Does OSCAL need a FAQ page?

[wendellpiez]

There are two questions here:

• Do OSCAL newcomers and users have frequently asked questions (actual or supposed) that would benefit from a FAQ page?
• Assuming the answer is yes, is this something to expedite (prioritize) and if so, how/where? maintenance model etc.

General discussion is welcome, and so are particular FAQs if readers have any to nominate.

A link to discussion and possible guidance regarding IDs and UUIDs in OSCAL has been mentioned as something that could address a question that is frequently asked.

But a dead FAQ page is worse than no FAQ page. We need a concept of how to curate this. (Maybe it should be a community thing, etc.)

[aj-stein-nist]

Yes, I think we do need a process for receiving FAQs and answers. I am going to propose a lightweight process for now, subject to change.

1. Anyone can post a question here in the discussions with the Q&A category.
2. One or more answers are provided.
3. A NIST staff member and repo maintainer will accept the official answer.
4. All NIST staff and community members can vote up a question or answer at any given time.
5. For questions, before or after receiving an officially endorsed answer in 3, that have a significant upvote count will be considered for inclusion into a to be determined FAQ page on pages.nist.gov/OSCAL.

Again, this is subject to change, but I think this is a good idea worth formalizing. Thanks for asking.

[iMichaela]

@aj-stein-nist - I like the proposed process. Where I see we need to add clarifications is 3). I wonder how will we proceed if the answers provided by the community are different than NIST's answers (e.g. if we have questions like the document's uuid). From your process, I understand we will adopt, as offical answer, the one voted 👍 the most. I like it, but I would like a confirmation this is what you proposed.

[aj-stein-nist]

I wonder how will we proceed if the answers provided by the community are different than NIST's answers.

We can choose to endorse an answer, sometimes it may be less popular, but it will be the officially correct one. That said, over time or later as more details emerge, nothing stops us from switching the endorsed one answer back and forth from a NIST answer to a community one, or vice versa.

Does that help explain the thought process?

[wendellpiez]

@iMichaela additionally, it is worth mentioning that some of our answers will not be along the lines of recommendations so much as statements of who is responsible or who has scope to design and deploy solutions, how 'mandatory' is an approach, etc.

In particular, I feel we should hesitate to make rules with no mechanisms for enforcement other than an honor system. :-) But we can certainly describe how an organization, or partners in exchange, might help themselves with rules that they could follow and whose regularities they could then leverage.

One thing that a FAQ can be useful for is as a road map to a problem space. This will take a while....