From b848c5b08c09fed786af5b3d0067d5d7ac456d36 Mon Sep 17 00:00:00 2001 From: Gabeblis Date: Mon, 23 Dec 2024 15:01:41 +0000 Subject: [PATCH] Fix control-implementation-status constraint --- .../ssp/xml/fedramp-ssp-example.oscal.xml | 8 +- ...-control-implementation-status-INVALID.xml | 2 +- ...sp-control-implementation-status-VALID.xml | 627 ------------------ .../fedramp-external-allowed-values.xml | 12 +- .../control-implementation-status-PASS.yaml | 2 +- 5 files changed, 12 insertions(+), 639 deletions(-) delete mode 100644 src/validations/constraints/content/ssp-control-implementation-status-VALID.xml diff --git a/src/content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml b/src/content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml index 90403e53f..dfad612b1 100644 --- a/src/content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml +++ b/src/content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml @@ -2485,7 +2485,7 @@ SSP authors must add implmentations for all required controls. - + 11111111-0000-4000-9000-000000000001 @@ -2500,7 +2500,7 @@ SSP authors must add implmentations for all required controls.

Component approach. This links to a component representing the Identity Management and Access Control Policy.

That component contains a link to the policy, so it does not have to be linked here too.

- + 11111111-0000-4000-9000-000000000001 @@ -2543,7 +2543,7 @@ SSP authors must add implmentations for all required controls.

Describe how Part b-1 is satisfied.

 - + 11111111-0000-4000-9000-000000000001 @@ -2553,7 +2553,7 @@ SSP authors must add implmentations for all required controls.

Describe how Part b-2 is satisfied.

 - + 11111111-0000-4000-9000-000000000001 diff --git a/src/validations/constraints/content/ssp-control-implementation-status-INVALID.xml b/src/validations/constraints/content/ssp-control-implementation-status-INVALID.xml index 2cb6b2176..ffeccd0af 100644 --- a/src/validations/constraints/content/ssp-control-implementation-status-INVALID.xml +++ b/src/validations/constraints/content/ssp-control-implementation-status-INVALID.xml @@ -7,7 +7,7 @@ - + diff --git a/src/validations/constraints/content/ssp-control-implementation-status-VALID.xml b/src/validations/constraints/content/ssp-control-implementation-status-VALID.xml deleted file mode 100644 index 05d4246bf..000000000 --- a/src/validations/constraints/content/ssp-control-implementation-status-VALID.xml +++ /dev/null @@ -1,627 +0,0 @@ - - - - Enhanced Example System Security Plan - 2024-08-01T14:30:00Z - 2024-08-01T14:30:00Z - 1.1 - 1.1.2 - SSP-2024-002 - - - - Authorizing Official - -

Senior official with authority to formally assume responsibility for operating a system at an acceptable level of risk.

- - - - Prepared By - -

This party prepared the SSP.

- - - - Prepared For - -

The organization for which this SSP was prepared. Typically the CSP.

- - - - Document Creator - - - Content Approver - - - System Administrator - - - Asset Owner - - - System Owner - - - Authorizing Official Point of Contact - - - Information System Security Officer (or Equivalent) - - - Information System Management Point of Contact (POC) - -

The highest level manager who is responsible for system operation on behalf of the System Owner.

- - - - Information System Technical Point of Contact - -

The individual or individuals leading the technical operation of the system.

- - - - General Point of Contact (POC) - -

A general point of contact for the system, designated by the system owner.

- - - - - CSP HQ -
- Suite 0000 - 1234 Some Street - Haven - ME - 00000 - US -
- - -
- US -
- - - -
- US -
- - - - Person Name 1 - - - name@example.com - 2020000001 - 27b78960-59ef-4619-82b0-ae20b9c709ac - 6b286b5d-8f07-4fa7-8847-1dd0d88f73fb - - - Cloud Service Provider (CSP) Name - CSP Acronym/Short Name - - 27b78960-59ef-4619-82b0-ae20b9c709ac - - - Example Organization - ExOrg - - - - Jane Doe - jane.doe@example.com -
- - - - 3360e343-9860-4bda-9dfc-ff427c3dfab6 - - - 6b286b5d-8f07-4fa7-8847-1dd0d88f73fb - - - 11111111-0000-4000-9000-000000000001 - - - 22222222-0000-4000-9000-000000000002 - - - - 22222222-0000-4000-9000-000000000002 - - - 22222222-0000-4000-9000-000000000002 - - - 22222222-0000-4000-9000-000000000002 - - - 22222222-0000-4000-9000-000000000002 - - - 22222222-0000-4000-9000-000000000002 - - - 22222222-0000-4000-9000-000000000002 - - - 22222222-0000-4000-9000-000000000002 - - - -

This SSP is an example for demonstration purposes.

- - - - - - - F00000001 - Enhanced Example System - System's Short Name or Acronym - -

This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.

- - - -

Remarks are required if deployment model is "hybrid-cloud" or "other". Optional otherwise.

- - - - -

Remarks are required if service model is "other". Optional otherwise.

- - - - - - - - fips-199-moderate - - - Financial Information - -

Contains sensitive financial data related to organizational operations.

- - - C.2.8.12 - - - fips-199-high - fips-199-high - - - - fips-199-moderate - fips-199-low - -

Required if the base and selected values do not match.

- - - - fips-199-high - fips-199-low - -

Required if the base and selected values do not match.

- - - - - - fips-199-moderate - fips-199-moderate - fips-199-moderate - - - - -

The authorization boundary includes all components within the main data center and the disaster recovery site.

- - - -

A diagram-specific explanation.

- - - Authorization Boundary Diagram - - - - -

A holistic, top-level explanation of the network architecture.

- - - -

A diagram-specific explanation.

- - - Network Diagram - - - - -

A holistic, top-level explanation of the system's data flows.

- - - -

A diagram-specific explanation.

- - - Data Flow Diagram - - - - - - - - GovCloud - - - - - f0bc13a4-3303-47dd-80d3-380e159c8362 - 2015-01-01 - -

Use one leveraged-authorization assembly for each underlying system. In the legacy world, these may be general support systems.

-

The link fields are optional, but preferred when known. Often, a leveraging system's SSP author will not have access to the leveraged system's SSP, but should have access to the leveraged system's CRM.

- - - - - System Administrator - - - - system-admin - - Admin -

admin user

 - administration - - - - - Primary Application Server - -

Main application server hosting the core system functionality.

- - main line - - - 11111111-0000-4000-9000-000000000001 - - -

This is the primary application server for the system.

- - - - Firebase CLI Connection - -

CLI for updating firebase Secure connection to an external API for data enrichment.

- - - -

Some description of the authentication method.

- - - - - - - - - - 11111111-0000-4000-9000-000000000001 - - -

This connection is used for secure data exchange with external systems.

- - - - An External Leveraged System - -

An external leveraged system.

- - - - - - -

Some description of the external authentication method.

- - - - - 11111111-0000-4000-9000-000000000001 - - - 11111111-0000-4000-9000-000000000001 - - - - - - - - External API Connection - -

Secure connection to an external API for data enrichment.

- - - - - - - - - -

Some description of the authentication method.

- - - - - 11111111-0000-4000-9000-000000000001 - - - 11111111-0000-4000-9000-000000000001 - - -

This connection is used for secure data exchange with external systems.

- - - - - Name of External System - -

Briefly describe the external system.

- - - - - - - - -

Some description of the authentication method.

- - - - - 11111111-0000-4000-9000-000000000001 - - - 11111111-0000-4000-9000-000000000001 - - - - - -

Primary database server

- - - - - - - - - 11111111-0000-4000-9000-000000000001 - - - - - - - - -

Secondary database server

- - - - - - - - - 11111111-0000-4000-9000-000000000001 - - - - - - - - - - -

Implementation of controls for the Enhanced Example System

- - - - - - - -

Access Control Policy and Procedures (AC-1) is fully implemented in our system.

- - - - 11111111-0000-4000-9000-000000000001 - - - - - - - - - - -

Information System Component Inventory (CM-8) is partially implemented.

- - - - 11111111-0000-4000-9000-000000000001 - - - - - - - - - Access Control Policy - -

Detailed access control policy document

- - - - - - User's Guide - -

User's Guide

- - - - - -

Table 12-1 Attachments: User's Guide Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Rules of Behavior

- - - - - - 00000000 - -

Table 12-1 Attachments: Rules of Behavior (ROB)

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Contingency Plan (CP)

- - - - - - 00000000 - -

Table 12-1 Attachments: Contingency Plan (CP) Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Configuration Management (CM) Plan

- - - - - - 00000000 - -

Table 12-1 Attachments: Configuration Management (CM) Plan Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Document Title - -

Incident Response (IR) Plan

- - - - - - 00000000 - -

Table 12-1 Attachments: Incident Response (IR) Plan Attachment

-

May use rlink with a relative path, or embedded as base64.

- - - - Separation of Duties Matrix - -

Separation of Duties Matrix

- - - - - - 00000000 - -

May use rlink with a relative path, or embedded as base64.

- - - - - Boundary Diagram - -

The primary authorization boundary diagram.

- - - - 00000000 - -

Section 8.1, Figure 8-1 Authorization Boundary Diagram (graphic)

-

This should be referenced in the system-characteristics/authorization-boundary/diagram/link/@href flag using a value of "#11111111-2222-4000-8000-001000000054"

-

May use rlink with a relative path, or embedded as base64.

-

FedRAMP prefers base64 for images and diagrams.

-

Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.

- - - - - Network Diagram - -

The primary network diagram.

- - - - - 00000000 - -

Section 8.1, Figure 8-2 Network Diagram (graphic)

-

This should be referenced in the system-characteristics/network-architecture/diagram/link/@href flag using a value of "#11111111-2222-4000-8000-001000000055"

-

May use rlink with a relative path, or embedded as base64.

-

FedRAMP prefers base64 for images and diagrams.

-

Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.

- - - - - Data Flow Diagram - -

The primary data flow diagram.

- - - - 00000000 - -

Section 8.1, Figure 8-3 Data Flow Diagram (graphic)

-

This should be referenced in the system-characteristics/data-flow/diagram/link/@href flag using a value of "#11111111-2222-4000-8000-001000000056"

-

May use rlink with a relative path, or embedded as base64.

-

FedRAMP prefers base64 for images and diagrams.

-

Images must be in sufficient resolution to read all detail when rendered in a browser via HTML5.

- - - - \ No newline at end of file diff --git a/src/validations/constraints/fedramp-external-allowed-values.xml b/src/validations/constraints/fedramp-external-allowed-values.xml index 762dc6eac..43cfd8e9e 100644 --- a/src/validations/constraints/fedramp-external-allowed-values.xml +++ b/src/validations/constraints/fedramp-external-allowed-values.xml @@ -107,14 +107,14 @@ A physical or virtual network. - + Control Implementation Status The implementation status of the control. - Implemented - Partially Implemented - Planned - Alternative Implementation - Not Applicable + The control is fully implemented. + The control is partially implemented. + There is a plan for implementing the control as explained in the remarks. + There is an alternative implementation for this control as explained in the remarks. + This control does not apply to this system as justified in the remarks. diff --git a/src/validations/constraints/unit-tests/control-implementation-status-PASS.yaml b/src/validations/constraints/unit-tests/control-implementation-status-PASS.yaml index bba1c533e..efc00d188 100644 --- a/src/validations/constraints/unit-tests/control-implementation-status-PASS.yaml +++ b/src/validations/constraints/unit-tests/control-implementation-status-PASS.yaml @@ -2,7 +2,7 @@ test-case: name: The valid control implementation status test. description: Test that the specified control implementation status is valid. - content: ../content/ssp-control-implementation-status-VALID.xml + content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml expectations: - constraint-id: control-implementation-status result: pass \ No newline at end of file