
             <responsible-role role-id="system-administrator">
                 <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
             </responsible-role>
             <responsible-role role-id="system-owner">
                 <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
             </responsible-role>
-            <statement statement-id="ac-2_smt" uuid="4a2428eb-41eb-447a-81db-4f6d98a003ce">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="eb710146-1ede-4876-9a3b-02c18408e506">
+            <statement statement-id="ac-2_smt" uuid="4facc265-ba1d-4d66-afc7-6385984b6a1e">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010" uuid="9d06a5a6-0c30-43cb-a18a-baabd616ddfb">
                     <description>
-                        <p>The NGAC implementation in the two chaincodes manages the access control for the Blossom business layer users and the BC Member's ATO-related accounts.</p>
+                        <p>For the IAM entities that have a business need, and which have accounts created in Cognito, the Policy machines which implement NGAC in the two chaincodes are managing the access control for the Blossom business layer users and the BC Member's Authorizing Official that is uploading the ATO Attestation to the Authorization channel.</p>
                     </description>
-                    <set-parameter param-id="ac-2_prm_1">
-                        <value>business need</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_2">
-                        <value>business need</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_3">
-                        <value>System Owner (SO)</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_4">
-                        <value>Types of User Accounts for Blossom</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_5">
-                        <value>System Owner (SO)</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_6">
-                        <value>1 business day</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_7">
-                        <value>1 business day</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_8">
-                        <value>1 business day</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_9">
-                        <value>System Owner (SO)</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-2_prm_10">
-                        <value>every 6 months</value>
-                    </set-parameter>
+                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="customer-configured">
+                        <remarks>
+                            <p>The Blossom system System Owner and System Administrator are repsonsible for approving, creating and managing access by maintainit accurate information in Cognito and updating the access control policies in the chaincode for each channel.</p>
+                        </remarks>
+                    </prop>
+                </by-component>
+                <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" uuid="eb710146-1ede-4876-9a3b-02c18408e506">
+                    <description>
+                        <p>AWS provide access to the system to approved entities, for deployment, maintenance, and operations.</p>
+                    </description>
+                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged">
+                        <remarks>
+                            <p>Keep the ACL list current at all times.</p>
+                        </remarks>
+                    </prop>
                 </by-component>
             </statement>
             <statement statement-id="ac-2_smt.a" uuid="24a85abb-25ad-4686-850c-5c0e8ab69a0c">
@@ -764,18 +888,21 @@
                         <p>These accounts are managed by the NGAC implementation in the chaincodes for the ATO and for the assets management (business) processes.</p>
                         <p>The following accounts are supported for the business operations (assets management):</p>
                         <ul>
-                            <li>Privileged accounts:
-                                <ul>License Owner (LO)</ul>
+                            <li>Privileged accounts: 
+                                <ul>License Owner</ul>
                             </li>
-                            <li>Non-Privileged accounts:
-                                <ul>Acquisition Officer (ACQ)</ul>
-                                <ul>Technical Point of Contact (TPOC)</ul>
+                            <li>Non-Privileged accounts: 
+                                <ul>Acquisition Officer</ul>
+                                <ul>Technical Point of Contact</ul>
                             </li>
                         </ul>
-                        <p>The following account is supported for the ATO process (ATO attestation submission and review of other Blossom members):</p>
+                        <p>The Authorizing Official is responsible for reviewing the ATO package prepared by the System Owner and signing/authorizing the system to operate.</p>
+                        <p>The System Owner remains the custodian of all system ATO related artifacts.</p>
+                        <p>Upon approval, teh AO is responsible for generating automatically the ATO attestation and upload it to the ATO channel.</p>
+                        <p>The following account is supported for the ATO processes. :</p>
                         <ul>
-                            <li>Non-Privileged accounts:
-                                <ul>Authorizing Official (AO)</ul>
+                            <li>Privileged accounts:
+                                 <ul>Authorizing Official</ul>
                             </li>
                         </ul>
                     </description>
@@ -784,15 +911,20 @@
                 <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65"
                     uuid="84de735f-ba37-4bb4-b784-79760f986a40">
                     <description>
-                        <p>The accounts of the Blossom Member managed by the Leveraged AWS IaaS are:</p>
+                        <p>The following accounts of the Blossom System of NIST Member managed by the Leveraged AWS IaaS are:</p>
                         <ul>
-                            <li>Privileged accounts:
-                                <ul>System Owner (SO)</ul>
-                                <ul>System Administrator (SA)</ul>
+                            <li>Privileged accounts: 
+                                <ul>System Owner</ul>
+                                <ul>System Administrator</ul>
                             </li>
-                            <li>Non-Privileged accounts:
-                                <ul>System Security Assessor (SSA)</ul>
-                                <ul>Authorizing Official (AO)</ul>
+                            <li>Non-Privileged accounts: 
+                                <ul>System Security Assessor</ul>
+                                <!-- 
+                                NOTE: Authorizing Official will not have access to the infrastructure. 
+                                 System Owner is responsible to prepare the ATO package in collaboration 
+                                 with the System Security Assessor. Removing the AO from this list.
+                                <ul>Authorizing Official</ul>
+                                -->
                             </li>
                         </ul>
                     </description>
@@ -800,13 +932,21 @@
                         provided-uuid="11111111-0000-4000-9009-002001002001">
                         <description>
                             <p>TBD: provided-uuid needs to match the one in the AWS' SSP.</p>
-                            <p>All privileged and non-privileged accounts that are granted access to the AWS infrastructure and are responsible for the Blossom member (this sysstem), are managed by the AWS IaaS (leveraged ATO system) which uses an Access Control List (ACL) for the NIST employees assigned Blossom roles.</p>
+                            <p>All privileged and non-privileged accounts that are granted access to
+                                the AWS infrastructure and are responsible for the Blossom System deployment and maintenance
+                                (this system), are managed by the AWS IaaS (leveraged ATO system)
+                                which uses an Access Control List (ACL) for the NIST employees
+                                assigned Blossom roles.</p>
                         </description>
                     </inherited>
                     <satisfied uuid="6486f725-1372-434f-9b1b-7cf3f50c32d1"
                         responsibility-uuid="11111111-0000-4000-9009-002001002002">
                         <description>
-                            <p>For all responsible parties with roles managed by the AWS IaaS system, accounts creation/deletion are requested, approved/revoked by the System Owner or the Blossom PM and are added to or delete from the ACL list.</p>
+                            <p>The Access Control List (ACL) updates are Blossom system's responsibility (as customers of AWS)
+                                For all roles listed above which are managed by the AWS IaaS
+                                system, account creation/revokation/deletion requests are approved
+                                by the Blossom system's System Owner or the Blossom PM and are added to or delete
+                                from the ACL list by the System Administrator.</p>
                         </description>
                     </satisfied>
                 </by-component>
@@ -815,7 +955,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="d52db118-3e6f-4b39-8fd9-a3a65dfcb6b1">
                     <description>
-                        <p>Assign account managers</p>
+                        <p>For this system, the entity with the System Administratore role
+                             acts as the Accounts Manager and is responsible for creating, 
+                             revoking, delete accounts per decissions made by the System Owner.</p>
                     </description>
                 </by-component>
             </statement>
@@ -823,7 +965,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c72b52e1-1943-4a52-be48-7bcce7df2f6d">
                     <description>
-                        <p>Require <insert type="param" id-ref="ac-2_prm_1" />[Assignment: organization-defined prerequisites and criteria] for group and role membership;</p>
+                        <p>Require <insert type="param" id-ref="ac-2_prm_1" />[Assignment:
+                            organization-defined prerequisites and criteria] for group and role
+                            membership;</p>
                     </description>
                 </by-component>
             </statement>
@@ -856,7 +1000,8 @@
                     uuid="37e94c9b-acb8-458f-8a95-c1d110ead856">
                     <description>
                         <p>Access authorizations (i.e., privileges) and <insert type="param"
-                            id-ref="ac-2_prm_2" />[Assignment: organization-defined attributes (as required)] for each account;</p>
+                                id-ref="ac-2_prm_2" />[Assignment: organization-defined attributes
+                            (as required)] for each account;</p>
                     </description>
                 </by-component>
             </statement>
@@ -864,7 +1009,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="40d40fbc-aed0-4323-9846-2ed3dc0f321e">
                     <description>
-                        <p>Require approvals by <insert type="param" id-ref="ac-2_prm_3" />[Assignment: organization-defined personnel or roles] for requests to create accounts;</p>
+                        <p>Require approvals by <insert type="param" id-ref="ac-2_prm_3" />[Assignment:
+                            organization-defined personnel or roles] for requests to create
+                            accounts;</p>
                     </description>
                 </by-component>
             </statement>
@@ -873,7 +1020,8 @@
                     uuid="02d4c648-5a86-4155-bd73-02c3439262b4">
                     <description>
                         <p>Create, enable, modify, disable, and remove accounts in accordance with <insert
-                            type="param" id-ref="ac-2_prm_4" />[Assignment: organization-defined policy, procedures, prerequisites, and criteria];</p>
+                                type="param" id-ref="ac-2_prm_4" />[Assignment: organization-defined
+                            policy, procedures, prerequisites, and criteria];</p>
                     </description>
                 </by-component>
             </statement>
@@ -889,7 +1037,8 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c555e31a-7b0d-437a-b415-e9ba5f2e1ef0">
                     <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment: organization-defined personnel or roles] within:</p>
+                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment:
+                            organization-defined personnel or roles] within:</p>
                     </description>
                 </by-component>
             </statement>
@@ -897,7 +1046,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="f1606d4f-3c5e-4c25-9649-94a12edbc113">
                     <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment: system owner] within:<insert type="param" id-ref="ac-2_prm_6" />[Assignment: 1 business day] when accounts are no longer required;</p>
+                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment:
+                            system owner] within:<insert type="param" id-ref="ac-2_prm_6" />[Assignment:
+                            1 business day] when accounts are no longer required;</p>
                     </description>
                 </by-component>
             </statement>
@@ -905,7 +1056,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c5a6312a-6123-4aa4-8097-3b4e30e70b72">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_7" />[Assignment: organization-defined time period] when users are terminated or transferred; </p>
+                        <p><insert type="param" id-ref="ac-2_prm_7" />[Assignment:
+                            organization-defined time period] when users are terminated or
+                            transferred; </p>
                     </description>
                 </by-component>
             </statement>
@@ -913,7 +1066,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="1d085fa3-94d9-4f4c-a62b-963cc4640f12">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_8" />[Assignment: organization-defined time period] when system usage or need-to-know changes for an individual;</p>
+                        <p><insert type="param" id-ref="ac-2_prm_8" />[Assignment:
+                            organization-defined time period] when system usage or need-to-know
+                            changes for an individual;</p>
                     </description>
                 </by-component>
             </statement>
@@ -945,7 +1100,8 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="587c32c5-701a-4e5c-83a7-2438ab3d71b1">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_9" />[Assignment: organization-defined attributes (as required)];</p>
+                        <p><insert type="param" id-ref="ac-2_prm_9" />[Assignment:
+                            organization-defined attributes (as required)];</p>
                     </description>
                 </by-component>
             </statement>
@@ -954,7 +1110,8 @@
                     uuid="b7932e43-9aa3-4bba-86a8-439a74e1e79a">
                     <description>
                         <p>Review accounts for compliance with account management requirements <insert
-                            type="param" id-ref="ac-2_prm_10" />[Assignment: organization-defined frequency];</p>
+                                type="param" id-ref="ac-2_prm_10" />[Assignment:
+                            organization-defined frequency];</p>
                     </description>
                 </by-component>
             </statement>
@@ -962,7 +1119,9 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="d0cdfbc2-aef5-418e-94dc-9906341bcc12">
                     <description>
-                        <p>Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group;</p>
+                        <p>Establish and implement a process for changing shared or group account
+                            authenticators (if deployed) when individuals are removed from the
+                            group;</p>
                     </description>
                 </by-component>
             </statement>
@@ -970,13 +1129,25 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="f23d55dd-1204-42f9-862e-2a07200b5c6e">
                     <description>
-                        <p>Align account management processes with personnel termination and transfer processes.</p>
+                        <p>Align account management processes with personnel termination and
+                            transfer processes.</p>
                     </description>
                 </by-component>
             </statement>
         </implemented-requirement>
     </control-implementation>
     <back-matter>
+        <resource uuid="c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c">
+            <description>
+                <p>Blossom Wiki</p>
+            </description>
+            <rlink
+                href="https://github.com/usnistgov/blossom-nist-member/wiki"
+                media-type="multipart/alternative" />
+            <remarks>
+                <p>Project's Wiki which provides descriptions for the ATO and business processes.</p>
+            </remarks>
+        </resource>
         <resource uuid="006babc9-4f57-4ab0-9941-15fcb65e0387">
             <description>
                 <p>National Institute of Standards and Technology's Logo</p>

From e5ea1a3eba40322b0dd9c316b92d460cd8208f73 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Tue, 2 Jul 2024 17:37:01 -0400
Subject: [PATCH 20/36] Add handshake to S3 bucket

---
 .github/workflows/account_request_implement.yaml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/account_request_implement.yaml b/.github/workflows/account_request_implement.yaml
index 5f300a2..5d52eff 100644
--- a/.github/workflows/account_request_implement.yaml
+++ b/.github/workflows/account_request_implement.yaml
@@ -21,4 +21,16 @@ jobs:
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
             @usnistgov/blossom-assessors An edit to the ACL and/or SSP has been implemented.
-            Please monitor the automated assessment.
\ No newline at end of file
+            Please monitor the automated assessment.
+      
+      - name: Checkout repo to access handshake file
+        uses: actions/checkout@v3
+      
+      - name: Initiate handshake to S3 bucket
+        uses: shallwefootball/s3-upload-action@v1.3.3
+        with:
+          aws_key_id: ${{ secrets.AWS_ACCESS_KEY }}
+          aws_secret_access_key: ${{ secrets.AWS_SECRET_KEY }}
+          aws_bucket: ${{ secrets.AWS_BUCKET }}
+          source_dir: '.sims/handshake'
+          destination_dir: ''
\ No newline at end of file

From 6ca1e2d93553f9407da5227d655cd432d17e8c1c Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Fri, 5 Jul 2024 15:25:12 -0400
Subject: [PATCH 21/36] Add handshake empty file

---
 .sims/handshake | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 .sims/handshake

diff --git a/.sims/handshake b/.sims/handshake
new file mode 100644
index 0000000..e69de29

From 5c9047eb9e25ff6eb8c1486b3ba81f3cf6f81aa3 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Mon, 8 Jul 2024 10:04:01 -0400
Subject: [PATCH 22/36] Create handshake directory to upload to S3

---
 .sims/{handshake => handshake/handshake_empty} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .sims/{handshake => handshake/handshake_empty} (100%)

diff --git a/.sims/handshake b/.sims/handshake/handshake_empty
similarity index 100%
rename from .sims/handshake
rename to .sims/handshake/handshake_empty

From 04cb0ab5cb24ee2178b0d12b2c51422660b7d835 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Tue, 9 Jul 2024 12:42:24 -0400
Subject: [PATCH 23/36] Handshake using AWS cli

---
 .../workflows/account_request_implement.yaml   | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/account_request_implement.yaml b/.github/workflows/account_request_implement.yaml
index 5d52eff..241473e 100644
--- a/.github/workflows/account_request_implement.yaml
+++ b/.github/workflows/account_request_implement.yaml
@@ -26,11 +26,15 @@ jobs:
       - name: Checkout repo to access handshake file
         uses: actions/checkout@v3
       
-      - name: Initiate handshake to S3 bucket
-        uses: shallwefootball/s3-upload-action@v1.3.3
+      - name: Configure AWS CLI
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws_key_id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws_secret_access_key: ${{ secrets.AWS_SECRET_KEY }}
-          aws_bucket: ${{ secrets.AWS_BUCKET }}
-          source_dir: '.sims/handshake'
-          destination_dir: ''
\ No newline at end of file
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+      
+      - name: Copy handshake to bucket
+        run: |
+          aws s3 cp .sims/handshake/handshake_empty s3://"$AWS_BUCKET"
+        env:
+          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file

From 34b3e36a43ef05801336b8d74a74ddd867c98514 Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Tue, 9 Jul 2024 15:32:54 -0400
Subject: [PATCH 24/36] More progress made on AC-2 in the  SSP and ACL

---
 .sims/acl-ato.xml                             | 56 -----------
 .sims/acl.xml                                 | 20 +---
 .../xml/ssp/blossom_admin_member_ssp.xml      | 96 ++++++++++++-------
 3 files changed, 64 insertions(+), 108 deletions(-)
 delete mode 100644 .sims/acl-ato.xml

diff --git a/.sims/acl-ato.xml b/.sims/acl-ato.xml
deleted file mode 100644
index c6e0889..0000000
--- a/.sims/acl-ato.xml
+++ /dev/null
@@ -1,56 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Owner>
-    <ID>Owner-canonical-user-ID</ID>
-    <DisplayName>System Owner (SO)</DisplayName>
-  </Owner>
-  <AccessControlList>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>Owner-canonical-user-ID</ID>
-        <DisplayName>System Owner (SO)</DisplayName>
-      </Grantee>
-      <Permission>FULL_CONTROL</Permission>
-    </Grant>   
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>user1-canonical-user-ID</ID>
-        <DisplayName>System Administrator (SA)</DisplayName>
-      </Grantee>
-      <Permission>WRITE</Permission>
-    </Grant>
-    <Grant>
-        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-          <ID>user1-canonical-user-ID</ID>
-          <DisplayName>System Administrator (SA)</DisplayName>
-        </Grantee>
-        <Permission>WRITE</Permission>
-    </Grant>
-    <Grant>
-        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-          <ID>user1-canonical-user-ID</ID>
-          <DisplayName>Authorizing Official (AO)</DisplayName>
-        </Grantee>
-        <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-          <ID>user1-canonical-user-ID</ID>
-          <DisplayName>System Security Assessor (SSA)</DisplayName>
-        </Grantee>
-        <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
-        <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI> 
-      </Grantee>
-      <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
-        <URI>http://acs.amazonaws.com/groups/s3/LogDelivery</URI>
-      </Grantee>
-      <Permission>WRITE</Permission>
-    </Grant>
-  </AccessControlList>
-</AccessControlPolicy>
\ No newline at end of file
diff --git a/.sims/acl.xml b/.sims/acl.xml
index 6370f3c..50523c2 100644
--- a/.sims/acl.xml
+++ b/.sims/acl.xml
@@ -21,21 +21,21 @@
         <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
         <DisplayName>System Owner</DisplayName>
       </Grantee>
-      <Permission>READ_ACP</Permission>
+      <Permission>WRITE</Permission>
     </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
         <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
         <DisplayName>System Owner</DisplayName>
       </Grantee>
-      <Permission>WRITE</Permission>
+      <Permission>READ_ACP</Permission>
     </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
         <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
         <DisplayName>System Owner</DisplayName>
       </Grantee>
-      <Permission>READ</Permission>
+      <Permission>WRITE_ACP</Permission>
     </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
@@ -93,20 +93,6 @@
       </Grantee>
       <Permission>READ_ACP</Permission>
     </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>user1-canonical-user-ID</ID>
-        <DisplayName>System Security Assessor</DisplayName>
-      </Grantee>
-      <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>user1-canonical-user-ID</ID>
-        <DisplayName>System Security Assessor</DisplayName>
-      </Grantee>
-      <Permission>READ_ACP</Permission>
-    </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
         <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index a1762b7..fb848c2 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -7,6 +7,9 @@
         <last-modified>2024-03-27T00:00:00Z</last-modified>
         <version>0.1</version>
         <oscal-version>1.1.2</oscal-version>
+        <!-- ###
+         The following 4 roles are associated with the ATO operations and system management. 
+         ### -->
         <role id="system-owner">
             <title>System Owner (SO)</title>
             <description>
@@ -16,15 +19,11 @@
                     in known as "this system").</p>
             </description>
         </role>
-        <role id="authorizing-official">
-            <title>Authorizing Official</title>
+        <role id="system-administrator">
+            <title>System Administrator (SA)</title>
             <description>
-                <p>The individual or individuals who are ultimatly accountable for reviewing the
-                    assessemnt package, discuss with the SO the findings and grant an authorization
-                    to operate (ATO) to "this system".</p>
-                <p>The Authorizing Official is the only entity responsible for the security posture
-                    of the system that gets access to the ATO channel (chainecode). The AO signs the
-                    MOU on behalf of the agency.</p>
+                <p>The individual accountable for the deployment, configuration, testing and
+                    operations of the system on behalf of the System Owner.</p>
             </description>
         </role>
         <role id="sys-sec-assessor">
@@ -34,6 +33,20 @@
                     behalf of the system owner.</p>
             </description>
         </role>
+        <role id="authorizing-official">
+            <title>Authorizing Official</title>
+            <description>
+                <p>The individual or individuals who are ultimatly accountable for reviewing the
+                    assessemnt package, discuss with the SO the findings and grant an authorization
+                    to operate (ATO) to Blosom, a.ka "this system".</p>
+                <p>The Authorizing Official is the only entity responsible for the security posture
+                    of the system and has access to the ATO channel (chaincode) to upload the ATO Attestation Memo (AAM). 
+                    The AO signs the AAM on behalf of the agency.</p>
+            </description>
+        </role>
+        <!-- ###
+          The following 3 roles are associated with the business (assets) operations 
+          ### -->
         <role id="tpoc">
             <title>Technical Point of Contact (TPOC)</title>
             <description>
@@ -41,13 +54,6 @@
                     uninstall, return).</p>
             </description>
         </role>
-        <role id="system-administrator">
-            <title>System Administrator (SA)</title>
-            <description>
-                <p>The individual accountable for the deployment, configuration, testing and
-                    operations of the system on behalf of the System Owner.</p>
-            </description>
-        </role>
         <role id="license-owner">
             <title>License Owner (LO)</title>
             <description>
@@ -134,9 +140,11 @@
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <!-- The UUIDs of the following parties need to be registered in Cognito first
+        <!-- ###
+         The UUIDs of the following parties need to be registered in Cognito first
           and the UUID generated by Cognito needs to be used as the party's UUID.
-          Any update in Cognito will have to trigger an update of the SSP -->
+          Any update in Cognito will have to trigger an update of the SSP 
+          ### -->
         <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
             <name>Aurelian Officeman</name>
             <prop name="job-title" value="Authorizing Official" />
@@ -173,8 +181,10 @@
         </party>
         <!-- ###
              Entities with access to the infrastructure
-         ### -->
-         <!-- Privileged Roles -->
+        ### -->
+            <!-- #### 
+             Privileged Roles 
+            #### -->
         <responsible-party role-id="system-owner">
             <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
             <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
@@ -186,7 +196,9 @@
                     responsibilities for "this system" supporting the system owner.</p>
             </remarks>
         </responsible-party>
-        <!-- Non-Privileged Roles -->
+            <!-- ####
+             Non-Privileged Roles 
+             #### -->
         <responsible-party role-id="sys-sec-assessor">
             <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
             <remarks>
@@ -197,15 +209,23 @@
         <!-- ###
              Entities with access to the assets/business private channel 
          ### -->
-         <!-- Privileged Roles -->
+            <!-- #### 
+             Privileged Roles 
+             #### -->
         <responsible-party role-id="license-owner">
             <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
+            <remarks>
+                <p>The license owner is responsible for managing the licenses a Blossom Member leases, and is also responsible for uploading to the asset chaincode the MOA signed by the TPOC and Acquisition Officer.</p>
+            </remarks>
         </responsible-party>
-         <!-- Non-Privileged Roles -->
+            <!-- ####
+             Non-Privileged Roles 
+             #### -->
         <responsible-party role-id="tpoc">
             <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
             <remarks>
                 <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
+                <p>The TPOC is also responsible for reviewing and signing the initial Memorandum of Aggrement (MOA) stating the rules on engagemnet whith Blossom service around ATO automation and assets leasing.</p>
             </remarks>
         </responsible-party>
         <responsible-party role-id="acquisition-officer">
@@ -571,8 +591,9 @@
                 <description>
                     <p>A diagram-specific explanation.</p>
                 </description>
-                <!--TBD:
-                needds fixing link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" / -->
+                <!--TBD: needds to be fixed 
+                <link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" /> 
+                -->
                 <caption>Data Flow Diagram</caption>
             </diagram>
         </data-flow>
@@ -823,7 +844,7 @@
             -->
             <link rel="documentation" href="#c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c" />
             <set-parameter param-id="ac-2_prm_1">
-                <value>business need</value>
+                <value>have an organization-sponsored email address to demonstrate employment and have been approved by the System Owner based on the business need of the individual</value>
             </set-parameter>
             <set-parameter param-id="ac-2_prm_2">
                 <value>business need</value>
@@ -847,7 +868,7 @@
                 <value>1 business day</value>
             </set-parameter>
             <set-parameter param-id="ac-2_prm_9">
-                <value>System Owner (SO)</value>
+                <value>System Owner</value>
             </set-parameter>
             <set-parameter param-id="ac-2_prm_10">
                 <value>every 6 months</value>
@@ -865,13 +886,13 @@
                     </description>
                     <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="customer-configured">
                         <remarks>
-                            <p>The Blossom system System Owner and System Administrator are repsonsible for approving, creating and managing access by maintainit accurate information in Cognito and updating the access control policies in the chaincode for each channel.</p>
+                            <p>The Blossom system's System Owner and System Administrator are repsonsible for approving, creating and managing accounts and grant or denie access to the system by maintaining accurate information in Cognito and updating the access control policies access control lists (ACLs).</p>
                         </remarks>
                     </prop>
                 </by-component>
                 <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" uuid="eb710146-1ede-4876-9a3b-02c18408e506">
                     <description>
-                        <p>AWS provide access to the system to approved entities, for deployment, maintenance, and operations.</p>
+                        <p>AWS manages the access to approved entities to the system's infrastructure, for deployment, maintenance, and operations.</p>
                     </description>
                     <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged">
                         <remarks>
@@ -919,12 +940,12 @@
                             </li>
                             <li>Non-Privileged accounts: 
                                 <ul>System Security Assessor</ul>
-                                <!-- 
+                                <!-- #####
                                 NOTE: Authorizing Official will not have access to the infrastructure. 
                                  System Owner is responsible to prepare the ATO package in collaboration 
                                  with the System Security Assessor. Removing the AO from this list.
                                 <ul>Authorizing Official</ul>
-                                -->
+                                ##### -->
                             </li>
                         </ul>
                     </description>
@@ -955,7 +976,7 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="d52db118-3e6f-4b39-8fd9-a3a65dfcb6b1">
                     <description>
-                        <p>For this system, the entity with the System Administratore role
+                        <p>For this system, the entity with the System Administrator role
                              acts as the Accounts Manager and is responsible for creating, 
                              revoking, delete accounts per decissions made by the System Owner.</p>
                     </description>
@@ -965,9 +986,11 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c72b52e1-1943-4a52-be48-7bcce7df2f6d">
                     <description>
-                        <p>Require <insert type="param" id-ref="ac-2_prm_1" />[Assignment:
-                            organization-defined prerequisites and criteria] for group and role
-                            membership;</p>
+                        <!-- ac-2_prm_1= "have an organization-sponsored email address to demonstrate employment and
+                          have been approved by the System Owner based on the business need of the individual" -->
+                        <p>For each identified role, access to the system for each role will be individually 
+                            analyzed and granted if the requesters proves they <insert type="param" id-ref="ac-2_prm_1" /> 
+                            for the respective group and role membership.</p>
                     </description>
                 </by-component>
             </statement>
@@ -975,7 +998,10 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="779d08e3-4ed0-4a83-84ab-2ca2c9ec3745">
                     <description>
-                        <p>Specify:</p>
+                        <p>1. All authorized users are listed and accuratelly maintained in this SSP in the "metadata", as "party" elements of type="person".</p>
+                        <p>2. All roles supported by the Blossom system are documented in this SSP in the "metadata", as "role" elements with "id" identifying the role. 
+                            This system does not support groups. </p>
+                        <p>3. All access authorizations are docuemnted in this SSP in the "metadata" as "responsible-party" with "role-id" mathing the respective roles or attributes.</p>
                     </description>
                 </by-component>
             </statement>

From 39bc59278f938a806f683821a0c992d7d9683084 Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Tue, 9 Jul 2024 15:32:54 -0400
Subject: [PATCH 25/36] More progress made on AC-2 in the  SSP and ACL

---
 .sims/acl-ato.xml                             | 56 -----------
 .sims/acl.xml                                 | 20 +---
 .../xml/ssp/blossom_admin_member_ssp.xml      | 96 ++++++++++++-------
 3 files changed, 64 insertions(+), 108 deletions(-)
 delete mode 100644 .sims/acl-ato.xml

diff --git a/.sims/acl-ato.xml b/.sims/acl-ato.xml
deleted file mode 100644
index c6e0889..0000000
--- a/.sims/acl-ato.xml
+++ /dev/null
@@ -1,56 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Owner>
-    <ID>Owner-canonical-user-ID</ID>
-    <DisplayName>System Owner (SO)</DisplayName>
-  </Owner>
-  <AccessControlList>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>Owner-canonical-user-ID</ID>
-        <DisplayName>System Owner (SO)</DisplayName>
-      </Grantee>
-      <Permission>FULL_CONTROL</Permission>
-    </Grant>   
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>user1-canonical-user-ID</ID>
-        <DisplayName>System Administrator (SA)</DisplayName>
-      </Grantee>
-      <Permission>WRITE</Permission>
-    </Grant>
-    <Grant>
-        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-          <ID>user1-canonical-user-ID</ID>
-          <DisplayName>System Administrator (SA)</DisplayName>
-        </Grantee>
-        <Permission>WRITE</Permission>
-    </Grant>
-    <Grant>
-        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-          <ID>user1-canonical-user-ID</ID>
-          <DisplayName>Authorizing Official (AO)</DisplayName>
-        </Grantee>
-        <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-        <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-          <ID>user1-canonical-user-ID</ID>
-          <DisplayName>System Security Assessor (SSA)</DisplayName>
-        </Grantee>
-        <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
-        <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI> 
-      </Grantee>
-      <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
-        <URI>http://acs.amazonaws.com/groups/s3/LogDelivery</URI>
-      </Grantee>
-      <Permission>WRITE</Permission>
-    </Grant>
-  </AccessControlList>
-</AccessControlPolicy>
\ No newline at end of file
diff --git a/.sims/acl.xml b/.sims/acl.xml
index 6370f3c..50523c2 100644
--- a/.sims/acl.xml
+++ b/.sims/acl.xml
@@ -21,21 +21,21 @@
         <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
         <DisplayName>System Owner</DisplayName>
       </Grantee>
-      <Permission>READ_ACP</Permission>
+      <Permission>WRITE</Permission>
     </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
         <ID>09ad840f-aa79-43aa-9f22-25182c2ab11b</ID>
         <DisplayName>System Owner</DisplayName>
       </Grantee>
-      <Permission>WRITE</Permission>
+      <Permission>READ_ACP</Permission>
     </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
         <ID>551b9706-d6a4-4d25-8207-f2ccec541016</ID>
         <DisplayName>System Owner</DisplayName>
       </Grantee>
-      <Permission>READ</Permission>
+      <Permission>WRITE_ACP</Permission>
     </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
@@ -93,20 +93,6 @@
       </Grantee>
       <Permission>READ_ACP</Permission>
     </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>user1-canonical-user-ID</ID>
-        <DisplayName>System Security Assessor</DisplayName>
-      </Grantee>
-      <Permission>READ</Permission>
-    </Grant>
-    <Grant>
-      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
-        <ID>user1-canonical-user-ID</ID>
-        <DisplayName>System Security Assessor</DisplayName>
-      </Grantee>
-      <Permission>READ_ACP</Permission>
-    </Grant>
     <Grant>
       <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
         <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index a1762b7..fb848c2 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -7,6 +7,9 @@
         <last-modified>2024-03-27T00:00:00Z</last-modified>
         <version>0.1</version>
         <oscal-version>1.1.2</oscal-version>
+        <!-- ###
+         The following 4 roles are associated with the ATO operations and system management. 
+         ### -->
         <role id="system-owner">
             <title>System Owner (SO)</title>
             <description>
@@ -16,15 +19,11 @@
                     in known as "this system").</p>
             </description>
         </role>
-        <role id="authorizing-official">
-            <title>Authorizing Official</title>
+        <role id="system-administrator">
+            <title>System Administrator (SA)</title>
             <description>
-                <p>The individual or individuals who are ultimatly accountable for reviewing the
-                    assessemnt package, discuss with the SO the findings and grant an authorization
-                    to operate (ATO) to "this system".</p>
-                <p>The Authorizing Official is the only entity responsible for the security posture
-                    of the system that gets access to the ATO channel (chainecode). The AO signs the
-                    MOU on behalf of the agency.</p>
+                <p>The individual accountable for the deployment, configuration, testing and
+                    operations of the system on behalf of the System Owner.</p>
             </description>
         </role>
         <role id="sys-sec-assessor">
@@ -34,6 +33,20 @@
                     behalf of the system owner.</p>
             </description>
         </role>
+        <role id="authorizing-official">
+            <title>Authorizing Official</title>
+            <description>
+                <p>The individual or individuals who are ultimatly accountable for reviewing the
+                    assessemnt package, discuss with the SO the findings and grant an authorization
+                    to operate (ATO) to Blosom, a.ka "this system".</p>
+                <p>The Authorizing Official is the only entity responsible for the security posture
+                    of the system and has access to the ATO channel (chaincode) to upload the ATO Attestation Memo (AAM). 
+                    The AO signs the AAM on behalf of the agency.</p>
+            </description>
+        </role>
+        <!-- ###
+          The following 3 roles are associated with the business (assets) operations 
+          ### -->
         <role id="tpoc">
             <title>Technical Point of Contact (TPOC)</title>
             <description>
@@ -41,13 +54,6 @@
                     uninstall, return).</p>
             </description>
         </role>
-        <role id="system-administrator">
-            <title>System Administrator (SA)</title>
-            <description>
-                <p>The individual accountable for the deployment, configuration, testing and
-                    operations of the system on behalf of the System Owner.</p>
-            </description>
-        </role>
         <role id="license-owner">
             <title>License Owner (LO)</title>
             <description>
@@ -134,9 +140,11 @@
             <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
             <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
         </party>
-        <!-- The UUIDs of the following parties need to be registered in Cognito first
+        <!-- ###
+         The UUIDs of the following parties need to be registered in Cognito first
           and the UUID generated by Cognito needs to be used as the party's UUID.
-          Any update in Cognito will have to trigger an update of the SSP -->
+          Any update in Cognito will have to trigger an update of the SSP 
+          ### -->
         <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
             <name>Aurelian Officeman</name>
             <prop name="job-title" value="Authorizing Official" />
@@ -173,8 +181,10 @@
         </party>
         <!-- ###
              Entities with access to the infrastructure
-         ### -->
-         <!-- Privileged Roles -->
+        ### -->
+            <!-- #### 
+             Privileged Roles 
+            #### -->
         <responsible-party role-id="system-owner">
             <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
             <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
@@ -186,7 +196,9 @@
                     responsibilities for "this system" supporting the system owner.</p>
             </remarks>
         </responsible-party>
-        <!-- Non-Privileged Roles -->
+            <!-- ####
+             Non-Privileged Roles 
+             #### -->
         <responsible-party role-id="sys-sec-assessor">
             <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
             <remarks>
@@ -197,15 +209,23 @@
         <!-- ###
              Entities with access to the assets/business private channel 
          ### -->
-         <!-- Privileged Roles -->
+            <!-- #### 
+             Privileged Roles 
+             #### -->
         <responsible-party role-id="license-owner">
             <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
+            <remarks>
+                <p>The license owner is responsible for managing the licenses a Blossom Member leases, and is also responsible for uploading to the asset chaincode the MOA signed by the TPOC and Acquisition Officer.</p>
+            </remarks>
         </responsible-party>
-         <!-- Non-Privileged Roles -->
+            <!-- ####
+             Non-Privileged Roles 
+             #### -->
         <responsible-party role-id="tpoc">
             <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
             <remarks>
                 <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
+                <p>The TPOC is also responsible for reviewing and signing the initial Memorandum of Aggrement (MOA) stating the rules on engagemnet whith Blossom service around ATO automation and assets leasing.</p>
             </remarks>
         </responsible-party>
         <responsible-party role-id="acquisition-officer">
@@ -571,8 +591,9 @@
                 <description>
                     <p>A diagram-specific explanation.</p>
                 </description>
-                <!--TBD:
-                needds fixing link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" / -->
+                <!--TBD: needds to be fixed 
+                <link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" /> 
+                -->
                 <caption>Data Flow Diagram</caption>
             </diagram>
         </data-flow>
@@ -823,7 +844,7 @@
             -->
             <link rel="documentation" href="#c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c" />
             <set-parameter param-id="ac-2_prm_1">
-                <value>business need</value>
+                <value>have an organization-sponsored email address to demonstrate employment and have been approved by the System Owner based on the business need of the individual</value>
             </set-parameter>
             <set-parameter param-id="ac-2_prm_2">
                 <value>business need</value>
@@ -847,7 +868,7 @@
                 <value>1 business day</value>
             </set-parameter>
             <set-parameter param-id="ac-2_prm_9">
-                <value>System Owner (SO)</value>
+                <value>System Owner</value>
             </set-parameter>
             <set-parameter param-id="ac-2_prm_10">
                 <value>every 6 months</value>
@@ -865,13 +886,13 @@
                     </description>
                     <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="customer-configured">
                         <remarks>
-                            <p>The Blossom system System Owner and System Administrator are repsonsible for approving, creating and managing access by maintainit accurate information in Cognito and updating the access control policies in the chaincode for each channel.</p>
+                            <p>The Blossom system's System Owner and System Administrator are repsonsible for approving, creating and managing accounts and grant or denie access to the system by maintaining accurate information in Cognito and updating the access control policies access control lists (ACLs).</p>
                         </remarks>
                     </prop>
                 </by-component>
                 <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" uuid="eb710146-1ede-4876-9a3b-02c18408e506">
                     <description>
-                        <p>AWS provide access to the system to approved entities, for deployment, maintenance, and operations.</p>
+                        <p>AWS manages the access to approved entities to the system's infrastructure, for deployment, maintenance, and operations.</p>
                     </description>
                     <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged">
                         <remarks>
@@ -919,12 +940,12 @@
                             </li>
                             <li>Non-Privileged accounts: 
                                 <ul>System Security Assessor</ul>
-                                <!-- 
+                                <!-- #####
                                 NOTE: Authorizing Official will not have access to the infrastructure. 
                                  System Owner is responsible to prepare the ATO package in collaboration 
                                  with the System Security Assessor. Removing the AO from this list.
                                 <ul>Authorizing Official</ul>
-                                -->
+                                ##### -->
                             </li>
                         </ul>
                     </description>
@@ -955,7 +976,7 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="d52db118-3e6f-4b39-8fd9-a3a65dfcb6b1">
                     <description>
-                        <p>For this system, the entity with the System Administratore role
+                        <p>For this system, the entity with the System Administrator role
                              acts as the Accounts Manager and is responsible for creating, 
                              revoking, delete accounts per decissions made by the System Owner.</p>
                     </description>
@@ -965,9 +986,11 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c72b52e1-1943-4a52-be48-7bcce7df2f6d">
                     <description>
-                        <p>Require <insert type="param" id-ref="ac-2_prm_1" />[Assignment:
-                            organization-defined prerequisites and criteria] for group and role
-                            membership;</p>
+                        <!-- ac-2_prm_1= "have an organization-sponsored email address to demonstrate employment and
+                          have been approved by the System Owner based on the business need of the individual" -->
+                        <p>For each identified role, access to the system for each role will be individually 
+                            analyzed and granted if the requesters proves they <insert type="param" id-ref="ac-2_prm_1" /> 
+                            for the respective group and role membership.</p>
                     </description>
                 </by-component>
             </statement>
@@ -975,7 +998,10 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="779d08e3-4ed0-4a83-84ab-2ca2c9ec3745">
                     <description>
-                        <p>Specify:</p>
+                        <p>1. All authorized users are listed and accuratelly maintained in this SSP in the "metadata", as "party" elements of type="person".</p>
+                        <p>2. All roles supported by the Blossom system are documented in this SSP in the "metadata", as "role" elements with "id" identifying the role. 
+                            This system does not support groups. </p>
+                        <p>3. All access authorizations are docuemnted in this SSP in the "metadata" as "responsible-party" with "role-id" mathing the respective roles or attributes.</p>
                     </description>
                 </by-component>
             </statement>

From 0bfa2c26b39488455b1a58fce59e4d051165d8b5 Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Wed, 10 Jul 2024 18:55:02 -0400
Subject: [PATCH 26/36] More progress with the controls in the SSP.

---
 .../xml/ssp/blossom_admin_member_ssp.xml      | 46 +++++++++----------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index fb848c2..c75a4c5 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -843,34 +843,34 @@
             </prop>
             -->
             <link rel="documentation" href="#c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c" />
-            <set-parameter param-id="ac-2_prm_1">
+            <set-parameter param-id="ac-02_odp.01">
                 <value>have an organization-sponsored email address to demonstrate employment and have been approved by the System Owner based on the business need of the individual</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_2">
+            <set-parameter param-id="ac-02_odp.02">
                 <value>business need</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_3">
+            <set-parameter param-id="ac-02_odp.03">
                 <value>System Owner (SO)</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_4">
+            <set-parameter param-id="ac-02_odp.04">
                 <value>Types of User Accounts for Blossom</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_5">
+            <set-parameter param-id="ac-02_odp.0_5">
                 <value>System Owner (SO)</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_6">
+            <set-parameter param-id="ac-02_odp.06">
                 <value>1 business day</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_7">
+            <set-parameter param-id="ac-02_odp.07">
                 <value>1 business day</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_8">
+            <set-parameter param-id="ac-02_odp.08">
                 <value>1 business day</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_9">
+            <set-parameter param-id="ac-02_odp.09">
                 <value>System Owner</value>
             </set-parameter>
-            <set-parameter param-id="ac-2_prm_10">
+            <set-parameter param-id="ac-02_odp.10">
                 <value>every 6 months</value>
             </set-parameter>
             <responsible-role role-id="system-administrator">
@@ -986,10 +986,10 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c72b52e1-1943-4a52-be48-7bcce7df2f6d">
                     <description>
-                        <!-- ac-2_prm_1= "have an organization-sponsored email address to demonstrate employment and
+                        <!-- ac-02_odp.01= "have an organization-sponsored email address to demonstrate employment and
                           have been approved by the System Owner based on the business need of the individual" -->
                         <p>For each identified role, access to the system for each role will be individually 
-                            analyzed and granted if the requesters proves they <insert type="param" id-ref="ac-2_prm_1" /> 
+                            analyzed and granted if the requesters proves they <insert type="param" id-ref="ac-02_odp.01" /> 
                             for the respective group and role membership.</p>
                     </description>
                 </by-component>
@@ -1001,7 +1001,7 @@
                         <p>1. All authorized users are listed and accuratelly maintained in this SSP in the "metadata", as "party" elements of type="person".</p>
                         <p>2. All roles supported by the Blossom system are documented in this SSP in the "metadata", as "role" elements with "id" identifying the role. 
                             This system does not support groups. </p>
-                        <p>3. All access authorizations are docuemnted in this SSP in the "metadata" as "responsible-party" with "role-id" mathing the respective roles or attributes.</p>
+                        <p>3. All access authorizations are documented in this SSP in the "metadata" as "responsible-party" with "role-id" mathing the respective roles or attributes.</p>
                     </description>
                 </by-component>
             </statement>
@@ -1026,7 +1026,7 @@
                     uuid="37e94c9b-acb8-458f-8a95-c1d110ead856">
                     <description>
                         <p>Access authorizations (i.e., privileges) and <insert type="param"
-                                id-ref="ac-2_prm_2" />[Assignment: organization-defined attributes
+                                id-ref="ac-02_odp.0_2" />[Assignment: organization-defined attributes
                             (as required)] for each account;</p>
                     </description>
                 </by-component>
@@ -1035,7 +1035,7 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="40d40fbc-aed0-4323-9846-2ed3dc0f321e">
                     <description>
-                        <p>Require approvals by <insert type="param" id-ref="ac-2_prm_3" />[Assignment:
+                        <p>Require approvals by <insert type="param" id-ref="ac-02_odp.03" />[Assignment:
                             organization-defined personnel or roles] for requests to create
                             accounts;</p>
                     </description>
@@ -1046,7 +1046,7 @@
                     uuid="02d4c648-5a86-4155-bd73-02c3439262b4">
                     <description>
                         <p>Create, enable, modify, disable, and remove accounts in accordance with <insert
-                                type="param" id-ref="ac-2_prm_4" />[Assignment: organization-defined
+                                type="param" id-ref="ac-02_odp.04" />[Assignment: organization-defined
                             policy, procedures, prerequisites, and criteria];</p>
                     </description>
                 </by-component>
@@ -1063,7 +1063,7 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c555e31a-7b0d-437a-b415-e9ba5f2e1ef0">
                     <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment:
+                        <p>Notify account managers and <insert type="param" id-ref="ac-02_odp.05" />[Assignment:
                             organization-defined personnel or roles] within:</p>
                     </description>
                 </by-component>
@@ -1072,8 +1072,8 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="f1606d4f-3c5e-4c25-9649-94a12edbc113">
                     <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-2_prm_5" />[Assignment:
-                            system owner] within:<insert type="param" id-ref="ac-2_prm_6" />[Assignment:
+                        <p>Notify account managers and <insert type="param" id-ref="ac-02_odp.05" />[Assignment:
+                            system owner] within:<insert type="param" id-ref="ac-02_odp.06" />[Assignment:
                             1 business day] when accounts are no longer required;</p>
                     </description>
                 </by-component>
@@ -1082,7 +1082,7 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="c5a6312a-6123-4aa4-8097-3b4e30e70b72">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_7" />[Assignment:
+                        <p><insert type="param" id-ref="ac-02_odp.07" />[Assignment:
                             organization-defined time period] when users are terminated or
                             transferred; </p>
                     </description>
@@ -1092,7 +1092,7 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="1d085fa3-94d9-4f4c-a62b-963cc4640f12">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_8" />[Assignment:
+                        <p><insert type="param" id-ref="ac-02_odp.08" />[Assignment:
                             organization-defined time period] when system usage or need-to-know
                             changes for an individual;</p>
                     </description>
@@ -1126,7 +1126,7 @@
                 <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
                     uuid="587c32c5-701a-4e5c-83a7-2438ab3d71b1">
                     <description>
-                        <p><insert type="param" id-ref="ac-2_prm_9" />[Assignment:
+                        <p><insert type="param" id-ref="ac-02_odp.09" />[Assignment:
                             organization-defined attributes (as required)];</p>
                     </description>
                 </by-component>
@@ -1136,7 +1136,7 @@
                     uuid="b7932e43-9aa3-4bba-86a8-439a74e1e79a">
                     <description>
                         <p>Review accounts for compliance with account management requirements <insert
-                                type="param" id-ref="ac-2_prm_10" />[Assignment:
+                                type="param" id-ref="ac-02_odp.10" />[Assignment:
                             organization-defined frequency];</p>
                     </description>
                 </by-component>

From 7ba77716a7e3d93f206539380570e43b99501844 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Thu, 18 Jul 2024 14:25:42 -0400
Subject: [PATCH 27/36] Python script to create yaml file with user info

---
 ato/secops/create_user.py | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 ato/secops/create_user.py

diff --git a/ato/secops/create_user.py b/ato/secops/create_user.py
new file mode 100644
index 0000000..7428e95
--- /dev/null
+++ b/ato/secops/create_user.py
@@ -0,0 +1,33 @@
+import click
+import yaml
+from datetime import datetime
+
+@click.command()
+@click.option('--user-name', required=True, help='Name of user to create')
+@click.option('--user-email', required=True, help='Email of user to create')
+@click.option('--user-role', required=True, help='Role of user to create')
+@click.option('--location-uuid', default='00000000-0000-0000-0000-000000000000', help='UUID of physical location of user')
+@click.option('--org-member', default='00000000-0000-0000-0000-000000000000', help='UUID of organization that user is member of')
+def create_user(user_name, user_email, user_role, location_uuid, org_member):
+    # Structure of yaml file
+    cmd = {
+    "command" : "create-acl-user|create-cognito-user",
+    "user" : {
+        "name" : f"{user_name}",
+        "email-address":f"{user_email}",
+        "role":f"{user_role}",
+        "location-uuid":f"{location_uuid}",
+        "member-of-organization":f"{org_member}",
+        },
+    }
+    
+    # Include timestamp in filename
+    timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    filename = "ato/oscal-artifacts/created_users/created_user_" + timestamp + ".yaml"
+
+    # Write to yaml file
+    with open(filename, 'w') as f:
+        print(f"\n\n{yaml.safe_dump(cmd, default_flow_style=False)}", file=f)
+
+if __name__ == '__main__':
+    create_user()
\ No newline at end of file

From 11c842ba178fff3b0ec83b2941c66434bf24d949 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Thu, 18 Jul 2024 14:37:34 -0400
Subject: [PATCH 28/36] Add user email input to account request form

---
 .../account_management_request_form.yaml              | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/account_management_request_form.yaml b/.github/ISSUE_TEMPLATE/account_management_request_form.yaml
index 2c4ebfd..096e662 100644
--- a/.github/ISSUE_TEMPLATE/account_management_request_form.yaml
+++ b/.github/ISSUE_TEMPLATE/account_management_request_form.yaml
@@ -3,19 +3,26 @@ description: Submit an account related request
 labels: ['ACCOUNT_REQUEST_RECORD']
 body:
   - type: input
-    id: first-name
+    id: user-first-name
     attributes:
       label: Account Holder First Name
       placeholder: Type here user's first name as it appears in his/her ID.
     validations:
       required: true
   - type: input
-    id: last-name
+    id: user-last-name
     attributes:
       label: Account Holder Last Name
       placeholder: Type here user's last name as it appears in his/her ID.
     validations:
       required: true
+  - type: input
+    id: user-email
+    attributes:
+      label: Account Holder Email
+      placeholder: Type here user's email
+    validations:
+      required: true
   - type: input
     id: requester-name
     attributes:

From 204d9f90c88c000dd655c47fddce6a0199c1a057 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Fri, 19 Jul 2024 16:44:01 -0400
Subject: [PATCH 29/36] Implement action to send yaml to S3

---
 .../workflows/account_request_implement.yaml  | 50 +++++++++++++------
 ato/secops/create_user.py                     |  4 +-
 2 files changed, 36 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/account_request_implement.yaml b/.github/workflows/account_request_implement.yaml
index 241473e..acd9449 100644
--- a/.github/workflows/account_request_implement.yaml
+++ b/.github/workflows/account_request_implement.yaml
@@ -10,21 +10,29 @@ jobs:
   request-implemented:
     if: github.event.label.name == 'ACCOUNT_IMPLEMENTED'
     runs-on: ubuntu-20.04
-    permissions:
-      issues: write
+    # permissions:
+    #   issues: write
     steps:
-      - name: Notify Blossom Assessors about Implemented Account
-        run: gh issue comment "$NUMBER" --body "$BODY"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          NUMBER: ${{ github.event.issue.number }}
-          BODY: >
-            @usnistgov/blossom-assessors An edit to the ACL and/or SSP has been implemented.
-            Please monitor the automated assessment.
-      
       - name: Checkout repo to access handshake file
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        
+      - name: Parse issue body
+        uses: stefanbuck/github-issue-parser@v3.2.1
+        id: issue-parser
+        with:
+          template-path: ".github/ISSUE_TEMPLATE/account_management_request_form.yaml"
+
+      - name: Ensure directory exists for created users
+        run: |
+          mkdir -p ato/oscal-artifacts/created_users/
+
+      - name: Create yaml file for automated user creation
+        env:
+          USER_NAME: "${{ steps.issue-parser.outputs.issueparser_user-first-name }} ${{ steps.issue-parser.outputs.issueparser_user-last-name }}"
+          USER_EMAIL: ${{ steps.issue-parser.outputs.issueparser_user-email }}
+          USER_ROLE: ${{ steps.issue-parser.outputs.issueparser_account-type }}
+        run: |
+          python ato/secops/create_user.py --user-name "$USER_NAME" --user-email "$USER_EMAIL" --user-role "$USER_ROLE"
       
       - name: Configure AWS CLI
         uses: aws-actions/configure-aws-credentials@v4
@@ -33,8 +41,18 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
       
-      - name: Copy handshake to bucket
+      - name: Copy user yaml to bucket
         run: |
-          aws s3 cp .sims/handshake/handshake_empty s3://"$AWS_BUCKET"
+          aws s3 cp --recursive ato/oscal-artifacts/created_users/ s3://"$AWS_BUCKET"
         env:
-          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file
+          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
+        
+      # - name: Notify Blossom Assessors about Implemented Account
+      #   run: gh issue comment "$NUMBER" --body "$BODY"
+      #   env:
+      #     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      #     GH_REPO: ${{ github.repository }}
+      #     NUMBER: ${{ github.event.issue.number }}
+      #     BODY: >
+      #       @usnistgov/blossom-assessors An edit to the ACL and/or SSP has been implemented.
+      #       Please monitor the automated assessment.
\ No newline at end of file
diff --git a/ato/secops/create_user.py b/ato/secops/create_user.py
index 7428e95..8eb237c 100644
--- a/ato/secops/create_user.py
+++ b/ato/secops/create_user.py
@@ -6,8 +6,8 @@
 @click.option('--user-name', required=True, help='Name of user to create')
 @click.option('--user-email', required=True, help='Email of user to create')
 @click.option('--user-role', required=True, help='Role of user to create')
-@click.option('--location-uuid', default='00000000-0000-0000-0000-000000000000', help='UUID of physical location of user')
-@click.option('--org-member', default='00000000-0000-0000-0000-000000000000', help='UUID of organization that user is member of')
+@click.option('--location-uuid', help='UUID of physical location of user')
+@click.option('--org-member', help='UUID of organization that user is member of')
 def create_user(user_name, user_email, user_role, location_uuid, org_member):
     # Structure of yaml file
     cmd = {

From 610398a6d6817ee4dade10a29a4b57547d589ca7 Mon Sep 17 00:00:00 2001
From: Michaela Iorga <michaela@nist.gov>
Date: Mon, 22 Jul 2024 23:34:25 -0400
Subject: [PATCH 30/36] Updates provided by Ned

---
 .../xml/ssp/blossom_admin_member_ssp.xml      | 2481 ++++++++---------
 1 file changed, 1235 insertions(+), 1246 deletions(-)

diff --git a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
index c75a4c5..d0a25ca 100644
--- a/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
+++ b/oscal-content/xml/ssp/blossom_admin_member_ssp.xml
@@ -1,1247 +1,1236 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
-    uuid="8c91b0ac-8eaa-4ac2-a2fb-eeff3b7efa20">
-    <metadata>
-        <title>BloSS@M System Security Plan</title>
-        <published>2022-04-05T00:00:00Z</published>
-        <last-modified>2024-03-27T00:00:00Z</last-modified>
-        <version>0.1</version>
-        <oscal-version>1.1.2</oscal-version>
-        <!-- ###
-         The following 4 roles are associated with the ATO operations and system management. 
-         ### -->
-        <role id="system-owner">
-            <title>System Owner (SO)</title>
-            <description>
-                <p>The individual within the organization who is ultimately accountable for
-                    everything related to the deployment, assessemnt, authorization and operations
-                    of the Blossom Member which provides the software assets leasing service (here
-                    in known as "this system").</p>
-            </description>
-        </role>
-        <role id="system-administrator">
-            <title>System Administrator (SA)</title>
-            <description>
-                <p>The individual accountable for the deployment, configuration, testing and
-                    operations of the system on behalf of the System Owner.</p>
-            </description>
-        </role>
-        <role id="sys-sec-assessor">
-            <title>System Security Assessor (SSA)</title>
-            <description>
-                <p>The individual accountable for assessing the security posture of the system on
-                    behalf of the system owner.</p>
-            </description>
-        </role>
-        <role id="authorizing-official">
-            <title>Authorizing Official</title>
-            <description>
-                <p>The individual or individuals who are ultimatly accountable for reviewing the
-                    assessemnt package, discuss with the SO the findings and grant an authorization
-                    to operate (ATO) to Blosom, a.ka "this system".</p>
-                <p>The Authorizing Official is the only entity responsible for the security posture
-                    of the system and has access to the ATO channel (chaincode) to upload the ATO Attestation Memo (AAM). 
-                    The AO signs the AAM on behalf of the agency.</p>
-            </description>
-        </role>
-        <!-- ###
-          The following 3 roles are associated with the business (assets) operations 
-          ### -->
-        <role id="tpoc">
-            <title>Technical Point of Contact (TPOC)</title>
-            <description>
-                <p>The individual accountable for managing leased licenses (checkout, install,
-                    uninstall, return).</p>
-            </description>
-        </role>
-        <role id="license-owner">
-            <title>License Owner (LO)</title>
-            <description>
-                <p>The individual within the service provider organization who is accountable for
-                    managing the pool of software resources made available for leasing to USG
-                    agencies.</p>
-                <p>The License Owner role exists only within the service provider agency.</p>
-            </description>
-        </role>
-        <role id="acquisition-officer">
-            <title>Acquisition Officer</title>
-            <description>
-                <p>The individual within the Agency which is responsible for approving and 
-                    processing the payment of the leased pool of software licenses.</p>
-            </description>
-        </role>
-        <location uuid="1ef39fd9-d184-44c4-8ef4-36d2dbad70a2">
-            <title>National Institute of Standards and Technology</title>
-            <address type="work">
-                <addr-line>100 Bureau Drive</addr-line>
-                <city>Gaithersburg</city>
-                <state>MD</state>
-                <postal-code>20899</postal-code>
-            </address>
-            <remarks>
-                <p>NIST ITL Computer Security Division's Secure Systems and Applications Group is
-                    the primary CSP for this project.</p>
-            </remarks>
-        </location>
-        <location uuid="cd8b83a8-3c8e-4b0e-abd3-bbb57e2c404e">
-            <title>AWS US East/West</title>
-            <address>
-                <addr-line>13200 Woodland Park Rd</addr-line>
-                <city>Herndon</city>
-                <state>VA</state>
-                <postal-code>20171</postal-code>
-            </address>
-            <prop name="type" value="data-center" class="primary" />
-            <remarks>
-                <p>This title must be kept as-is to match FedRAMP Marketplace listing. This is a a
-                    FedRAMP requirement. This official mailing address of Amazon's AWS commercial
-                    offering for the us-east-1 is provided, as Amazon not disclose the address of
-                    data-centers either on a region or availability zone basis.</p>
-            </remarks>
-        </location>
-        <party uuid="8aed7ffd-5158-445d-8d7c-eec5cf240cba" type="organization">
-            <name>National Institute of Standards and Technology IT Lab Computer Security Division Secure Systems and Applications Group</name>
-            <short-name>NIST</short-name>
-            <link href="#006babc9-4f57-4ab0-9941-15fcb65e0387" rel="logo" />
-            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
-            <remarks>
-                <p>Blossom network provider.</p>
-            </remarks>
-        </party>
-        <party uuid="09ad840f-aa79-43aa-9f22-25182c2ab11b" type="person">
-            <name>Stan Owens</name>
-            <prop name="job-title" value="System Owner" />
-            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
-            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
-            <email-address>blossom@nist.gov</email-address>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <party uuid="551b9706-d6a4-4d25-8207-f2ccec541016" type="person">
-            <name>ManoGiana Bloom</name>
-            <prop name="job-title" value="Blossom Program Manager" />
-            <email-address>blossom@nist.gov</email-address>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
-            <name>Simmon Admino</name>
-            <prop name="job-title" value="System Administrator" />
-            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
-            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
-            <email-address>blossom@nist.gov</email-address>
-            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <party uuid="132953a9-640c-46f7-9de9-3fa15ec99361" type="person">
-            <name>Steve S. Asesoro</name>
-            <prop name="job-title" value="System Security Assessor" />
-            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
-            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
-            <email-address>blossom@nist.gov</email-address>
-            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <!-- ###
-         The UUIDs of the following parties need to be registered in Cognito first
-          and the UUID generated by Cognito needs to be used as the party's UUID.
-          Any update in Cognito will have to trigger an update of the SSP 
-          ### -->
-        <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
-            <name>Aurelian Officeman</name>
-            <prop name="job-title" value="Authorizing Official" />
-            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
-            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
-            <email-address>blossom@nist.gov</email-address>
-            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <party uuid="51588d7c-aa79-43aa-9f22-25182c2cd22d" type="person">
-            <name>Licenta Owens</name>
-            <prop name="job-title" value="License Owner" />
-            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
-            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
-            <email-address>blossom@nist.gov</email-address>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <party uuid="7380b1a3-5f04-4b6a-bada-ee13a1d78f3a" type="person">
-            <name>Acquia Officiale</name>
-            <prop name="job-title" value="Acquisition Officer" />
-            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
-            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
-            <email-address>blossom@nist.gov</email-address>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <party uuid="c46e27d1-7a65-47ea-bd76-df574fded5fd" type="person">
-            <name>Tom Pock</name>
-            <prop name="job-title" value="Technical Point of Contact" />
-            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
-            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
-            <email-address>blossom@nist.gov</email-address>
-            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
-            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
-        </party>
-        <!-- ###
-             Entities with access to the infrastructure
-        ### -->
-            <!-- #### 
-             Privileged Roles 
-            #### -->
-        <responsible-party role-id="system-owner">
-            <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
-            <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
-        </responsible-party>
-        <responsible-party role-id="system-administrator">
-            <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
-            <remarks>
-                <p>This party has development, deployment, configuration and operations
-                    responsibilities for "this system" supporting the system owner.</p>
-            </remarks>
-        </responsible-party>
-            <!-- ####
-             Non-Privileged Roles 
-             #### -->
-        <responsible-party role-id="sys-sec-assessor">
-            <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
-            <remarks>
-                <p>The party responsible to assess the security controls on behalf of the system
-                    owner.</p>
-            </remarks>
-        </responsible-party>
-        <!-- ###
-             Entities with access to the assets/business private channel 
-         ### -->
-            <!-- #### 
-             Privileged Roles 
-             #### -->
-        <responsible-party role-id="license-owner">
-            <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
-            <remarks>
-                <p>The license owner is responsible for managing the licenses a Blossom Member leases, and is also responsible for uploading to the asset chaincode the MOA signed by the TPOC and Acquisition Officer.</p>
-            </remarks>
-        </responsible-party>
-            <!-- ####
-             Non-Privileged Roles 
-             #### -->
-        <responsible-party role-id="tpoc">
-            <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
-            <remarks>
-                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
-                <p>The TPOC is also responsible for reviewing and signing the initial Memorandum of Aggrement (MOA) stating the rules on engagemnet whith Blossom service around ATO automation and assets leasing.</p>
-            </remarks>
-        </responsible-party>
-        <responsible-party role-id="acquisition-officer">
-            <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
-            <remarks>
-                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
-            </remarks>
-        </responsible-party>
-        <!-- ###
-            Entities with access to the Authorization private channel 
-         ### -->
-         <!-- Privileged Roles -->
-        <responsible-party role-id="authorizing-official">
-            <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
-        </responsible-party>
-        <remarks>
-            <p>This SSP was created using a simplified version of OSCAL-based FedRAMP SSP Template
-                for the FedRAMP Low, Moderate, and High baselines.</p>
-        </remarks>
-    </metadata>
-    <import-profile href="../../xml/profile/blossom_moderate_profile.xml">
-        <remarks>
-            <p>This example points to the tailored FedRAMP Moderate 800-53 rev 5 baseline, adjusted
-                accordingly for BloSS@M.</p>
-        </remarks>
-    </import-profile>
-    <system-characteristics>
-        <system-id identifier-type="http://ietf.org/rfc/rfc4122">8101e04d-8305-4e73-bb95-6b59f645b143</system-id>
-        <system-name>Blockchain-based Secure Software Assets Management</system-name>
-        <system-name-short>Blossom</system-name-short>
-        <description>
-            <p>TBD: Describe the purpose and functions of this system here.</p>
-        </description>
-        <prop name="identity-assurance-level" value="2" />
-        <prop name="authenticator-assurance-level" value="2" />
-        <prop name="federation-assurance-level" value="2" />
-        <prop name="cloud-service-model" value="saas" />
-        <prop name="cloud-deployment-model" ns="https://fedramp.gov/ns/oscal" value="public-cloud" />
-        <security-sensitivity-level>fips-199-moderate</security-sensitivity-level>
-        <system-information>
-            <prop name="privacy-designation" value="no" />
-            <prop name="pta-1" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
-            <prop name="pta-2" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
-            <prop name="pta-3" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
-            <prop name="pta-4" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
-            <information-type uuid="1c21b0ef-29af-4b81-9a38-dacd1e6967b1">
-                <title>Blockchain-based Software Assets Management</title>
-                <description>
-                    <p>BloSS@M stores the minimally required identity and authorization metadata to
-                        authenitcate and authorize federal users of the system.</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.2.8.12</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-low</base>
-                    <selected>fips-199-moderate</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-low</base>
-                    <selected>fips-199-moderate</selected>
-                    <adjustment-justification>
-                        <p>The NIST Privacy Office and Office of Information Systems Management
-                            categorizes personal identity and authentication information with as
-                            FIPS-199 Low impact for integrity concerns.
-                            This categorization is limited to federal employees when this data is
-                            for identification of these federal employees only.</p>
-                    </adjustment-justification>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-low</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="0c9f7c06-bc4e-4006-b5a5-f150cf7ce1ac">
-                <title>Inventory control information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.4.2</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="c7c42a0c-8fa6-49fb-b98f-8804609504a5">
-                <title>Logistics management information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.4.3</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="f18905ed-6971-4a31-b29a-38d78c398d1f">
-                <title>Services acquisition information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.4.4</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="4be97836-b11a-487d-8c27-174e3352d8d6">
-                <title>Lifecycle and change management information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.5.2</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="fa4794ee-5d10-45e8-a8ab-154d4199cbd3">
-                <title>Information security information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.5.5</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="514e0850-16ce-4a86-b589-ca546c4c645c">
-                <title>Record retention information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.5.6</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="70b28c11-31c8-429b-855f-cc323fef59ea">
-                <title>Information management information</title>
-                <description>
-                    <p>TBD:</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.5.7</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="5820d24a-487a-4748-8bd2-ea4318337816">
-                <title>Information sharing information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>C.3.5.9</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                    <adjustment-justification>
-                        <p>This information has no base recommendation in SP 800-60 Volume 2
-                            Revision 1 guidance.
-                            The Office of Information Systems Management's consulted the BloSS@M
-                            Team and the NIST system owner, who categorized this information sharing
-                            at FIPS-199 Moderate impact.</p>
-                    </adjustment-justification>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                    <adjustment-justification>
-                        <p>This information has no base recommendation in SP 800-60 Volume 2
-                            Revision 1 guidance.
-                            The Office of Information Systems Management's consulted the BloSS@M
-                            Team and the NIST system owner, who categorized this information sharing
-                            at FIPS-199 Moderate impact.</p>
-                    </adjustment-justification>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                    <adjustment-justification>
-                        <p>This information has no base recommendation in SP 800-60 Volume 2
-                            Revision 1 guidance.
-                            The Office of Information Systems Management's consulted the BloSS@M
-                            Team and the NIST system owner, who categorized this information sharing
-                            at FIPS-199 Moderate impact.</p>
-                    </adjustment-justification>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="abaf261d-3860-47aa-bd7a-58e5776bae44">
-                <title>Scientific and technological research and innovation information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>D.19.1</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="88f10ac5-f2c8-43e3-af9e-d692360c61da">
-                <title>Research and development information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>D.20.1</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-moderate</selected>
-                </availability-impact>
-            </information-type>
-            <information-type uuid="53347cf4-8b06-4acc-a2fa-88177d7c937c">
-                <title>Research and development information</title>
-                <description>
-                    <p>TBD</p>
-                </description>
-                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
-                    <information-type-id>D.20.4</information-type-id>
-                </categorization>
-                <confidentiality-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </confidentiality-impact>
-                <integrity-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </integrity-impact>
-                <availability-impact>
-                    <base>fips-199-moderate</base>
-                    <selected>fips-199-low</selected>
-                </availability-impact>
-            </information-type>
-        </system-information>
-        <security-impact-level>
-            <security-objective-confidentiality>fips-199-moderate</security-objective-confidentiality>
-            <security-objective-integrity>fips-199-moderate</security-objective-integrity>
-            <security-objective-availability>fips-199-low</security-objective-availability>
-        </security-impact-level>
-        <status state="under-development" />
-        <authorization-boundary>
-            <description>
-                <p>TBD: A holistic, top-level explanation of the system's authorization boundary.</p>
-            </description>
-            <diagram uuid="dbf46c27-52a9-49c4-beb6-b6399cd75497">
-                <description>
-                    <p>A diagram-specific explanation.</p>
-                </description>
-                <link href="#d2eb3c18-6754-4e3a-a933-03d289e3fad5" rel="diagram" />
-                <caption>Authorization Boundary Diagram</caption>
-            </diagram>
-        </authorization-boundary>
-        <network-architecture>
-            <description>
-                <p>A holistic, top-level explanation of the network architecture.</p>
-            </description>
-            <diagram uuid="e97c3395-433a-48c1-8cc7-dd1e1555941c">
-                <description>
-                    <p>A diagram-specific explanation.</p>
-                </description>
-                <link href="#61081e81-850b-43c1-bf43-1ecbddcb9e7f" rel="diagram" />
-                <caption>Network Diagram</caption>
-            </diagram>
-        </network-architecture>
-        <data-flow>
-            <description>
-                <p>A holistic, top-level explanation of the system's data flows.</p>
-            </description>
-            <diagram uuid="e3b98448-4219-46a5-b229-412423c566f3">
-                <description>
-                    <p>A diagram-specific explanation.</p>
-                </description>
-                <!--TBD: needds to be fixed 
-                <link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" /> 
-                -->
-                <caption>Data Flow Diagram</caption>
-            </diagram>
-        </data-flow>
-    </system-characteristics>
-    <system-implementation>
-        <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
-            <title>AWS Managed Blockchain (AMB)</title>
-            <link href="./aws_leveraged_authorization_ssp.xml" />
-            <!-- The Leveraged Authorization POC is the AMB's Authorizing Official in this case. -->
-            <party-uuid>e63e870d-bf43-40dc-98a0-37d5e39b2dd1</party-uuid>
-            <date-authorized>2024-01-01</date-authorized>
-            <remarks>
-                <p>TBD: ssp-uuid: 73a7ca56-ac02-43b9-8664-62bcb05a7e91 will need to be added for
-                    oscal 1.2.0.</p>
-                <p>The leveraged authorization assembly is supposed to have a required uuid flag
-                    instead of an optional id flag. This will be fixed in the syntax shortly.</p>
-                <p>Use one leveraged-authorization assembly for each underlying system. (In the
-                    legacy world, these may be general support systems.</p>
-                <p>The link fields are optional, but preferred where known. Often, a leveraging
-                    system's SSP author will not have access to the leveraged system's SSP, but
-                    should have access to the leveraged system's CRM.</p>
-            </remarks>
-        </leveraged-authorization>
-        <user uuid="9cb0fab0-78bd-44ba-bcb8-3e9801cc952f">
-            <title>System Administrator</title>
-            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
-            <prop name="privilege-level" value="privileged" />
-            <prop name="type" value="internal" />
-            <role-id>system-administrator</role-id>
-            <authorized-privilege>
-                <title>Full administrative access rights</title>
-                <function-performed>add and remove users, software-name and hardware</function-performed>
-                <function-performed>install and configure deployments</function-performed>
-                <function-performed>system updates, patches and hotfixes</function-performed>
-                <function-performed>perform backups</function-performed>
-            </authorized-privilege>
-        </user>
-        <user uuid="046ea806-2220-4ab4-9de0-1304f6be0b66">
-            <title>System Owner</title>
-            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
-            <prop name="privilege-level" value="privileged" />
-            <prop name="type" value="internal" />
-            <role-id>system-owner</role-id>
-            <authorized-privilege>
-                <title>Privileged access rights</title>
-                <function-performed>add and remove users, software-name and hardware</function-performed>
-                <function-performed>install and configure deployments</function-performed>
-                <function-performed>system updates, patches and hotfixes</function-performed>
-                <function-performed>perform backups</function-performed>
-            </authorized-privilege>
-        </user>
-        <user uuid="f93d5a58-0688-4e48-8aaa-0c4d20c57f9b">
-            <title>System Security Assessor</title>
-            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
-            <prop name="privilege-level" value="non-privileged" />
-            <prop name="type" value="internal" />
-            <role-id>sys-sec-assessor</role-id>
-            <authorized-privilege>
-                <title>Non-privileged access rights (read only)</title>
-                <function-performed>review system documentation and security configurations</function-performed>
-                <function-performed>review if system updates, patches and hotfixes are documented and successfully completed</function-performed>
-                <function-performed>review disaster recovery procedures and system backups existance</function-performed>
-            </authorized-privilege>
-        </user>
-        <component uuid="60f92bcf-f353-4236-9803-2a5d41751010" type="this-system">
-            <title>This System</title>
-            <description>
-                <p>The entire Blossom system as depicted in the system authorization boundary</p>
-            </description>
-            <status state="under-development" />
-        </component>
-        <component uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" type="leveraged-system">
-            <title>AWS Managed Blockchain (AMB) - Leveraged System</title>
-            <description>
-                <p>TBD: If the leveraged system owner provides a UUID for their system (such as in
-                    an OSCAL-based CRM), it should be reflected in the <code>inherited-uuid</code>
-                    property.</p>
-            </description>
-            <prop name="leveraged-authorization-uuid" value="5a9c98ab-8e5e-433d-a7bd-515c07cd1497" />
-            <prop name="implementation-point" value="external" />
-            <!-- The value of inherited-uuid is the uuid of the component of the leveraged system
-            which provides the control implementation. In thsi case will be the AMB's
-            "this-system"-->
-            <prop name="inherited-uuid" value="73a7ca56-ac02-43b9-8664-62bcb05a7e91" />
-            <status state="operational" />
-        </component>
-        <inventory-item uuid="79b4f0d1-91ab-49e8-af28-045c12aa9272">
-            <description>
-                <p>TBD: Description of Blossom inventory items 1</p>
-            </description>
-            <prop name="software-name" value="Blossom SaaS" class="blockchain-application" />
-            <prop name="software-version" value="1.0.0" class="blockchain-application" />
-            <prop name="asset-id" value="BLOSSOM-SAAS-2222-01" />
-            <prop name="is-scanned" value="yes" />
-            <implemented-component component-uuid="1541015b-6d19-42cb-a991-624cc082ed4d">
-                <prop name="asset-id" value="BLOSSOM-SAAS-2222" />
-            </implemented-component>
-        </inventory-item>
-    </system-implementation>
-    <control-implementation>
-        <description>
-            <p>This is a palceholder for the FedRAMP SSP Template Section 13</p>
-            <p>This description field is required by OSCAL.</p>
-            <p>FedRAMP does not require any specific information here.</p>
-        </description>
-        <!-- ####
-            AC-1 is not in our profile. If we include it, we meed to correct the errors (AC-1.b does not have a
-        b.1 and b.2, but it has b and c) 
-            #### -->
-        <!-- AC-1 will not be implemented now. 
-        <implemented-requirement uuid="eee8697a-bc39-45aa-accc-d3e534932efb" control-id="ac-1">
-            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal"
-                value="2020-11-27Z" />
-            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="planned">
-                <remarks>
-                    <p>Describe the plan to complete the implementation.</p>
-                </remarks>
-            </prop>
-            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="sp-system" />
-            <statement statement-id="ac-1_smt" uuid="240fa015-01df-4741-bff5-6958c7fb85e5">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="d9d1ce66-ff47-474d-8596-5fdf2af60179">
-                    <description>
-                        <p>Describe how the control is satisfied within the system.</p>
-                    </description>
-                    <set-parameter param-id="ac-1_prm_1">
-                        <value>[replace with list of personnel or roles]</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-1_prm_2">
-                        <value>[specify frequency]</value>
-                    </set-parameter>
-                    <set-parameter param-id="ac-1_prm_3">
-                        <value>[specify frequency]</value>
-                    </set-parameter>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-1_smt.a.1" uuid="fb4d039a-dc4f-46f5-9c1f-f6343eaf69bc">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="3f5612a4-cd1d-4c47-8cae-75d2eaa332cd">
-                    <description>
-                        <p>Describe how Part a is satisfied within the system.</p>
-                        <p>Legacy approach. If no policy component is defined, describe here how the
-                            policy satisfies part a.</p>
-                        <p>In this case, a link must be provided to the policy.</p>
-                        <p>FedRAMP prefers all policies and procedures be attached as a resource in
-                            the back-matter. The link points to a resource.</p>
-                    </description>
-                    <link href="#090ab379-2089-4830-b9fd-26d0729e22e9" rel="policy" />
-                </by-component>
-                <remarks>
-                    <p>The specified component is the system itself.</p>
-                    <p>Any control implementation response that can not be associated with another
-                        component is associated with the component representing the system.</p>
-                </remarks>
-            </statement>
-            <statement statement-id="ac-1_smt.a.2" uuid="c365cf95-5bc0-4599-9773-f4eddf69798d">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="00507a44-e0d7-4fe6-ad20-8d474a84ee15">
-                    <description>
-                        <p>Describe how Part b is satisfied within the system.</p>
-                        <p>Legacy approach. If no policy component is defined, describe here how the
-                            procedure satisfies part b.</p>
-                        <p>In this case, a link must be provided to the procedure.</p>
-                        <p>FedRAMP prefers all policies and procedures be attached as a resource in
-                            the back-matter. The link points to a resource.</p>
-                    </description>
-                    <link href="#1002a58e-9e11-4aa6-9ab4-2bde52995952" rel="procedure" />
-                </by-component>
-                <by-component component-uuid="fa90644a-8bf8-47da-b0d3-82bffc708afc"
-                    uuid="42ac379e-4abc-4716-809c-119c03b5ac64">
-                    <description>
-                        <p>Describe how Part b is satisfied within the system.</p>
-                        <p>Legacy approach. If no policy component is defined, describe here how the
-                            procedure satisfies part b.</p>
-                        <p>In this case, a link must be provided to the procedure.</p>
-                        <p>FedRAMP prefers all policies and procedures be attached as a resource in
-                            the back-matter. The link points to a resource.</p>
-                    </description>
-                </by-component>
-                <remarks>
-                    <p>The specified component is the system itself.</p>
-                    <p>Any control implementation response that can not be associated with another
-                        component is associated with the component representing the system.</p>
-                </remarks>
-            </statement>
-            <statement statement-id="ac-1_smt.b.1" uuid="b46f97ec-55c1-4249-a9b9-3a228f1e3791">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="767666cb-e558-484b-81ca-b0209932425c">
-                    <description>
-                        <p>Describe how Part b-1 is satisfied.</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-1_smt.b.2" uuid="59c67969-3d5c-45f1-8e3e-1e642249633f">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="5a869308-1625-4d92-9ed8-ff5d8bd13656">
-                    <description>
-                        <p>Describe how Part b-2 is satisfied.</p>
-                    </description>
-                </by-component>
-            </statement>
-        </implemented-requirement>
-    -->
-        <!-- ####
-            AC-2
-            ######  -->
-        <implemented-requirement uuid="7a36cf53-156d-4d1f-9a8b-433f61cc57b7" control-id="ac-2">
-            <!-- TBD: The following <prop>s must be reviewed, updated and only one option kept based
-            on AC-2 implementation of the inherited control for manageing the Authorizing Official's
-            account -->
-            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal"
-                value="2024/05/30" />
-            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="partial">
-                <remarks>
-                    <p>Per the documentation available in the Blossom Wiki, the AWS Managed
-                        Blockchain (AMB) provides access control to the infrastracture for the
-                        entities identified below which require access to IaaS to maintain and
-                        deploy system components. The blockchain's chaincode is implementing Next
-                        Generation Access Control (NGAC) standard to manage the access to resources
-                        for the roles docuemnted in the Blossom specification. Access control policy
-                        machines are implemented for the two private channels of the AMB: the ATO or
-                        "Authorization" channel and the "Businness" channel.</p>
-                </remarks>
-            </prop>
-            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="implemented">
-                <remarks>
-                    <p>The policy machines are controling the access to the two chaincodes
-                        (Authorization and Business) used by the system.</p>
-                </remarks>
-            </prop>
-            <!-- Use this prop for not applicable controls
-            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable">
-                <remarks>
-                    <p>TBD: Describe the justification for marking this control Not Applicable.</p>
-                </remarks>
-            </prop>  
-            -->
-            <!-- Control origination varies per role. See by-component under ac-2_smt
-            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
-                value="leveraged-system" />
-            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
-                value="customer-configured">
-                <remarks>
-                    <p>TBD: Describe any customer-configured requirements for satisfying this
-                        control.</p>
-                </remarks>
-            </prop>
-            -->
-            <link rel="documentation" href="#c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c" />
-            <set-parameter param-id="ac-02_odp.01">
-                <value>have an organization-sponsored email address to demonstrate employment and have been approved by the System Owner based on the business need of the individual</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.02">
-                <value>business need</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.03">
-                <value>System Owner (SO)</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.04">
-                <value>Types of User Accounts for Blossom</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.0_5">
-                <value>System Owner (SO)</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.06">
-                <value>1 business day</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.07">
-                <value>1 business day</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.08">
-                <value>1 business day</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.09">
-                <value>System Owner</value>
-            </set-parameter>
-            <set-parameter param-id="ac-02_odp.10">
-                <value>every 6 months</value>
-            </set-parameter>
-            <responsible-role role-id="system-administrator">
-                <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
-            </responsible-role>
-            <responsible-role role-id="system-owner">
-                <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
-            </responsible-role>
-            <statement statement-id="ac-2_smt" uuid="4facc265-ba1d-4d66-afc7-6385984b6a1e">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010" uuid="9d06a5a6-0c30-43cb-a18a-baabd616ddfb">
-                    <description>
-                        <p>For the IAM entities that have a business need, and which have accounts created in Cognito, the Policy machines which implement NGAC in the two chaincodes are managing the access control for the Blossom business layer users and the BC Member's Authorizing Official that is uploading the ATO Attestation to the Authorization channel.</p>
-                    </description>
-                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="customer-configured">
-                        <remarks>
-                            <p>The Blossom system's System Owner and System Administrator are repsonsible for approving, creating and managing accounts and grant or denie access to the system by maintaining accurate information in Cognito and updating the access control policies access control lists (ACLs).</p>
-                        </remarks>
-                    </prop>
-                </by-component>
-                <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" uuid="eb710146-1ede-4876-9a3b-02c18408e506">
-                    <description>
-                        <p>AWS manages the access to approved entities to the system's infrastructure, for deployment, maintenance, and operations.</p>
-                    </description>
-                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged">
-                        <remarks>
-                            <p>Keep the ACL list current at all times.</p>
-                        </remarks>
-                    </prop>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.a" uuid="24a85abb-25ad-4686-850c-5c0e8ab69a0c">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="b29d1505-69fa-4ad0-834b-d179e7f44fff">
-                    <description>
-                        <p>The system has privileged and non-privileged accounts associated with the business layer and the ATO processes.</p>
-                        <p>These accounts are managed by the NGAC implementation in the chaincodes for the ATO and for the assets management (business) processes.</p>
-                        <p>The following accounts are supported for the business operations (assets management):</p>
-                        <ul>
-                            <li>Privileged accounts: 
-                                <ul>License Owner</ul>
-                            </li>
-                            <li>Non-Privileged accounts: 
-                                <ul>Acquisition Officer</ul>
-                                <ul>Technical Point of Contact</ul>
-                            </li>
-                        </ul>
-                        <p>The Authorizing Official is responsible for reviewing the ATO package prepared by the System Owner and signing/authorizing the system to operate.</p>
-                        <p>The System Owner remains the custodian of all system ATO related artifacts.</p>
-                        <p>Upon approval, teh AO is responsible for generating automatically the ATO attestation and upload it to the ATO channel.</p>
-                        <p>The following account is supported for the ATO processes. :</p>
-                        <ul>
-                            <li>Privileged accounts:
-                                 <ul>Authorizing Official</ul>
-                            </li>
-                        </ul>
-                    </description>
-                    <implementation-status state="under-development" />
-                </by-component>
-                <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65"
-                    uuid="84de735f-ba37-4bb4-b784-79760f986a40">
-                    <description>
-                        <p>The following accounts of the Blossom System of NIST Member managed by the Leveraged AWS IaaS are:</p>
-                        <ul>
-                            <li>Privileged accounts: 
-                                <ul>System Owner</ul>
-                                <ul>System Administrator</ul>
-                            </li>
-                            <li>Non-Privileged accounts: 
-                                <ul>System Security Assessor</ul>
-                                <!-- #####
-                                NOTE: Authorizing Official will not have access to the infrastructure. 
-                                 System Owner is responsible to prepare the ATO package in collaboration 
-                                 with the System Security Assessor. Removing the AO from this list.
-                                <ul>Authorizing Official</ul>
-                                ##### -->
-                            </li>
-                        </ul>
-                    </description>
-                    <inherited uuid="780a3910-2019-4d33-a2f9-5c6ac91929d6"
-                        provided-uuid="11111111-0000-4000-9009-002001002001">
-                        <description>
-                            <p>TBD: provided-uuid needs to match the one in the AWS' SSP.</p>
-                            <p>All privileged and non-privileged accounts that are granted access to
-                                the AWS infrastructure and are responsible for the Blossom System deployment and maintenance
-                                (this system), are managed by the AWS IaaS (leveraged ATO system)
-                                which uses an Access Control List (ACL) for the NIST employees
-                                assigned Blossom roles.</p>
-                        </description>
-                    </inherited>
-                    <satisfied uuid="6486f725-1372-434f-9b1b-7cf3f50c32d1"
-                        responsibility-uuid="11111111-0000-4000-9009-002001002002">
-                        <description>
-                            <p>The Access Control List (ACL) updates are Blossom system's responsibility (as customers of AWS)
-                                For all roles listed above which are managed by the AWS IaaS
-                                system, account creation/revokation/deletion requests are approved
-                                by the Blossom system's System Owner or the Blossom PM and are added to or delete
-                                from the ACL list by the System Administrator.</p>
-                        </description>
-                    </satisfied>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.b" uuid="bb2476f6-0f78-4e64-94f1-1b58b80db8e0">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="d52db118-3e6f-4b39-8fd9-a3a65dfcb6b1">
-                    <description>
-                        <p>For this system, the entity with the System Administrator role
-                             acts as the Accounts Manager and is responsible for creating, 
-                             revoking, delete accounts per decissions made by the System Owner.</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.c" uuid="297d7975-c0fa-46f3-bbbd-585b2e2bae3f">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="c72b52e1-1943-4a52-be48-7bcce7df2f6d">
-                    <description>
-                        <!-- ac-02_odp.01= "have an organization-sponsored email address to demonstrate employment and
-                          have been approved by the System Owner based on the business need of the individual" -->
-                        <p>For each identified role, access to the system for each role will be individually 
-                            analyzed and granted if the requesters proves they <insert type="param" id-ref="ac-02_odp.01" /> 
-                            for the respective group and role membership.</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.d" uuid="a0ae8e3a-83b9-4a07-ba9b-3ba0d7a7104c">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="779d08e3-4ed0-4a83-84ab-2ca2c9ec3745">
-                    <description>
-                        <p>1. All authorized users are listed and accuratelly maintained in this SSP in the "metadata", as "party" elements of type="person".</p>
-                        <p>2. All roles supported by the Blossom system are documented in this SSP in the "metadata", as "role" elements with "id" identifying the role. 
-                            This system does not support groups. </p>
-                        <p>3. All access authorizations are documented in this SSP in the "metadata" as "responsible-party" with "role-id" mathing the respective roles or attributes.</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.d.1" uuid="4c65972e-1580-49dd-aede-b3e4af0703e1">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="49c1dab6-3c75-4758-8119-120e01f163d7">
-                    <description>
-                        <p>Authorized users of the system</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.d.2" uuid="77ab4262-292a-4542-be4f-3bbf136adaf7">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="df7fbdc2-78e2-4391-9981-bb9f682a363a">
-                    <description>
-                        <p>Group and role membership</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.d.3" uuid="0a95af0d-8d11-41cb-a5cf-e7352b0cafe8">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="37e94c9b-acb8-458f-8a95-c1d110ead856">
-                    <description>
-                        <p>Access authorizations (i.e., privileges) and <insert type="param"
-                                id-ref="ac-02_odp.0_2" />[Assignment: organization-defined attributes
-                            (as required)] for each account;</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.e" uuid="f14d12a4-470a-4d97-b0d1-8a8bd72749f0">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="40d40fbc-aed0-4323-9846-2ed3dc0f321e">
-                    <description>
-                        <p>Require approvals by <insert type="param" id-ref="ac-02_odp.03" />[Assignment:
-                            organization-defined personnel or roles] for requests to create
-                            accounts;</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.f" uuid="25468357-e8b1-4703-aecb-b6a37ccccd9e">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="02d4c648-5a86-4155-bd73-02c3439262b4">
-                    <description>
-                        <p>Create, enable, modify, disable, and remove accounts in accordance with <insert
-                                type="param" id-ref="ac-02_odp.04" />[Assignment: organization-defined
-                            policy, procedures, prerequisites, and criteria];</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.g" uuid="a4de4fa5-0c77-4a13-8a57-13739bcfc1ae">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="ab679286-80e7-4b6d-b08c-34931bb56073">
-                    <description>
-                        <p>Monitor the use of accounts;</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.h" uuid="17fe835f-b916-4966-a168-6249b54a9275">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="c555e31a-7b0d-437a-b415-e9ba5f2e1ef0">
-                    <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-02_odp.05" />[Assignment:
-                            organization-defined personnel or roles] within:</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.h.1" uuid="e3d29dc5-7247-4045-862b-8b233824937a">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="f1606d4f-3c5e-4c25-9649-94a12edbc113">
-                    <description>
-                        <p>Notify account managers and <insert type="param" id-ref="ac-02_odp.05" />[Assignment:
-                            system owner] within:<insert type="param" id-ref="ac-02_odp.06" />[Assignment:
-                            1 business day] when accounts are no longer required;</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.h.2" uuid="a48f76ce-c4d3-4b65-ab88-9d9de0eb5408">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="c5a6312a-6123-4aa4-8097-3b4e30e70b72">
-                    <description>
-                        <p><insert type="param" id-ref="ac-02_odp.07" />[Assignment:
-                            organization-defined time period] when users are terminated or
-                            transferred; </p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.h.3" uuid="07fa50b6-54a6-4e82-8d50-b732868be673">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="1d085fa3-94d9-4f4c-a62b-963cc4640f12">
-                    <description>
-                        <p><insert type="param" id-ref="ac-02_odp.08" />[Assignment:
-                            organization-defined time period] when system usage or need-to-know
-                            changes for an individual;</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.i" uuid="8089db43-a930-4b05-b661-f6bdaf602de0">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="f793018d-36df-48bf-a2f0-996364d3f46e">
-                    <description>
-                        <p>Authorize access to the system based on:</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.i.1" uuid="d39d826f-5eda-46f5-ba6e-c1876c5c9a44">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="c5d96adf-2313-48c2-98e1-73f1b7044d68">
-                    <description>
-                        <p>A valid access authorization;</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.i.2" uuid="3bc04bba-c4bb-4134-be58-00b1c9e639e1">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="54fc3c61-3717-4ad2-8291-fd521b6b9d0d">
-                    <description>
-                        <p>Intended system usage; </p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.i.3" uuid="c6e80ed4-f36e-4e6b-9bb2-2ef200bda619">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="587c32c5-701a-4e5c-83a7-2438ab3d71b1">
-                    <description>
-                        <p><insert type="param" id-ref="ac-02_odp.09" />[Assignment:
-                            organization-defined attributes (as required)];</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.j" uuid="6d66a726-f59a-478c-b1ab-071293318857">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="b7932e43-9aa3-4bba-86a8-439a74e1e79a">
-                    <description>
-                        <p>Review accounts for compliance with account management requirements <insert
-                                type="param" id-ref="ac-02_odp.10" />[Assignment:
-                            organization-defined frequency];</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.k" uuid="781332d1-017d-4c97-8f42-ec618914bcb3">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="d0cdfbc2-aef5-418e-94dc-9906341bcc12">
-                    <description>
-                        <p>Establish and implement a process for changing shared or group account
-                            authenticators (if deployed) when individuals are removed from the
-                            group;</p>
-                    </description>
-                </by-component>
-            </statement>
-            <statement statement-id="ac-2_smt.l" uuid="ea940e91-f316-4adc-8a99-ffa8a7609127">
-                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
-                    uuid="f23d55dd-1204-42f9-862e-2a07200b5c6e">
-                    <description>
-                        <p>Align account management processes with personnel termination and
-                            transfer processes.</p>
-                    </description>
-                </by-component>
-            </statement>
-        </implemented-requirement>
-    </control-implementation>
-    <back-matter>
-        <resource uuid="c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c">
-            <description>
-                <p>Blossom Wiki</p>
-            </description>
-            <rlink
-                href="https://github.com/usnistgov/blossom-nist-member/wiki"
-                media-type="multipart/alternative" />
-            <remarks>
-                <p>Project's Wiki which provides descriptions for the ATO and business processes.</p>
-            </remarks>
-        </resource>
-        <resource uuid="006babc9-4f57-4ab0-9941-15fcb65e0387">
-            <description>
-                <p>National Institute of Standards and Technology's Logo</p>
-            </description>
-            <rlink
-                href="https://www.nist.gov/sites/default/files/images/2017/09/20/645px-nist_logo-svg_1.png"
-                media-type="image/png" />
-            <base64 filename="logo.png" media-type="image/png">00000000</base64>
-            <remarks>
-                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
-                    .</p>
-                <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-                <p>Images must be in sufficient resolution to read all detail when rendered in a
-                    browser via HTML5.</p>
-            </remarks>
-        </resource>
-        <resource uuid="d2eb3c18-6754-4e3a-a933-03d289e3fad5">
-            <description>
-                <p>The primary authorization boundary diagram.</p>
-            </description>
-            <rlink href="./diagrams/boundary.png" />
-            <base64 filename="logo.png" media-type="image/png">00000000</base64>
-            <remarks>
-                <p>Section 9.2, Figure 9-1 Authorization Boundary Diagram (graphic)</p>
-                <p>This should be referenced in the
-                    system-characteristics/authorization-boundary/diagram/link/@href flag using a
-                    value of "#d2eb3c18-6754-4e3a-a933-03d289e3fad5"</p>
-                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
-                    .</p>
-                <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-                <p>Images must be in sufficient resolution to read all detail when rendered in a
-                    browser via HTML5.</p>
-            </remarks>
-        </resource>
-        <resource uuid="61081e81-850b-43c1-bf43-1ecbddcb9e7f">
-            <description>
-                <p>The primary network diagram.</p>
-            </description>
-            <rlink href="./diagrams/network.png" />
-            <base64 filename="network.png" media-type="image/png">00000000</base64>
-            <remarks>
-                <p>Section 9.4, Figure 9-2 Network Diagram (graphic)</p>
-                <p>This should be referenced in the
-                    system-characteristics/network-architecture/diagram/link/@href flag using a
-                    value of "#61081e81-850b-43c1-bf43-1ecbddcb9e7f"</p>
-                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
-                    .</p>
-                <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
-                <p>Images must be in sufficient resolution to read all detail when rendered in a
-                    browser via HTML5.</p>
-            </remarks>
-        </resource>
-        <resource uuid="fab59751-b855-40cb-93c1-492562e20e18">
-            <title>Privacy Impact Assessment</title>
-            <prop name="type" ns="https://csrc.nist.gov/ns/blossom"
-                value="privacy-impact-assessment" />
-            <prop name="publication" ns="https://csrc.nist.gov/ns/blossom" value="Document Date" />
-            <prop name="version" value="Document Version" />
-            <rlink href="./documents/pia.docx"
-                media-type="application/vnd.openxmlformats-officedocument.wordprocessingml.document" />
-            <base64 filename="pia.docx"
-                media-type="application/vnd.openxmlformats-officedocument.wordprocessingml.document">
-                00000000</base64>
-            <remarks>
-                <p>Table 15-1 Attachments: Privacy Impact Assessment</p>
-                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
-                    .</p>
-            </remarks>
-        </resource>
-    </back-matter>
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+    uuid="8c91b0ac-8eaa-4ac2-a2fb-eeff3b7efa20">
+    <metadata>
+        <title>BloSS@M System Security Plan</title>
+        <published>2022-04-05T00:00:00Z</published>
+        <last-modified>2024-03-27T00:00:00Z</last-modified>
+        <version>0.1</version>
+        <oscal-version>1.1.2</oscal-version>
+        <!-- ###
+         The following 4 roles are associated with the ATO operations and system management. 
+         ### -->
+        <role id="system-owner">
+            <title>System Owner (SO)</title>
+            <description>
+                <p>The individual within the organization who is ultimately accountable for
+                    everything related to the deployment, assessemnt, authorization and operations
+                    of the Blossom Member which provides the software assets leasing service (here
+                    in known as "this system").</p>
+            </description>
+        </role>
+        <role id="system-administrator">
+            <title>System Administrator (SA)</title>
+            <description>
+                <p>The individual accountable for the deployment, configuration, testing and
+                    operations of the system on behalf of the System Owner.</p>
+            </description>
+        </role>
+        <role id="sys-sec-assessor">
+            <title>System Security Assessor (SSA)</title>
+            <description>
+                <p>The individual accountable for assessing the security posture of the system on
+                    behalf of the system owner.</p>
+            </description>
+        </role>
+        <role id="authorizing-official">
+            <title>Authorizing Official</title>
+            <description>
+                <p>The individual or individuals who are ultimatly accountable for reviewing the
+                    assessemnt package, discuss with the SO the findings and grant an authorization
+                    to operate (ATO) to Blosom, a.ka "this system".</p>
+                <p>The Authorizing Official is the only entity responsible for the security posture
+                    of the system and has access to the ATO channel (chaincode) to upload the ATO Attestation Memo (AAM). 
+                    The AO signs the AAM on behalf of the agency.</p>
+            </description>
+        </role>
+        <!-- ###
+          The following 3 roles are associated with the business (assets) operations 
+          ### -->
+        <role id="tpoc">
+            <title>Technical Point of Contact (TPOC)</title>
+            <description>
+                <p>The individual accountable for managing leased licenses (checkout, install,
+                    uninstall, return).</p>
+            </description>
+        </role>
+        <role id="license-owner">
+            <title>License Owner (LO)</title>
+            <description>
+                <p>The individual within the service provider organization who is accountable for
+                    managing the pool of software resources made available for leasing to USG
+                    agencies.</p>
+                <p>The License Owner role exists only within the service provider agency.</p>
+            </description>
+        </role>
+        <role id="acquisition-officer">
+            <title>Acquisition Officer</title>
+            <description>
+                <p>The individual within the Agency which is responsible for approving and 
+                    processing the payment of the leased pool of software licenses.</p>
+            </description>
+        </role>
+        <location uuid="1ef39fd9-d184-44c4-8ef4-36d2dbad70a2">
+            <title>National Institute of Standards and Technology</title>
+            <address type="work">
+                <addr-line>100 Bureau Drive</addr-line>
+                <city>Gaithersburg</city>
+                <state>MD</state>
+                <postal-code>20899</postal-code>
+            </address>
+            <remarks>
+                <p>NIST ITL Computer Security Division's Secure Systems and Applications Group is
+                    the primary CSP for this project.</p>
+            </remarks>
+        </location>
+        <location uuid="cd8b83a8-3c8e-4b0e-abd3-bbb57e2c404e">
+            <title>AWS US East/West</title>
+            <address>
+                <addr-line>13200 Woodland Park Rd</addr-line>
+                <city>Herndon</city>
+                <state>VA</state>
+                <postal-code>20171</postal-code>
+            </address>
+            <prop name="type" value="data-center" class="primary" />
+            <remarks>
+                <p>This title must be kept as-is to match FedRAMP Marketplace listing. This is a a
+                    FedRAMP requirement. This official mailing address of Amazon's AWS commercial
+                    offering for the us-east-1 is provided, as Amazon not disclose the address of
+                    data-centers either on a region or availability zone basis.</p>
+            </remarks>
+        </location>
+        <party uuid="8aed7ffd-5158-445d-8d7c-eec5cf240cba" type="organization">
+            <name>National Institute of Standards and Technology IT Lab Computer Security Division Secure Systems and Applications Group</name>
+            <short-name>NIST</short-name>
+            <link href="#006babc9-4f57-4ab0-9941-15fcb65e0387" rel="logo" />
+            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
+            <remarks>
+                <p>Blossom network provider.</p>
+            </remarks>
+        </party>
+        <party uuid="09ad840f-aa79-43aa-9f22-25182c2ab11b" type="person">
+            <name>Stan Owens</name>
+            <prop name="job-title" value="System Owner" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <party uuid="551b9706-d6a4-4d25-8207-f2ccec541016" type="person">
+            <name>ManoGiana Bloom</name>
+            <prop name="job-title" value="Blossom Program Manager" />
+            <email-address>blossom@nist.gov</email-address>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <party uuid="4fded5fd-7a65-47ea-bd76-df57c46e27d1" type="person">
+            <name>Simmon Admino</name>
+            <prop name="job-title" value="System Administrator" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <party uuid="132953a9-640c-46f7-9de9-3fa15ec99361" type="person">
+            <name>Steve S. Asesoro</name>
+            <prop name="job-title" value="System Security Assessor" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="AWS" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <!-- ###
+         The UUIDs of the following parties need to be registered in Cognito first
+          and the UUID generated by Cognito needs to be used as the party's UUID.
+          Any update in Cognito will have to trigger an update of the SSP 
+          ### -->
+        <party uuid="3360e343-9860-4bda-9dfc-ff427c3dfab6" type="person">
+            <name>Aurelian Officeman</name>
+            <prop name="job-title" value="Authorizing Official" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <party uuid="51588d7c-aa79-43aa-9f22-25182c2cd22d" type="person">
+            <name>Licenta Owens</name>
+            <prop name="job-title" value="License Owner" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <party uuid="7380b1a3-5f04-4b6a-bada-ee13a1d78f3a" type="person">
+            <name>Acquia Officiale</name>
+            <prop name="job-title" value="Acquisition Officer" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <party uuid="c46e27d1-7a65-47ea-bd76-df574fded5fd" type="person">
+            <name>Tom Pock</name>
+            <prop name="job-title" value="Technical Point of Contact" />
+            <prop name="iam-manager" ns="https://csrc.nist.gov/ns/blossom" value="Cognito-NGAC" />
+            <prop name="privilege-level" ns="https://csrc.nist.gov/ns/blossom" value="non-privileged" />
+            <email-address>blossom@nist.gov</email-address>
+            <location-uuid>1ef39fd9-d184-44c4-8ef4-36d2dbad70a2</location-uuid>
+            <member-of-organization>8aed7ffd-5158-445d-8d7c-eec5cf240cba</member-of-organization>
+        </party>
+        <!-- ###
+             Entities with access to the infrastructure
+        ### -->
+            <!-- #### 
+             Privileged Roles 
+            #### -->
+        <responsible-party role-id="system-owner">
+            <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
+            <party-uuid>551b9706-d6a4-4d25-8207-f2ccec541016</party-uuid>
+        </responsible-party>
+        <responsible-party role-id="system-administrator">
+            <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
+            <remarks>
+                <p>This party has development, deployment, configuration and operations
+                    responsibilities for "this system" supporting the system owner.</p>
+            </remarks>
+        </responsible-party>
+            <!-- ####
+             Non-Privileged Roles 
+             #### -->
+        <responsible-party role-id="sys-sec-assessor">
+            <party-uuid>132953a9-640c-46f7-9de9-3fa15ec99361</party-uuid>
+            <remarks>
+                <p>The party responsible to assess the security controls on behalf of the system
+                    owner.</p>
+            </remarks>
+        </responsible-party>
+        <!-- ###
+             Entities with access to the assets/business private channel 
+         ### -->
+            <!-- #### 
+             Privileged Roles 
+             #### -->
+        <responsible-party role-id="license-owner">
+            <party-uuid>51588d7c-aa79-43aa-9f22-25182c2cd22d</party-uuid>
+            <remarks>
+                <p>The license owner is responsible for managing the licenses a Blossom Member leases, and is also responsible for uploading to the asset chaincode the MOA signed by the TPOC and Acquisition Officer.</p>
+            </remarks>
+        </responsible-party>
+            <!-- ####
+             Non-Privileged Roles 
+             #### -->
+        <responsible-party role-id="tpoc">
+            <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
+            <remarks>
+                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
+                <p>The TPOC is also responsible for reviewing and signing the initial Memorandum of Aggrement (MOA) stating the rules on engagemnet whith Blossom service around ATO automation and assets leasing.</p>
+            </remarks>
+        </responsible-party>
+        <responsible-party role-id="acquisition-officer">
+            <party-uuid>c46e27d1-7a65-47ea-bd76-df574fded5fd</party-uuid>
+            <remarks>
+                <p>Interfaces with the other agencies and need only read access to the ledger to review the assets (licenses) processed.</p>
+            </remarks>
+        </responsible-party>
+        <!-- ###
+            Entities with access to the Authorization private channel 
+         ### -->
+         <!-- Privileged Roles -->
+        <responsible-party role-id="authorizing-official">
+            <party-uuid>3360e343-9860-4bda-9dfc-ff427c3dfab6</party-uuid>
+        </responsible-party>
+        <remarks>
+            <p>This SSP was created using a simplified version of OSCAL-based FedRAMP SSP Template
+                for the FedRAMP Low, Moderate, and High baselines.</p>
+        </remarks>
+    </metadata>
+    <import-profile href="../../xml/profile/blossom_moderate_profile.xml">
+        <remarks>
+            <p>This example points to the tailored FedRAMP Moderate 800-53 rev 5 baseline, adjusted
+                accordingly for BloSS@M.</p>
+        </remarks>
+    </import-profile>
+    <system-characteristics>
+        <system-id identifier-type="http://ietf.org/rfc/rfc4122">8101e04d-8305-4e73-bb95-6b59f645b143</system-id>
+        <system-name>Blockchain-based Secure Software Assets Management</system-name>
+        <system-name-short>Blossom</system-name-short>
+        <description>
+            <p>TBD: Describe the purpose and functions of this system here.</p>
+        </description>
+        <prop name="identity-assurance-level" value="2" />
+        <prop name="authenticator-assurance-level" value="2" />
+        <prop name="federation-assurance-level" value="2" />
+        <prop name="cloud-service-model" value="saas" />
+        <prop name="cloud-deployment-model" ns="https://fedramp.gov/ns/oscal" value="public-cloud" />
+        <security-sensitivity-level>fips-199-moderate</security-sensitivity-level>
+        <system-information>
+            <prop name="privacy-designation" value="no" />
+            <prop name="pta-1" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
+            <prop name="pta-2" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
+            <prop name="pta-3" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
+            <prop name="pta-4" ns="https://fedramp.gov/ns/oscal" value="no" class="pta" />
+            <information-type uuid="1c21b0ef-29af-4b81-9a38-dacd1e6967b1">
+                <title>Blockchain-based Software Assets Management</title>
+                <description>
+                    <p>BloSS@M stores the minimally required identity and authorization metadata to
+                        authenitcate and authorize federal users of the system.</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.2.8.12</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-low</base>
+                    <selected>fips-199-moderate</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-low</base>
+                    <selected>fips-199-moderate</selected>
+                    <adjustment-justification>
+                        <p>The NIST Privacy Office and Office of Information Systems Management
+                            categorizes personal identity and authentication information with as
+                            FIPS-199 Low impact for integrity concerns.
+                            This categorization is limited to federal employees when this data is
+                            for identification of these federal employees only.</p>
+                    </adjustment-justification>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-low</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="0c9f7c06-bc4e-4006-b5a5-f150cf7ce1ac">
+                <title>Inventory control information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.4.2</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="c7c42a0c-8fa6-49fb-b98f-8804609504a5">
+                <title>Logistics management information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.4.3</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="f18905ed-6971-4a31-b29a-38d78c398d1f">
+                <title>Services acquisition information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.4.4</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="4be97836-b11a-487d-8c27-174e3352d8d6">
+                <title>Lifecycle and change management information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.5.2</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="fa4794ee-5d10-45e8-a8ab-154d4199cbd3">
+                <title>Information security information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.5.5</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="514e0850-16ce-4a86-b589-ca546c4c645c">
+                <title>Record retention information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.5.6</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="70b28c11-31c8-429b-855f-cc323fef59ea">
+                <title>Information management information</title>
+                <description>
+                    <p>TBD:</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.5.7</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="5820d24a-487a-4748-8bd2-ea4318337816">
+                <title>Information sharing information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>C.3.5.9</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                    <adjustment-justification>
+                        <p>This information has no base recommendation in SP 800-60 Volume 2
+                            Revision 1 guidance.
+                            The Office of Information Systems Management's consulted the BloSS@M
+                            Team and the NIST system owner, who categorized this information sharing
+                            at FIPS-199 Moderate impact.</p>
+                    </adjustment-justification>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                    <adjustment-justification>
+                        <p>This information has no base recommendation in SP 800-60 Volume 2
+                            Revision 1 guidance.
+                            The Office of Information Systems Management's consulted the BloSS@M
+                            Team and the NIST system owner, who categorized this information sharing
+                            at FIPS-199 Moderate impact.</p>
+                    </adjustment-justification>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                    <adjustment-justification>
+                        <p>This information has no base recommendation in SP 800-60 Volume 2
+                            Revision 1 guidance.
+                            The Office of Information Systems Management's consulted the BloSS@M
+                            Team and the NIST system owner, who categorized this information sharing
+                            at FIPS-199 Moderate impact.</p>
+                    </adjustment-justification>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="abaf261d-3860-47aa-bd7a-58e5776bae44">
+                <title>Scientific and technological research and innovation information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>D.19.1</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="88f10ac5-f2c8-43e3-af9e-d692360c61da">
+                <title>Research and development information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>D.20.1</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-moderate</selected>
+                </availability-impact>
+            </information-type>
+            <information-type uuid="53347cf4-8b06-4acc-a2fa-88177d7c937c">
+                <title>Research and development information</title>
+                <description>
+                    <p>TBD</p>
+                </description>
+                <categorization system="https://doi.org/10.6028/NIST.SP.800-60v2r1">
+                    <information-type-id>D.20.4</information-type-id>
+                </categorization>
+                <confidentiality-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </confidentiality-impact>
+                <integrity-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </integrity-impact>
+                <availability-impact>
+                    <base>fips-199-moderate</base>
+                    <selected>fips-199-low</selected>
+                </availability-impact>
+            </information-type>
+        </system-information>
+        <security-impact-level>
+            <security-objective-confidentiality>fips-199-moderate</security-objective-confidentiality>
+            <security-objective-integrity>fips-199-moderate</security-objective-integrity>
+            <security-objective-availability>fips-199-low</security-objective-availability>
+        </security-impact-level>
+        <status state="under-development" />
+        <authorization-boundary>
+            <description>
+                <p>TBD: A holistic, top-level explanation of the system's authorization boundary.</p>
+            </description>
+            <diagram uuid="dbf46c27-52a9-49c4-beb6-b6399cd75497">
+                <description>
+                    <p>A diagram-specific explanation.</p>
+                </description>
+                <link href="#d2eb3c18-6754-4e3a-a933-03d289e3fad5" rel="diagram" />
+                <caption>Authorization Boundary Diagram</caption>
+            </diagram>
+        </authorization-boundary>
+        <network-architecture>
+            <description>
+                <p>A holistic, top-level explanation of the network architecture.</p>
+            </description>
+            <diagram uuid="e97c3395-433a-48c1-8cc7-dd1e1555941c">
+                <description>
+                    <p>A diagram-specific explanation.</p>
+                </description>
+                <link href="#61081e81-850b-43c1-bf43-1ecbddcb9e7f" rel="diagram" />
+                <caption>Network Diagram</caption>
+            </diagram>
+        </network-architecture>
+        <data-flow>
+            <description>
+                <p>A holistic, top-level explanation of the system's data flows.</p>
+            </description>
+            <diagram uuid="e3b98448-4219-46a5-b229-412423c566f3">
+                <description>
+                    <p>A diagram-specific explanation.</p>
+                </description>
+                <!--TBD: needds to be fixed 
+                <link href="#ac5d7535-f3b8-45d3-bf3b-735c82c64547" rel="diagram" /> 
+                -->
+                <caption>Data Flow Diagram</caption>
+            </diagram>
+        </data-flow>
+    </system-characteristics>
+    <system-implementation>
+        <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+            <title>AWS Managed Blockchain (AMB)</title>
+            <link href="./aws_leveraged_authorization_ssp.xml" />
+            <!-- The Leveraged Authorization POC is the AMB's Authorizing Official in this case. -->
+            <party-uuid>e63e870d-bf43-40dc-98a0-37d5e39b2dd1</party-uuid>
+            <date-authorized>2024-01-01</date-authorized>
+            <remarks>
+                <p>TBD: ssp-uuid: 73a7ca56-ac02-43b9-8664-62bcb05a7e91 will need to be added for
+                    oscal 1.2.0.</p>
+                <p>The leveraged authorization assembly is supposed to have a required uuid flag
+                    instead of an optional id flag. This will be fixed in the syntax shortly.</p>
+                <p>Use one leveraged-authorization assembly for each underlying system. (In the
+                    legacy world, these may be general support systems.</p>
+                <p>The link fields are optional, but preferred where known. Often, a leveraging
+                    system's SSP author will not have access to the leveraged system's SSP, but
+                    should have access to the leveraged system's CRM.</p>
+            </remarks>
+        </leveraged-authorization>
+        <user uuid="9cb0fab0-78bd-44ba-bcb8-3e9801cc952f">
+            <title>System Administrator</title>
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
+            <prop name="privilege-level" value="privileged" />
+            <prop name="type" value="internal" />
+            <role-id>system-administrator</role-id>
+            <authorized-privilege>
+                <title>Full administrative access rights</title>
+                <function-performed>add and remove users, software-name and hardware</function-performed>
+                <function-performed>install and configure deployments</function-performed>
+                <function-performed>system updates, patches and hotfixes</function-performed>
+                <function-performed>perform backups</function-performed>
+            </authorized-privilege>
+        </user>
+        <user uuid="046ea806-2220-4ab4-9de0-1304f6be0b66">
+            <title>System Owner</title>
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
+            <prop name="privilege-level" value="privileged" />
+            <prop name="type" value="internal" />
+            <role-id>system-owner</role-id>
+            <authorized-privilege>
+                <title>Privileged access rights</title>
+                <function-performed>add and remove users, software-name and hardware</function-performed>
+                <function-performed>install and configure deployments</function-performed>
+                <function-performed>system updates, patches and hotfixes</function-performed>
+                <function-performed>perform backups</function-performed>
+            </authorized-privilege>
+        </user>
+        <user uuid="f93d5a58-0688-4e48-8aaa-0c4d20c57f9b">
+            <title>System Security Assessor</title>
+            <prop name="sensitivity" ns="https://csrc.nist.gov/ns/blossom" value="high" />
+            <prop name="privilege-level" value="non-privileged" />
+            <prop name="type" value="internal" />
+            <role-id>sys-sec-assessor</role-id>
+            <authorized-privilege>
+                <title>Non-privileged access rights (read only)</title>
+                <function-performed>review system documentation and security configurations</function-performed>
+                <function-performed>review if system updates, patches and hotfixes are documented and successfully completed</function-performed>
+                <function-performed>review disaster recovery procedures and system backups existance</function-performed>
+            </authorized-privilege>
+        </user>
+        <component uuid="60f92bcf-f353-4236-9803-2a5d41751010" type="this-system">
+            <title>This System</title>
+            <description>
+                <p>The entire Blossom system as depicted in the system authorization boundary</p>
+            </description>
+            <status state="under-development" />
+        </component>
+        <component uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" type="leveraged-system">
+            <title>AWS Managed Blockchain (AMB) - Leveraged System</title>
+            <description>
+                <p>TBD: If the leveraged system owner provides a UUID for their system (such as in
+                    an OSCAL-based CRM), it should be reflected in the <code>inherited-uuid</code>
+                    property.</p>
+            </description>
+            <prop name="leveraged-authorization-uuid" value="5a9c98ab-8e5e-433d-a7bd-515c07cd1497" />
+            <prop name="implementation-point" value="external" />
+            <!-- The value of inherited-uuid is the uuid of the component of the leveraged system
+            which provides the control implementation. In thsi case will be the AMB's
+            "this-system"-->
+            <prop name="inherited-uuid" value="73a7ca56-ac02-43b9-8664-62bcb05a7e91" />
+            <status state="operational" />
+        </component>
+        <inventory-item uuid="79b4f0d1-91ab-49e8-af28-045c12aa9272">
+            <description>
+                <p>TBD: Description of Blossom inventory items 1</p>
+            </description>
+            <prop name="software-name" value="Blossom SaaS" class="blockchain-application" />
+            <prop name="software-version" value="1.0.0" class="blockchain-application" />
+            <prop name="asset-id" value="BLOSSOM-SAAS-2222-01" />
+            <prop name="is-scanned" value="yes" />
+            <implemented-component component-uuid="1541015b-6d19-42cb-a991-624cc082ed4d">
+                <prop name="asset-id" value="BLOSSOM-SAAS-2222" />
+            </implemented-component>
+        </inventory-item>
+    </system-implementation>
+    <control-implementation>
+        <description>
+            <p>This is a palceholder for the FedRAMP SSP Template Section 13</p>
+            <p>This description field is required by OSCAL.</p>
+            <p>FedRAMP does not require any specific information here.</p>
+        </description>
+        <!-- ####
+            AC-1 is not in our profile. If we include it, we meed to correct the errors (AC-1.b does not have a
+        b.1 and b.2, but it has b and c) 
+            #### -->
+        <!-- AC-1 will not be implemented now. 
+        <implemented-requirement uuid="eee8697a-bc39-45aa-accc-d3e534932efb" control-id="ac-1">
+            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal"
+                value="2020-11-27Z" />
+            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="planned">
+                <remarks>
+                    <p>Describe the plan to complete the implementation.</p>
+                </remarks>
+            </prop>
+            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="sp-system" />
+            <statement statement-id="ac-1_smt" uuid="240fa015-01df-4741-bff5-6958c7fb85e5">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="d9d1ce66-ff47-474d-8596-5fdf2af60179">
+                    <description>
+                        <p>Describe how the control is satisfied within the system.</p>
+                    </description>
+                    <set-parameter param-id="ac-1_prm_1">
+                        <value>[replace with list of personnel or roles]</value>
+                    </set-parameter>
+                    <set-parameter param-id="ac-1_prm_2">
+                        <value>[specify frequency]</value>
+                    </set-parameter>
+                    <set-parameter param-id="ac-1_prm_3">
+                        <value>[specify frequency]</value>
+                    </set-parameter>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-1_smt.a.1" uuid="fb4d039a-dc4f-46f5-9c1f-f6343eaf69bc">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="3f5612a4-cd1d-4c47-8cae-75d2eaa332cd">
+                    <description>
+                        <p>Describe how Part a is satisfied within the system.</p>
+                        <p>Legacy approach. If no policy component is defined, describe here how the
+                            policy satisfies part a.</p>
+                        <p>In this case, a link must be provided to the policy.</p>
+                        <p>FedRAMP prefers all policies and procedures be attached as a resource in
+                            the back-matter. The link points to a resource.</p>
+                    </description>
+                    <link href="#090ab379-2089-4830-b9fd-26d0729e22e9" rel="policy" />
+                </by-component>
+                <remarks>
+                    <p>The specified component is the system itself.</p>
+                    <p>Any control implementation response that can not be associated with another
+                        component is associated with the component representing the system.</p>
+                </remarks>
+            </statement>
+            <statement statement-id="ac-1_smt.a.2" uuid="c365cf95-5bc0-4599-9773-f4eddf69798d">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="00507a44-e0d7-4fe6-ad20-8d474a84ee15">
+                    <description>
+                        <p>Describe how Part b is satisfied within the system.</p>
+                        <p>Legacy approach. If no policy component is defined, describe here how the
+                            procedure satisfies part b.</p>
+                        <p>In this case, a link must be provided to the procedure.</p>
+                        <p>FedRAMP prefers all policies and procedures be attached as a resource in
+                            the back-matter. The link points to a resource.</p>
+                    </description>
+                    <link href="#1002a58e-9e11-4aa6-9ab4-2bde52995952" rel="procedure" />
+                </by-component>
+                <by-component component-uuid="fa90644a-8bf8-47da-b0d3-82bffc708afc"
+                    uuid="42ac379e-4abc-4716-809c-119c03b5ac64">
+                    <description>
+                        <p>Describe how Part b is satisfied within the system.</p>
+                        <p>Legacy approach. If no policy component is defined, describe here how the
+                            procedure satisfies part b.</p>
+                        <p>In this case, a link must be provided to the procedure.</p>
+                        <p>FedRAMP prefers all policies and procedures be attached as a resource in
+                            the back-matter. The link points to a resource.</p>
+                    </description>
+                </by-component>
+                <remarks>
+                    <p>The specified component is the system itself.</p>
+                    <p>Any control implementation response that can not be associated with another
+                        component is associated with the component representing the system.</p>
+                </remarks>
+            </statement>
+            <statement statement-id="ac-1_smt.b.1" uuid="b46f97ec-55c1-4249-a9b9-3a228f1e3791">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="767666cb-e558-484b-81ca-b0209932425c">
+                    <description>
+                        <p>Describe how Part b-1 is satisfied.</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-1_smt.b.2" uuid="59c67969-3d5c-45f1-8e3e-1e642249633f">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="5a869308-1625-4d92-9ed8-ff5d8bd13656">
+                    <description>
+                        <p>Describe how Part b-2 is satisfied.</p>
+                    </description>
+                </by-component>
+            </statement>
+        </implemented-requirement>
+    -->
+        <!-- ####
+            AC-2
+            ######  -->
+        <implemented-requirement uuid="7a36cf53-156d-4d1f-9a8b-433f61cc57b7" control-id="ac-2">
+            <!-- TBD: The following <prop>s must be reviewed, updated and only one option kept based
+            on AC-2 implementation of the inherited control for manageing the Authorizing Official's
+            account -->
+            <prop name="planned-completion-date" ns="https://fedramp.gov/ns/oscal"
+                value="2024/05/30" />
+            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="partial">
+                <remarks>
+                    <p>Per the documentation available in the Blossom Wiki, the AWS Managed
+                        Blockchain (AMB) provides access control to the infrastracture for the
+                        entities identified below which require access to IaaS to maintain and
+                        deploy system components. The blockchain's chaincode is implementing Next
+                        Generation Access Control (NGAC) standard to manage the access to resources
+                        for the roles docuemnted in the Blossom specification. Access control policy
+                        machines are implemented for the two private channels of the AMB: the ATO or
+                        "Authorization" channel and the "Businness" channel.</p>
+                </remarks>
+            </prop>
+            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="implemented">
+                <remarks>
+                    <p>The policy machines are controling the access to the two chaincodes
+                        (Authorization and Business) used by the system.</p>
+                </remarks>
+            </prop>
+            <!-- Use this prop for not applicable controls
+            <prop name="implementation-status" ns="https://fedramp.gov/ns/oscal" value="not-applicable">
+                <remarks>
+                    <p>TBD: Describe the justification for marking this control Not Applicable.</p>
+                </remarks>
+            </prop>  
+            -->
+            <!-- Control origination varies per role. See by-component under ac-2_smt
+            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
+                value="leveraged-system" />
+            <prop name="control-origination" ns="https://fedramp.gov/ns/oscal"
+                value="customer-configured">
+                <remarks>
+                    <p>TBD: Describe any customer-configured requirements for satisfying this
+                        control.</p>
+                </remarks>
+            </prop>
+            -->
+            <link rel="documentation" href="#c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c" />
+            <set-parameter param-id="ac-02_odp.01">
+                <value>have an organization-sponsored email address to demonstrate employment,complete training, and have been approved by the System Owner based on the business need of the individual</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.02">
+                <value>Access tagging</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.03">
+                <value>Accounts Manager(s): System Owner and Program Manager.</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.04">
+                <value>Organizational access control policies, standards and procedures, as documented in the AC-02.a statement implementation (statement-id="ac-2_smt.a", uuid="24a85abb-25ad-4686-850c-5c0e8ab69a0c").</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.05">
+                <!-- e.g. the security monitoring team-->
+                <value>System Administrator</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.06">
+                <value>1 business day</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.07">
+                <value>within one hour</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.08">
+                <value>within openxmlformats-officedocument hours</value>
+            </set-parameter>
+            <!-- AC-2_ODP[09] reads: "attributes needed to authorize system access"-->
+            <set-parameter param-id="ac-02_odp.09">
+                <value>need to know</value>
+            </set-parameter>
+            <set-parameter param-id="ac-02_odp.10">
+                <value>every 6 months or when a change takes place</value>
+            </set-parameter>
+            <responsible-role role-id="system-administrator">
+                <party-uuid>4fded5fd-7a65-47ea-bd76-df57c46e27d1</party-uuid>
+            </responsible-role>
+            <responsible-role role-id="system-owner">
+                <party-uuid>09ad840f-aa79-43aa-9f22-25182c2ab11b</party-uuid>
+            </responsible-role>
+            <statement statement-id="ac-2_smt" uuid="4facc265-ba1d-4d66-afc7-6385984b6a1e">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010" uuid="9d06a5a6-0c30-43cb-a18a-baabd616ddfb">
+                    <description>
+                        <p>For the IAM entities that have a business need, and which have accounts created in Cognito, the Policy machines which implement NGAC in the two chaincodes are managing the access control for the Blossom business layer users and the BC Member's Authorizing Official that is uploading the ATO Attestation to the Authorization channel.</p>
+                    </description>
+                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="customer-configured">
+                        <remarks>
+                            <p>The Blossom system's System Owner and System Administrator are repsonsible for approving, creating and managing accounts and grant or denie access to the system by maintaining accurate information in Cognito and updating the access control policies access control lists (ACLs).</p>
+                        </remarks>
+                    </prop>
+                </by-component>
+                <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65" uuid="eb710146-1ede-4876-9a3b-02c18408e506">
+                    <description>
+                        <p>AWS manages the access to approved entities to the system's infrastructure, for deployment, maintenance, and operations.</p>
+                    </description>
+                    <prop name="control-origination" ns="https://fedramp.gov/ns/oscal" value="leveraged">
+                        <remarks>
+                            <p>Keep the ACL list current at all times.</p>
+                        </remarks>
+                    </prop>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.a" uuid="24a85abb-25ad-4686-850c-5c0e8ab69a0c">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="b29d1505-69fa-4ad0-834b-d179e7f44fff">
+                    <description>
+                        <p>The system has privileged and non-privileged accounts associated with the business layer and the ATO processes.</p>
+                        <p>These accounts are managed by the NGAC implementation in the chaincodes for the ATO and for the assets management (business) processes.</p>
+                        <p>The following accounts are supported for the business operations (assets management):</p>
+                        <ul>
+                            <li>Privileged accounts: 
+                                <ul>License Owner</ul>
+                            </li>
+                            <li>Non-Privileged accounts: 
+                                <ul>Acquisition Officer</ul>
+                                <ul>Technical Point of Contact</ul>
+                            </li>
+                        </ul>
+                        <p>The Authorizing Official is responsible for reviewing the ATO package prepared by the System Owner and signing/authorizing the system to operate.</p>
+                        <p>The System Owner remains the custodian of all system ATO related artifacts.</p>
+                        <p>Upon approval, the Authorizing official is responsible for automatically generating the ATO attestation and uploading it to the ATO channel.</p>
+                        <p>The following account is supported for the ATO processes.</p>
+                        <ul>
+                            <li>Privileged accounts:
+                                 <ul>Authorizing Official</ul>
+                            </li>
+                        </ul>
+                    </description>
+                    <implementation-status state="under-development" />
+                </by-component>
+                <by-component component-uuid="e82e6e07-0c62-417e-8a19-3744991b4c65"
+                    uuid="84de735f-ba37-4bb4-b784-79760f986a40">
+                    <description>
+                        <p>The following accounts of the NIST Member of the Blossom System are managed by the Leveraged AWS IaaS:</p>
+                        <ul>
+                            <li>Privileged accounts: 
+                                <ul>System Owner</ul>
+                                <ul>System Administrator</ul>
+                            </li>
+                            <li>Non-Privileged accounts: 
+                                <ul>System Security Assessor</ul>
+                                <!-- #####
+                                NOTE: Authorizing Official will not have access to the infrastructure. 
+                                 System Owner is responsible to prepare the ATO package in collaboration 
+                                 with the System Security Assessor. Removing the AO from this list.
+                                <ul>Authorizing Official</ul>
+                                ##### -->
+                            </li>
+                        </ul>
+                    </description>
+                    <inherited uuid="780a3910-2019-4d33-a2f9-5c6ac91929d6"
+                        provided-uuid="11111111-0000-4000-9009-002001002001">
+                        <description>
+                            <p>TBD: provided-uuid needs to match the one in the AWS' SSP.</p>
+                            <p>All privileged and non-privileged accounts that are granted access to
+                                the AWS infrastructure and are responsible for the Blossom System deployment and maintenance
+                                (this system), are managed by the AWS IaaS (leveraged ATO system)
+                                which uses an Access Control List (ACL) for the NIST employees
+                                assigned Blossom roles.</p>
+                        </description>
+                    </inherited>
+                    <satisfied uuid="6486f725-1372-434f-9b1b-7cf3f50c32d1"
+                        responsibility-uuid="11111111-0000-4000-9009-002001002002">
+                        <description>
+                            <p>The Access Control List (ACL) updates are Blossom system's responsibility (as customers of AWS)
+                                For all roles listed above which are managed by the AWS IaaS
+                                system, account creation/revokation/deletion requests are approved
+                                by the Blossom system's System Owner or the Program Manager and are added to or delete
+                                from the ACL list by the System Administrator.</p>
+                        </description>
+                    </satisfied>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.b" uuid="bb2476f6-0f78-4e64-94f1-1b58b80db8e0">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="d52db118-3e6f-4b39-8fd9-a3a65dfcb6b1">
+                    <description>
+                        <p>For this system, the entity with the System Administrator role
+                             acts as the Accounts Manager and is responsible for creating, 
+                             revoking, deleting accounts per decisions made by the System Owner and the Program Manager.</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.c" uuid="297d7975-c0fa-46f3-bbbd-585b2e2bae3f">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="c72b52e1-1943-4a52-be48-7bcce7df2f6d">
+                    <description>
+                        <!-- ac-02_odp.01= "have an organization-sponsored email address to demonstrate employment and
+                          have been approved by the System Owner based on the business need of the individual" -->
+                        <p>For each identified role, access to the system for each role will be individually 
+                            analyzed and granted if the requesters proves they <insert type="param" id-ref="ac-02_odp.01" /> 
+                            for the respective group and role membership.</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.d" uuid="a0ae8e3a-83b9-4a07-ba9b-3ba0d7a7104c">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="779d08e3-4ed0-4a83-84ab-2ca2c9ec3745">
+                    <description>
+                        <p>1. All authorized users are listed and accuratelly maintained in this SSP in the "metadata", as "party" elements of type="person".</p>
+                        <p>2. All roles supported by the Blossom system are documented in this SSP in the "metadata", as "role" elements with "id" identifying the role. 
+                            This system does not support groups. </p>
+                        <p>3. All access authorizations are documented in this SSP in the "metadata" as "responsible-party" with "role-id" mathing the respective roles or attributes.</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.d.1" uuid="4c65972e-1580-49dd-aede-b3e4af0703e1">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="49c1dab6-3c75-4758-8119-120e01f163d7">
+                    <description>
+                        <p>Authorized Blossom users are documented in the Blossom SSP.</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.d.2" uuid="77ab4262-292a-4542-be4f-3bbf136adaf7">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="df7fbdc2-78e2-4391-9981-bb9f682a363a">
+                    <description>
+                        <p>Group and role membership</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.d.3" uuid="0a95af0d-8d11-41cb-a5cf-e7352b0cafe8">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="37e94c9b-acb8-458f-8a95-c1d110ead856">
+                    <description>
+                        <p>Access authorizations (i.e., privileges) and <insert type="param"
+                                id-ref="ac-02_odp.0_2" />[Assignment: organization-defined attributes
+                            (as required)] for each account;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.e" uuid="f14d12a4-470a-4d97-b0d1-8a8bd72749f0">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="40d40fbc-aed0-4323-9846-2ed3dc0f321e">
+                    <description>
+                        <p>Request to create accounts are approved <insert type="param" id-ref="ac-02_odp.03" />by the System Owner and the Program Manager;    </p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.f" uuid="25468357-e8b1-4703-aecb-b6a37ccccd9e">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="02d4c648-5a86-4155-bd73-02c3439262b4">
+                    <description>
+                        <p>Blossom user accounts are created, enabled, modified, disabled, and removed according to <insert
+                                type="param" id-ref="ac-02_odp.04" />the types of Blossom accounts (privileged or non-privileged);</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.g" uuid="a4de4fa5-0c77-4a13-8a57-13739bcfc1ae">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="ab679286-80e7-4b6d-b08c-34931bb56073">
+                    <description>
+                        <p>Monitor the use of accounts;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.h" uuid="17fe835f-b916-4966-a168-6249b54a9275">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="c555e31a-7b0d-437a-b415-e9ba5f2e1ef0">
+                    <description>
+                        <p>Account managers, <insert type="param" id-ref="ac-02_odp.05" />System Owner, and Program Manager are notified within:</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.h.1" uuid="e3d29dc5-7247-4045-862b-8b233824937a">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="f1606d4f-3c5e-4c25-9649-94a12edbc113">
+                    <description>
+                        <p>Account managers, <insert type="param" id-ref="ac-02_odp.05" />System Owner, and Program Manager are notified within<insert type="param" id-ref="ac-02_odp.06" />1 business day when accounts are no longer required;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.h.2" uuid="a48f76ce-c4d3-4b65-ab88-9d9de0eb5408">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="c5a6312a-6123-4aa4-8097-3b4e30e70b72">
+                    <description>
+                        <p><insert type="param" id-ref="ac-02_odp.07" />within 1 business day when users are terminated or
+                            transferred; </p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.h.3" uuid="07fa50b6-54a6-4e82-8d50-b732868be673">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="1d085fa3-94d9-4f4c-a62b-963cc4640f12">
+                    <description>
+                        <p><insert type="param" id-ref="ac-02_odp.08" />within 1 business day when system usage or need-to-know
+                            changes for an individual;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.i" uuid="8089db43-a930-4b05-b661-f6bdaf602de0">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="f793018d-36df-48bf-a2f0-996364d3f46e">
+                    <description>
+                        <p>System access authorization is based on:</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.i.1" uuid="d39d826f-5eda-46f5-ba6e-c1876c5c9a44">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="c5d96adf-2313-48c2-98e1-73f1b7044d68">
+                    <description>
+                        <p>A valid access authorization;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.i.2" uuid="3bc04bba-c4bb-4134-be58-00b1c9e639e1">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="54fc3c61-3717-4ad2-8291-fd521b6b9d0d">
+                    <description>
+                        <p>Intended system usage; </p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.i.3" uuid="c6e80ed4-f36e-4e6b-9bb2-2ef200bda619">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="587c32c5-701a-4e5c-83a7-2438ab3d71b1">
+                    <description>
+                        <p><insert type="param" id-ref="ac-02_odp.09" />Business need of the individual;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.j" uuid="6d66a726-f59a-478c-b1ab-071293318857">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="b7932e43-9aa3-4bba-86a8-439a74e1e79a">
+                    <description>
+                        <p>Accounts are reviewed for compliance with account management requirements <insert
+                                type="param" id-ref="ac-02_odp.10" />every 6 months.;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.k" uuid="781332d1-017d-4c97-8f42-ec618914bcb3">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="d0cdfbc2-aef5-418e-94dc-9906341bcc12">
+                    <description>
+                        <p>There are no group or shared accounts created for accessing Blossom;</p>
+                    </description>
+                </by-component>
+            </statement>
+            <statement statement-id="ac-2_smt.l" uuid="ea940e91-f316-4adc-8a99-ffa8a7609127">
+                <by-component component-uuid="60f92bcf-f353-4236-9803-2a5d41751010"
+                    uuid="f23d55dd-1204-42f9-862e-2a07200b5c6e">
+                    <description>
+                        <p>All Blossom user accounts are updated by the system administrator when they are terminated or are transferred where their Blossom account is not required.</p>
+                    </description>
+                </by-component>
+            </statement>
+        </implemented-requirement>
+    </control-implementation>
+    <back-matter>
+        <resource uuid="c3e6cc46-a28a-45ac-a2b0-ef7ce230a45c">
+            <description>
+                <p>Blossom Wiki</p>
+            </description>
+            <rlink
+                href="https://github.com/usnistgov/blossom-nist-member/wiki"
+                media-type="multipart/alternative" />
+            <remarks>
+                <p>Project's Wiki which provides descriptions for the ATO and business processes.</p>
+            </remarks>
+        </resource>
+        <resource uuid="006babc9-4f57-4ab0-9941-15fcb65e0387">
+            <description>
+                <p>National Institute of Standards and Technology's Logo</p>
+            </description>
+            <rlink
+                href="https://www.nist.gov/sites/default/files/images/2017/09/20/645px-nist_logo-svg_1.png"
+                media-type="image/png" />
+            <base64 filename="logo.png" media-type="image/png">00000000</base64>
+            <remarks>
+                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
+                    .</p>
+                <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
+                <p>Images must be in sufficient resolution to read all detail when rendered in a
+                    browser via HTML5.</p>
+            </remarks>
+        </resource>
+        <resource uuid="d2eb3c18-6754-4e3a-a933-03d289e3fad5">
+            <description>
+                <p>The primary authorization boundary diagram.</p>
+            </description>
+            <rlink href="./diagrams/boundary.png" />
+            <base64 filename="logo.png" media-type="image/png">00000000</base64>
+            <remarks>
+                <p>Section 9.2, Figure 9-1 Authorization Boundary Diagram (graphic)</p>
+                <p>This should be referenced in the
+                    system-characteristics/authorization-boundary/diagram/link/@href flag using a
+                    value of "#d2eb3c18-6754-4e3a-a933-03d289e3fad5"</p>
+                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
+                    .</p>
+                <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
+                <p>Images must be in sufficient resolution to read all detail when rendered in a
+                    browser via HTML5.</p>
+            </remarks>
+        </resource>
+        <resource uuid="61081e81-850b-43c1-bf43-1ecbddcb9e7f">
+            <description>
+                <p>The primary network diagram.</p>
+            </description>
+            <rlink href="./diagrams/network.png" />
+            <base64 filename="network.png" media-type="image/png">00000000</base64>
+            <remarks>
+                <p>Section 9.4, Figure 9-2 Network Diagram (graphic)</p>
+                <p>This should be referenced in the
+                    system-characteristics/network-architecture/diagram/link/@href flag using a
+                    value of "#61081e81-850b-43c1-bf43-1ecbddcb9e7f"</p>
+                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
+                    .</p>
+                <p>FedRAMP prefers <code>base64</code> for images and diagrams.</p>
+                <p>Images must be in sufficient resolution to read all detail when rendered in a
+                    browser via HTML5.</p>
+            </remarks>
+        </resource>
+        <resource uuid="fab59751-b855-40cb-93c1-492562e20e18">
+            <title>Privacy Impact Assessment</title>
+            <prop name="type" ns="https://csrc.nist.gov/ns/blossom"
+                value="privacy-impact-assessment" />
+            <prop name="publication" ns="https://csrc.nist.gov/ns/blossom" value="Document Date" />
+            <prop name="version" value="Document Version" />
+            <rlink href="./documents/pia.docx"
+                media-type="application/vnd.openxmlformats-officedocument.wordprocessingml.document" />
+            <base64 filename="pia.docx"
+                media-type="application/vnd.openxmlformats-officedocument.wordprocessingml.document">
+                00000000</base64>
+            <remarks>
+                <p>Table 15-1 Attachments: Privacy Impact Assessment</p>
+                <p>May use <code>rlink</code> with a relative path, or embedded as <code>base64</code>
+                    .</p>
+            </remarks>
+        </resource>
+    </back-matter>
 </system-security-plan>
\ No newline at end of file

From f45b836b434f9e7c2114e8f244b24dcdaa6e2138 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Fri, 26 Jul 2024 17:21:44 -0400
Subject: [PATCH 31/36] Implement reference user yaml in S3

---
 .../workflows/account_request_approve.yaml    | 57 ++++++++++++++++++-
 .../workflows/account_request_implement.yaml  | 54 ++++--------------
 ato/secops/create_user.py                     | 31 +++++++++-
 3 files changed, 94 insertions(+), 48 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index ddbafb4..93948af 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -23,4 +23,59 @@ jobs:
             Account management request APPROVED by Blossom Management.
             @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.
             When implemented, add the ACCOUNT_IMPLEMENTED label and 
-            link this account request issue to the PR with the implementation.
\ No newline at end of file
+            link this account request issue to the PR with the implementation.
+  create-user:
+    needs: request-approved
+    runs-on: ubuntu-20.04
+    steps:        
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Parse issue body
+        uses: stefanbuck/github-issue-parser@v3.2.1
+        id: issue-parser
+        with:
+          template-path: ".github/ISSUE_TEMPLATE/account_management_request_form.yaml"
+
+      - name: Ensure directory exists for created users
+        run: |
+          mkdir -p ato/oscal-artifacts/created_users/
+      
+      - name: Ensure directory exists for created users references
+        run: |
+          mkdir -p ato/oscal-artifacts/reference_created_users/
+
+      - name: Create yaml file for automated user creation
+        env:
+          USER_NAME: "${{ steps.issue-parser.outputs.issueparser_user-first-name }} ${{ steps.issue-parser.outputs.issueparser_user-last-name }}"
+          USER_EMAIL: ${{ steps.issue-parser.outputs.issueparser_user-email }}
+          USER_ROLE: ${{ steps.issue-parser.outputs.issueparser_account-type }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          python ato/secops/create_user.py --user-name "$USER_NAME" --user-email "$USER_EMAIL" --user-role "$USER_ROLE" --issue-number "$ISSUE_NUMBER"
+
+      - name: Store user yaml in repo
+        run: |
+          git config --global user.name "create-user-action[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH_NAME"
+          git add "ato/oscal-artifacts/created_users/*"
+          git add "ato/oscal-artifacts/reference_created_users/*"
+          git commit -m "Create user request #$ISSUE_NUMBER"
+          git push origin "$BRANCH_NAME"
+        env:
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          BRANCH_NAME: "account-request-${{ github.event.issue.number }}"
+  
+      - name: Configure AWS CLI
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+      
+      - name: Copy reference yaml to bucket
+        run: |
+          aws s3 cp --recursive ato/oscal-artifacts/reference_created_users/ s3://"$AWS_BUCKET"
+        env:
+          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file
diff --git a/.github/workflows/account_request_implement.yaml b/.github/workflows/account_request_implement.yaml
index acd9449..5f300a2 100644
--- a/.github/workflows/account_request_implement.yaml
+++ b/.github/workflows/account_request_implement.yaml
@@ -10,49 +10,15 @@ jobs:
   request-implemented:
     if: github.event.label.name == 'ACCOUNT_IMPLEMENTED'
     runs-on: ubuntu-20.04
-    # permissions:
-    #   issues: write
+    permissions:
+      issues: write
     steps:
-      - name: Checkout repo to access handshake file
-        uses: actions/checkout@v4
-        
-      - name: Parse issue body
-        uses: stefanbuck/github-issue-parser@v3.2.1
-        id: issue-parser
-        with:
-          template-path: ".github/ISSUE_TEMPLATE/account_management_request_form.yaml"
-
-      - name: Ensure directory exists for created users
-        run: |
-          mkdir -p ato/oscal-artifacts/created_users/
-
-      - name: Create yaml file for automated user creation
-        env:
-          USER_NAME: "${{ steps.issue-parser.outputs.issueparser_user-first-name }} ${{ steps.issue-parser.outputs.issueparser_user-last-name }}"
-          USER_EMAIL: ${{ steps.issue-parser.outputs.issueparser_user-email }}
-          USER_ROLE: ${{ steps.issue-parser.outputs.issueparser_account-type }}
-        run: |
-          python ato/secops/create_user.py --user-name "$USER_NAME" --user-email "$USER_EMAIL" --user-role "$USER_ROLE"
-      
-      - name: Configure AWS CLI
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-region: ${{ secrets.AWS_REGION }}
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
-      
-      - name: Copy user yaml to bucket
-        run: |
-          aws s3 cp --recursive ato/oscal-artifacts/created_users/ s3://"$AWS_BUCKET"
+      - name: Notify Blossom Assessors about Implemented Account
+        run: gh issue comment "$NUMBER" --body "$BODY"
         env:
-          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
-        
-      # - name: Notify Blossom Assessors about Implemented Account
-      #   run: gh issue comment "$NUMBER" --body "$BODY"
-      #   env:
-      #     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #     GH_REPO: ${{ github.repository }}
-      #     NUMBER: ${{ github.event.issue.number }}
-      #     BODY: >
-      #       @usnistgov/blossom-assessors An edit to the ACL and/or SSP has been implemented.
-      #       Please monitor the automated assessment.
\ No newline at end of file
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          NUMBER: ${{ github.event.issue.number }}
+          BODY: >
+            @usnistgov/blossom-assessors An edit to the ACL and/or SSP has been implemented.
+            Please monitor the automated assessment.
\ No newline at end of file
diff --git a/ato/secops/create_user.py b/ato/secops/create_user.py
index 8eb237c..1daaab6 100644
--- a/ato/secops/create_user.py
+++ b/ato/secops/create_user.py
@@ -8,7 +8,20 @@
 @click.option('--user-role', required=True, help='Role of user to create')
 @click.option('--location-uuid', help='UUID of physical location of user')
 @click.option('--org-member', help='UUID of organization that user is member of')
-def create_user(user_name, user_email, user_role, location_uuid, org_member):
+@click.option('--issue-number', help='Issue number of user account request')
+def create_user(user_name, user_email, user_role, location_uuid, org_member, issue_number):
+    """
+    Creates a yaml file containing information about a new user
+
+    Args:
+        user_name (string): String containing name of new user
+        user_email (string): String containing email of new user
+        user_role (string): String containing role of new user
+        location_uuid (string): String containing UUID of physical location of user
+        org_member (string): String containing UUID of organization that user is member of
+        issue_number (string): String containing issue number of user account request
+    """
+    
     # Structure of yaml file
     cmd = {
     "command" : "create-acl-user|create-cognito-user",
@@ -23,11 +36,23 @@ def create_user(user_name, user_email, user_role, location_uuid, org_member):
     
     # Include timestamp in filename
     timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    
+    # Write to user yaml file (stored in repo)
     filename = "ato/oscal-artifacts/created_users/created_user_" + timestamp + ".yaml"
-
-    # Write to yaml file
     with open(filename, 'w') as f:
         print(f"\n\n{yaml.safe_dump(cmd, default_flow_style=False)}", file=f)
+        
+    # Structure of yaml file referencing user yaml file
+    reference = {
+        "file": f"{filename}",
+        "issue_number": f"{issue_number}",
+        "branch_name": f"account-request-{issue_number}"
+    }
+    
+    # Write to user reference yaml file (sent to S3)
+    filename_reference = "ato/oscal-artifacts/reference_created_users/reference_created_user_" + timestamp + ".yaml"
+    with open(filename_reference, 'w') as f:
+        print(f"\n\n{yaml.safe_dump(reference, default_flow_style=False)}", file=f)
 
 if __name__ == '__main__':
     create_user()
\ No newline at end of file

From 28f818a0916825b58ccc07f32c2c065ab2bc7ed7 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Tue, 30 Jul 2024 17:12:17 -0400
Subject: [PATCH 32/36] Improve conditionals

---
 .../workflows/account_request_approve.yaml    | 27 ++++++++++++++++---
 .../workflows/account_workflow.md             |  0
 2 files changed, 23 insertions(+), 4 deletions(-)
 rename account_workflow.md => .github/workflows/account_workflow.md (100%)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index 93948af..f58dfa2 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -24,12 +24,23 @@ jobs:
             @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.
             When implemented, add the ACCOUNT_IMPLEMENTED label and 
             link this account request issue to the PR with the implementation.
-  create-user:
+
+  parse-issue:
     needs: request-approved
     runs-on: ubuntu-20.04
+    outputs:
+      account-modification: ${{ steps.issue-parser.outputs.issueparser_account-modification }}
+      user-first-name: ${{ steps.issue-parser.outputs.issueparser_user-first-name }}
+      user-last-name: ${{ steps.issue-parser.outputs.issueparser_user-last-name }}
+      user-email: ${{ steps.issue-parser.outputs.issueparser_user-email }}
+      account-type: ${{ steps.issue-parser.outputs.issueparser_account-type }}
     steps:        
       - name: Checkout repo
         uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            .github/ISSUE_TEMPLATE/account_management_request_form.yaml
+          sparse-checkout-cone-mode: false
 
       - name: Parse issue body
         uses: stefanbuck/github-issue-parser@v3.2.1
@@ -37,6 +48,14 @@ jobs:
         with:
           template-path: ".github/ISSUE_TEMPLATE/account_management_request_form.yaml"
 
+  create-user:
+    needs: parse-issue
+    if: ${{ needs.parse-issue.outputs.account-modification == 'Create' }}
+    runs-on: ubuntu-20.04
+    steps: 
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
       - name: Ensure directory exists for created users
         run: |
           mkdir -p ato/oscal-artifacts/created_users/
@@ -47,9 +66,9 @@ jobs:
 
       - name: Create yaml file for automated user creation
         env:
-          USER_NAME: "${{ steps.issue-parser.outputs.issueparser_user-first-name }} ${{ steps.issue-parser.outputs.issueparser_user-last-name }}"
-          USER_EMAIL: ${{ steps.issue-parser.outputs.issueparser_user-email }}
-          USER_ROLE: ${{ steps.issue-parser.outputs.issueparser_account-type }}
+          USER_NAME: "${{ needs.parse-issue.outputs.user-first-name }} ${{ needs.parse-issue.outputs.user-last-name }}"
+          USER_EMAIL: ${{ needs.parse-issue.outputs.user-email }}
+          USER_ROLE: ${{ needs.parse-issue.outputs.account-type }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           python ato/secops/create_user.py --user-name "$USER_NAME" --user-email "$USER_EMAIL" --user-role "$USER_ROLE" --issue-number "$ISSUE_NUMBER"
diff --git a/account_workflow.md b/.github/workflows/account_workflow.md
similarity index 100%
rename from account_workflow.md
rename to .github/workflows/account_workflow.md

From d18d56376f182116682c57048707fa8b93466ba2 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Wed, 31 Jul 2024 11:41:06 -0400
Subject: [PATCH 33/36] Add username

---
 .../account_management_request_form.yaml      |  7 +++++
 .../workflows/account_request_approve.yaml    | 26 ++++++++++---------
 ato/secops/create_user.py                     |  5 +++-
 3 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/account_management_request_form.yaml b/.github/ISSUE_TEMPLATE/account_management_request_form.yaml
index 096e662..bae6ce9 100644
--- a/.github/ISSUE_TEMPLATE/account_management_request_form.yaml
+++ b/.github/ISSUE_TEMPLATE/account_management_request_form.yaml
@@ -23,6 +23,13 @@ body:
       placeholder: Type here user's email
     validations:
       required: true
+  - type: input
+    id: user-username
+    attributes:
+      label: Account Holder Username
+      placeholder: Type here user's username
+    validations:
+      required: true
   - type: input
     id: requester-name
     attributes:
diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index f58dfa2..63a2f8b 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -32,6 +32,7 @@ jobs:
       account-modification: ${{ steps.issue-parser.outputs.issueparser_account-modification }}
       user-first-name: ${{ steps.issue-parser.outputs.issueparser_user-first-name }}
       user-last-name: ${{ steps.issue-parser.outputs.issueparser_user-last-name }}
+      user-username: ${{ steps.issue-parser.outputs.issueparser_user-username }}
       user-email: ${{ steps.issue-parser.outputs.issueparser_user-email }}
       account-type: ${{ steps.issue-parser.outputs.issueparser_account-type }}
     steps:        
@@ -67,11 +68,12 @@ jobs:
       - name: Create yaml file for automated user creation
         env:
           USER_NAME: "${{ needs.parse-issue.outputs.user-first-name }} ${{ needs.parse-issue.outputs.user-last-name }}"
+          USER_USERNAME: ${{ needs.parse-issue.outputs.user-username }}
           USER_EMAIL: ${{ needs.parse-issue.outputs.user-email }}
           USER_ROLE: ${{ needs.parse-issue.outputs.account-type }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
-          python ato/secops/create_user.py --user-name "$USER_NAME" --user-email "$USER_EMAIL" --user-role "$USER_ROLE" --issue-number "$ISSUE_NUMBER"
+          python ato/secops/create_user.py --user-name "$USER_NAME" --user-username "$USER_USERNAME" --user-email "$USER_EMAIL" --user-role "$USER_ROLE" --issue-number "$ISSUE_NUMBER"
 
       - name: Store user yaml in repo
         run: |
@@ -86,15 +88,15 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           BRANCH_NAME: "account-request-${{ github.event.issue.number }}"
   
-      - name: Configure AWS CLI
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-region: ${{ secrets.AWS_REGION }}
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+      # - name: Configure AWS CLI
+      #   uses: aws-actions/configure-aws-credentials@v4
+      #   with:
+      #     aws-region: ${{ secrets.AWS_REGION }}
+      #     aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
+      #     aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
       
-      - name: Copy reference yaml to bucket
-        run: |
-          aws s3 cp --recursive ato/oscal-artifacts/reference_created_users/ s3://"$AWS_BUCKET"
-        env:
-          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file
+      # - name: Copy reference yaml to bucket
+      #   run: |
+      #     aws s3 cp --recursive ato/oscal-artifacts/reference_created_users/ s3://"$AWS_BUCKET"
+      #   env:
+      #     AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file
diff --git a/ato/secops/create_user.py b/ato/secops/create_user.py
index 1daaab6..32891df 100644
--- a/ato/secops/create_user.py
+++ b/ato/secops/create_user.py
@@ -4,17 +4,19 @@
 
 @click.command()
 @click.option('--user-name', required=True, help='Name of user to create')
+@click.option('--user-username', required=True, help='Name of user to create')
 @click.option('--user-email', required=True, help='Email of user to create')
 @click.option('--user-role', required=True, help='Role of user to create')
 @click.option('--location-uuid', help='UUID of physical location of user')
 @click.option('--org-member', help='UUID of organization that user is member of')
 @click.option('--issue-number', help='Issue number of user account request')
-def create_user(user_name, user_email, user_role, location_uuid, org_member, issue_number):
+def create_user(user_name, user_username, user_email, user_role, location_uuid, org_member, issue_number):
     """
     Creates a yaml file containing information about a new user
 
     Args:
         user_name (string): String containing name of new user
+        user_username (string): String containing username of new user
         user_email (string): String containing email of new user
         user_role (string): String containing role of new user
         location_uuid (string): String containing UUID of physical location of user
@@ -27,6 +29,7 @@ def create_user(user_name, user_email, user_role, location_uuid, org_member, iss
     "command" : "create-acl-user|create-cognito-user",
     "user" : {
         "name" : f"{user_name}",
+        "username" : f"{user_username}",
         "email-address":f"{user_email}",
         "role":f"{user_role}",
         "location-uuid":f"{location_uuid}",

From 8a1ff9c6a4515e05e21264f5fac7a427bcfbae08 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Wed, 31 Jul 2024 12:19:17 -0400
Subject: [PATCH 34/36] Clean up

---
 .../workflows/account_request_approve.yaml    | 22 +++++++++----------
 .../workflows/account_request_assessment.yaml |  7 +++---
 .github/workflows/account_workflow.md         |  7 ++++--
 3 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index 63a2f8b..7b54927 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -88,15 +88,15 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           BRANCH_NAME: "account-request-${{ github.event.issue.number }}"
   
-      # - name: Configure AWS CLI
-      #   uses: aws-actions/configure-aws-credentials@v4
-      #   with:
-      #     aws-region: ${{ secrets.AWS_REGION }}
-      #     aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
-      #     aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
+      - name: Configure AWS CLI
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY }}
       
-      # - name: Copy reference yaml to bucket
-      #   run: |
-      #     aws s3 cp --recursive ato/oscal-artifacts/reference_created_users/ s3://"$AWS_BUCKET"
-      #   env:
-      #     AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file
+      - name: Copy reference yaml to bucket
+        run: |
+          aws s3 cp --recursive ato/oscal-artifacts/reference_created_users/ s3://"$AWS_BUCKET"
+        env:
+          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file
diff --git a/.github/workflows/account_request_assessment.yaml b/.github/workflows/account_request_assessment.yaml
index de52e40..2384b60 100644
--- a/.github/workflows/account_request_assessment.yaml
+++ b/.github/workflows/account_request_assessment.yaml
@@ -12,10 +12,9 @@ jobs:
   if_merged:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-20.04
-    permissions:
-      issues: write
+#     permissions:
+#       issues: write
     steps:
     - name: Run automated assessment
       run: echo "assessment"
-      # 1. dump empty file to s3 bucket, to initiate connection
-      # 2. query chaincode, code to execute on chaincode for list of supported roles, API command
+      # query chaincode, code to execute on chaincode for list of supported roles, API command
diff --git a/.github/workflows/account_workflow.md b/.github/workflows/account_workflow.md
index df4dfa6..ac07e57 100644
--- a/.github/workflows/account_workflow.md
+++ b/.github/workflows/account_workflow.md
@@ -7,8 +7,11 @@ This document explains the workflow of GitHub actions used to automate Blossom s
 - [ ] The Blossom Management group is automatically notified to review the request through GitHub.
 - [ ] One of the Blossom Management (a member of the Blossom Management group) reviews the request and adds a new label to the issue: ACCOUNT_APPROVED or ACCOUNT_REJECTED
 - [ ] If ACCOUNT_REJECTED, the account request issue is automatically closed.
-- [ ] If the account is approved and the label ACCOUNT_APPROVED is added, the Blossom Sysdevs group is automatically notified to implement the account.
-- [ ] Upon completion of creating the account requested, the Blossom Sysdev links the Account Request issue to the Pull Request that implements the account.
+- [ ] If the account is approved and the label ACCOUNT_APPROVED is added, the Blossom Sysdevs group is automatically notified about implementation.
+- [ ] A YAML file is automatically created from information submitted through the Account Request Form, which is pushed to the GitHub repo as a new branch and a condensed version is sent to S3 bucket.
+- [ ] S3 bucket receives the file about the new user to create and sends a trigger to EC2, which implements the new user in Cognito, SSM, ACL, AMB as necessary.
+- [ ] The new user is inserted into the SSP, which is pushed into the GitHub repo to the new branch.
+- [ ] Upon completion of creating the account requested, a Pull Request is automatically created, to link the branch with the Account Request issue.
 - [ ] Upon merging the Pull Request that implements the account, the relevant updated controls are re-assessed automatically. The Blossom Assessors group is then notified to monitor the automated assessment.
 - [ ] TBD: STEPS FOR AUTOMATED ASSESSMENT
 

From 0034903036f670c443e97ab2d9472730cd9918b3 Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Fri, 9 Aug 2024 12:07:42 -0400
Subject: [PATCH 35/36] Clarify requirements to run workflows

---
 .github/workflows/account_request_approve.yaml | 2 +-
 .github/workflows/account_workflow.md          | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index 7b54927..0e1a953 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -21,7 +21,7 @@ jobs:
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
             Account management request APPROVED by Blossom Management.
-            @usnistgov/blossom-sysdevs please implement by updating the ACL and the SSP.
+            @usnistgov/blossom-sysdevs please review the automated update to the ACL and/or SSP and user modification in AWS.
             When implemented, add the ACCOUNT_IMPLEMENTED label and 
             link this account request issue to the PR with the implementation.
 
diff --git a/.github/workflows/account_workflow.md b/.github/workflows/account_workflow.md
index ac07e57..a664e6d 100644
--- a/.github/workflows/account_workflow.md
+++ b/.github/workflows/account_workflow.md
@@ -2,6 +2,10 @@
 
 This document explains the workflow of GitHub actions used to automate Blossom service's accounts management.
 
+## Requirements to run Actions
+- [ ] Repository secrets: AWS_ACCESS_KEY, AWS_SECRET_KEY, AWS_REGION, AWS_BUCKET
+- [ ] Issue labels: ACCOUNT_REQUEST_RECORD, ACCOUNT_APPROVED, ACCOUNT_REJECTED, ACCOUNT_IMPLEMENTED
+
 ## Account Request and Creation
 - [ ] The requester requests an account for the Account Holder by creating a new GitHub issue using the Account Request Form.
 - [ ] The Blossom Management group is automatically notified to review the request through GitHub.

From 2f5d5c9ebc86f54ff041e76935a96c6af4b325df Mon Sep 17 00:00:00 2001
From: selenaxiao-nist <selena.xiao@nist.gov>
Date: Fri, 9 Aug 2024 12:55:53 -0400
Subject: [PATCH 36/36] Update account_request_approve.yaml

---
 .github/workflows/account_request_approve.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/account_request_approve.yaml b/.github/workflows/account_request_approve.yaml
index 0e1a953..5714bb0 100644
--- a/.github/workflows/account_request_approve.yaml
+++ b/.github/workflows/account_request_approve.yaml
@@ -21,7 +21,7 @@ jobs:
           NUMBER: ${{ github.event.issue.number }}
           BODY: >
             Account management request APPROVED by Blossom Management.
-            @usnistgov/blossom-sysdevs please review the automated update to the ACL and/or SSP and user modification in AWS.
+            @usnistgov/blossom-sysdevs please ensure the ACL and/or Cognito are updated and the SSP is in sync with the update.
             When implemented, add the ACCOUNT_IMPLEMENTED label and 
             link this account request issue to the PR with the implementation.
 
@@ -99,4 +99,4 @@ jobs:
         run: |
           aws s3 cp --recursive ato/oscal-artifacts/reference_created_users/ s3://"$AWS_BUCKET"
         env:
-          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}
\ No newline at end of file
+          AWS_BUCKET: ${{ secrets.AWS_BUCKET }}