How to import/use FedRAMP OSCAL Baseline Profile into a Project?

[gponto]

Our team is looking to make use of GovReady-Q to a document and deliver a FedRAMP SSP based on the recent template published by FedRAMP.gov here:

• FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.json (https://github.com/GSA/fedramp-automation/blob/master/dist/content/baselines/rev4/json/FedRAMP_rev4_MODERATE-baseline_profile.json)

Is there any way to import this baseline into a Project?

[davidpofo]

@gponto This isn't detailed in our docs however it is mildly detailed in the CHANGELOG.md under the v0.9.3.4 (April 20, 2021) heading.
Two steps really: that is to say you actually need this catalog json for fedramp rev4 moderate in catalogs subdirectory unfortunately but you can put your external OSCAL catalog json ~/govready-q/local/controls/data/catalogs/<json_file>. For the baseline file you would need to create a baselines.json file similar to the ones found in govready-q's controls/data/baselines that has a list for all controls that are in low/moderate/high for the given catalog this baselines.json file would then live in ~/govready-q/local/controls/data/baselines/<json_file>. I'll formally add this to the documentation thanks for asking!

[gponto]

@davidpofo Thank you for your detailed response and guidance. I am attempting to follow your directions to the letter using the v0.9.6-dev build, but I've run into a problem. I've done the following:

Steps Followed

1. Copied FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.json to /opt/govready-q/local/controls/data/catalogs/FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.json
2. Created baselines.json shown below & stored it within /opt/govready-q/local/controls/data/baselines/baselines.json

{
    "moderate" : {
        "controls": 
            ["ac-1", "ac-2", "ac-2.1", "ac-2.2", "ac-2.3", "ac-2.4", "ac-2.5", "ac-2.7", "ac-2.9", "ac-2.10", "ac-2.12", "ac-3", "ac-4", "ac-4.21", "ac-5", "ac-6", "ac-6.1", "ac-6.2", "ac-6.5", "ac-6.9", "ac-6.10", "ac-7", "ac-8", "ac-10", "ac-11", "ac-11.1", "ac-12", "ac-14", "ac-17", "ac-17.1", "ac-17.2", "ac-17.3", "ac-17.4", "ac-17.9", "ac-18", "ac-18.1", "ac-19", "ac-19.5", "ac-20", "ac-20.1", "ac-20.2", "ac-21", "ac-22", "at-1", "at-2", "at-2.2", "at-3", "at-4", "au-1", "au-2", "au-2.3", "au-3", "au-3.1", "au-4", "au-5", "au-6", "au-6.1", "au-6.3", "au-7", "au-7.1", "au-8", "au-8.1", "au-9", "au-9.2", "au-9.4", "au-11", "au-12", "ca-1", "ca-2", "ca-2.1", "ca-2.2", "ca-2.3", "ca-3", "ca-3.3", "ca-3.5", "ca-5", "ca-6", "ca-7", "ca-7.1", "ca-8", "ca-8.1", "ca-9", "cm-1", "cm-2", "cm-2.1",  "cm-2.2", "cm-2.3", "cm-2.7", "cm-3", "cm-4", "cm-5", "cm-5.1", "cm-5.3", "cm-5.5", "cm-6", "cm-6.1", "cm-7", "cm-7.1", "cm-7.2", "cm-7.5", "cm-8", "cm-8.1", "cm-8.3", "cm-8.5", "cm-9", "cm-10", "cm-10.1", "cm-11", "cp-1", "cp-2", "cp-2.1", "cp-2.2", "cp-2.3", "cp-2.8", "cp-3", "cp-4", "cp-4.1", "cp-6", "cp-6.1", "cp-6.3", "cp-7", "cp-7.1", "cp-7.2", "cp-7.3", "cp-8", "cp-8.1", "cp-8.2", "cp-9", "cp-9.1", "cp-9.3", "cp-10", "cp-10.2", "ia-1", "ia-2", "ia-2.1", "ia-2.2", "ia-2.3", "ia-2.5", "ia-2.8", "ia-2.11", "ia-2.12", "ia-3", "ia-4", "ia-4.4", "ia-5", "ia-5.1", "ia-5.2", "ia-5.3", "ia-5.4", "ia-5.6", "ia-5.7", "ia-5.11", "ia-6", "ia-7", "ia-8", "ia-8.1", "ia-8.2", "ia-8.3", "ia-8.4", "ir-1", "ir-2", "ir-3", "ir-3.2", "ir-4", "ir-4.1", "ir-5", "ir-6", "ir-6.1", "ir-7", "ir-7.1", "ir-7.2", "ir-8", "ir-9", "ir-9.1", "ir-9.2", "ir-9.3", "ir-9.4", "ma-1", "ma-2", "ma-3", "ma-3.1", "ma-3.2", "ma-3.3", "ma-4", "ma-4.2", "ma-5", "ma-5.1", "ma-6", "mp-1", "mp-2", "mp-3", "mp-4", "mp-5", "mp-5.4", "mp-6", "mp-6.2", "mp-7", "mp-7.1", "pe-1", "pe-2", "pe-3", "pe-4", "pe-5", "pe-6", "pe-6.1", "pe-8", "pe-9", "pe-10", "pe-11", "pe-12", "pe-13", "pe-13.2", "pe-13.3", "pe-14", "pe-14.2", "pe-15", "pe-16", "pe-17", "pl-1", "pl-2", "pl-2.3", "pl-4", "pl-4.1", "pl-8", "ps-1", "ps-2", "ps-3", "ps-3.3", "ps-4", "ps-5", "ps-6", "ps-7", "ps-8", "ra-1", "ra-2", "ra-3", "ra-5", "ra-5.1", "ra-5.2", "ra-5.3", "ra-5.5", "ra-5.6", "ra-5.8", "sa-1", "sa-2", "sa-3", "sa-4", "sa-4.1", "sa-4.2", "sa-4.8", "sa-4.9", "sa-4.10", "sa-5", "sa-8", "sa-9", "sa-9.1", "sa-9.2", "sa-9.4", "sa-9.5", "sa-10", "sa-10.1", "sa-11", "sa-11.1", "sa-11.2", "sa-11.8", "sc-1", "sc-2", "sc-4", "sc-5", "sc-6", "sc-7", "sc-7.3", "sc-7.4", "sc-7.5", "sc-7.7", "sc-7.8", "sc-7.12", "sc-7.13", "sc-7.18", "sc-8", "sc-8.1", "sc-10", "sc-12", "sc-12.2", "sc-12.3", "sc-13", "sc-15", "sc-17", "sc-18", "sc-19", "sc-20", "sc-21", "sc-22", "sc-23", "sc-28", "sc-28.1", "sc-39", "si-1", "si-2", "si-2.2", "si-2.3", "si-3", "si-3.1", "si-3.2", "si-3.7", "si-4", "si-4.1", "si-4.2", "si-4.4", "si-4.5", "si-4.14", "si-4.16", "si-4.23", "si-5", "si-6", "si-7", "si-7.1", "si-7.7", "si-8", "si-8.1", "si-8.2", "si-10", "si-11", "si-12", "si-16"]
        }
}

Error Message

Upon doing this, when I access the "CONTROLS" menu item (or any area of GovReady-Q) that renders CONTROLS, I am met with a 500 Server Error message:

Other troubleshooting

• I've also tried storing the baselines.json as /opt/govready-q/local/controls/data/catalogs/FedRAMP_rev4_MODERATE-baseline-resolved-profile_baselines.json to no avail, same 500 Server Error message.

• I've also tail -f /var/log/gunicorn.error.log, but no logs appear beyond the startup logs.

• Did I misinterpret your guidance?

• Is there a log I could look at that might provide more insight as to what might be wrong?

[gponto]

I took another stab at this using https://github.com/GovReady/govready-q/blob/main/fixtures/test_baseline.json and https://github.com/GovReady/govready-q/blob/main/fixtures/test_catalog.json and found that I can see the "test" Catalog and its controls under GovReady-Q > Controls. However, when I attempt to add any of the "test" control baselines to a Blank Project, I run into another Server Error (500). Accordingly, I have logged this is a bug here:

#1664

[davidpofo]

Sorry I got back to you so late. Great catch just missed an s in the naming of that test fixture. test baseline json file should be test_baselines.json not test_baseline.json` Will address this in the release. If you want to get ahead just add an s to the file name. @gponto

[davidpofo]

@gponto were you able to successfully add your custom catalog/baseline? I found that if you don't have the low and high keys it will error out 500 like you described above. So I would just make empty lists for those key's control key.

[gponto]

@davidpofo - I can confirm that appending s to test_baseline.json making it test_baselines.json does allow us to import your test catalog (https://github.com/GovReady/govready-q/blob/main/fixtures/test_catalog.json). So this effectively resolves the bug logged here: #1664.

For reference, the test_baselines.json I used looks like this:

{
    "low" : {
        "controls":
            ["ac-1"]
        },
    "moderate" : {
        "controls":
            ["ac-1", "ac-2"]
        },
    "high" : {
        "controls":
            ["ac-1", "ac-2", "ac-3"]
        }
}

However, using the exact same workflow, naming convention, and the same test_baselines.json file, which again looks like this:

{
    "low" : {
        "controls":
            ["ac-1"]
        },
    "moderate" : {
        "controls":
            ["ac-1", "ac-2"]
        },
    "high" : {
        "controls":
            ["ac-1", "ac-2", "ac-3"]
        }
}

, I cannot import FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.json, even if I name this file test_catalog.json. Accordingly I logged this as a different bug here: #1665

My guess as to the root cause of issue #1665 is a parsing issue with the latest ("oscal-version": "1.0.0") that FedRAMP_rev4_MODERATE-baseline-resolved-profile_catalog.json uses, which has changed from the ("oscal-version": "1.0.0-milestone3") that test_catalog.json uses.