Add implementation-status-has-remarks Constraint

features/fedramp_extensions.feature

@@ -97,6 +97,7 @@ Examples:
   | has-system-id |
   | has-system-name-short |
   | has-user-guide |
+  | implementation-status-has-remarks |
   | import-profile-has-available-document |
   | import-profile-resolves-to-fedramp-content |
   | incomplete-implemented-requirements |
@@ -314,6 +315,8 @@ Examples:
   | has-system-name-short-PASS.yaml |
   | has-user-guide-FAIL.yaml |
   | has-user-guide-PASS.yaml |
+  | implementation-status-has-remarks-FAIL.yaml |
+  | implementation-status-has-remarks-PASS.yaml |
   | import-profile-has-available-document-FAIL.yaml |
   | import-profile-has-available-document-PASS.yaml |
   | import-profile-resolves-to-fedramp-content-FAIL.yaml |

src/validations/constraints/content/ssp-implementation-status-has-remarks-INVALID.xml

@@ -0,0 +1,15 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="11111111-2222-4000-8000-000000000000">
+  <control-implementation>
+    <implemented-requirement uuid="11111111-2222-4000-8000-012000000001" control-id="ac-1">
+      <statement statement-id="ac-1_smt.a.1" uuid="11111111-2222-4000-8000-013000000001">
+        <by-component component-uuid="11111111-2222-4000-8000-009000000000" uuid="11111111-2222-4000-8000-014000000001">
+          <implementation-status state="planned"/>
+          <!-- <remarks>
+            <p>The specified component is the system itself.</p>
+            <p>Any control implementation response that can not be associated with another component is associated with the component representing the system.</p>
+          </remarks> Implementation status is not "implemented", therefore it is missing remarks to provide context. -->
+        </by-component>
+      </statement>
+    </implemented-requirement>
+  </control-implementation>
+</system-security-plan>

src/validations/constraints/fedramp-external-constraints.xml

@@ -646,6 +646,17 @@
         </constraints>
     </context>
 
+    <context>
+        <metapath target="/system-security-plan/control-implementation/implemented-requirement/statement/by-component"/>
+        <constraints>
+            <expect id="implementation-status-has-remarks" target="implementation-status[@state=('partial', 'planned', 'alternative', 'not-applicable' )]" test="exists(remarks)" level="ERROR">
+                <formal-name>Implementation Status Has Remarks</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/6-security-controls/#implementation-status"/>
+                <message>In a FedRAMP SSP, each by-component that is not implemented MUST have remarks to provide context.</message>
+            </expect>
+        </constraints>
+    </context>
+
     <context>
         <metapath target="/system-security-plan/system-characteristics/authorization-boundary/diagram/link"/>
         <constraints>

src/validations/constraints/unit-tests/implementation-status-has-remarks-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for implementation-status-has-remarks
+  description: >-
+    This test case validates the behavior of constraint
+    implementation-status-has-remarks
+  content: ../content/ssp-implementation-status-has-remarks-INVALID.xml
+  expectations:
+    - constraint-id: implementation-status-has-remarks
+      result: fail

src/validations/constraints/unit-tests/implementation-status-has-remarks-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for implementation-status-has-remarks
+  description: >-
+    This test case validates the behavior of constraint
+    implementation-status-has-remarks
+  content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml
+  expectations:
+    - constraint-id: implementation-status-has-remarks
+      result: pass