Skip to content

Commit 95603a4

Browse files
aj-stein-gsaaj-stein-gsa
authored
Adjust missing-response-components, warn on misplaced response components (#969)
1 parent d8267e3 commit 95603a4

9 files changed

+94
-26
lines changed

‎features/fedramp_extensions.feature

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ Examples:
116116
| leveraged-authorization-has-valid-impact-level |
117117
| leveraged-authorization-nature-of-agreement |
118118
| marking |
119+
| misplaced-response-components |
119120
| missing-response-components |
120121
| network-component-has-connection-security-prop |
121122
| network-component-has-implementation-point |
@@ -347,6 +348,8 @@ Examples:
347348
| leveraged-authorization-nature-of-agreement-PASS.yaml |
348349
| marking-FAIL.yaml |
349350
| marking-PASS.yaml |
351+
| misplaced-response-components-FAIL.yaml |
352+
| misplaced-response-components-PASS.yaml |
350353
| missing-response-components-FAIL.yaml |
351354
| missing-response-components-PASS.yaml |
352355
| network-component-has-connection-security-prop-FAIL.yaml |

‎src/validations/constraints/content/ssp-control-implementation-status-INVALID.xml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@
55
uuid="12345678-1234-4321-8765-123456789012">
66
<control-implementation>
77
<implemented-requirement uuid="88888888-0000-4000-9000-000000000008" control-id="ac-1">
8-
<by-component component-uuid="55555555-0000-4000-9000-000000000005" uuid="aaaaaaaa-0000-4000-9000-00000000000a">
9-
<prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="unsupported-status"/>
10-
</by-component>
8+
<statement statement-id="ac-1_stmt.a" uuid="99999999-0000-4000-9000-000000000009">
9+
<by-component component-uuid="55555555-0000-4000-9000-000000000005" uuid="aaaaaaaa-0000-4000-9000-00000000000a">
10+
<prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="unsupported-status"/>
11+
</by-component>
12+
</statement>
1113
</implemented-requirement>
1214
</control-implementation>
13-
</system-security-plan>
15+
</system-security-plan>

‎src/validations/constraints/content/ssp-control-implementation-status-VALID.xml

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,8 @@
358358
<prop name="connection-security" value="vpn" ns="https://fedramp.gov/ns/oscal"/>
359359
<prop name="interconnection-security" value="vpn" ns="https://fedramp.gov/ns/oscal"/>
360360
<prop name="interconnection-direction" value="in/out" ns="https://fedramp.gov/ns/oscal"/>
361+
<prop name="direction" value="incoming" ns="https://fedramp.gov/ns/oscal"/>
362+
<prop name="direction" value="outgoing" ns="https://fedramp.gov/ns/oscal"/>
361363
<prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
362364
<remarks>
363365
<p>Some description of the authentication method.</p>
@@ -445,31 +447,31 @@
445447
<prop name="control-origination" value="sp-system" ns="https://fedramp.gov/ns/oscal"/>
446448
<prop name="implementation-status" value="partial" ns="https://fedramp.gov/ns/oscal"/>
447449
<statement statement-id="ac-1_stmt.a" uuid="99999999-0000-4000-9000-000000000009">
450+
<by-component component-uuid="55555555-0000-4000-9000-000000000005" uuid="aaaaaaaa-0000-4000-9000-00000000000a">
451+
<description>
452+
<p>Access Control Policy and Procedures (AC-1) is fully implemented in our system.</p>
453+
</description>
454+
<prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="implemented"/>
455+
<responsible-role role-id="system-admin">
456+
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
457+
</responsible-role>
458+
</by-component>
448459
</statement>
449-
<by-component component-uuid="55555555-0000-4000-9000-000000000005" uuid="aaaaaaaa-0000-4000-9000-00000000000a">
450-
<description>
451-
<p>Access Control Policy and Procedures (AC-1) is fully implemented in our system.</p>
452-
</description>
453-
<prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="implemented"/>
454-
<responsible-role role-id="system-admin">
455-
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
456-
</responsible-role>
457-
</by-component>
458460
</implemented-requirement>
459461

460462
<implemented-requirement uuid="bbbbbbbb-0000-4000-9000-00000000000b" control-id="cm-8">
461463
<prop name="control-origination" value="sp-system" ns="https://fedramp.gov/ns/oscal"/>
462464
<statement statement-id="cm-8_stmt.a" uuid="cccccccc-0000-4000-9000-00000000000c">
465+
<by-component component-uuid="55555555-0000-4000-9000-000000000005" uuid="dddddddd-0000-4000-9000-00000000000d">
466+
<description>
467+
<p>Information System Component Inventory (CM-8) is partially implemented.</p>
468+
</description>
469+
<prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="partial"/>
470+
<responsible-role role-id="system-admin">
471+
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
472+
</responsible-role>
473+
</by-component>
463474
</statement>
464-
<by-component component-uuid="55555555-0000-4000-9000-000000000005" uuid="dddddddd-0000-4000-9000-00000000000d">
465-
<description>
466-
<p>Information System Component Inventory (CM-8) is partially implemented.</p>
467-
</description>
468-
<prop ns="https://fedramp.gov/ns/oscal" name="implementation-status" value="partial"/>
469-
<responsible-role role-id="system-admin">
470-
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
471-
</responsible-role>
472-
</by-component>
473475
</implemented-requirement>
474476
</control-implementation>
475477

‎src/validations/constraints/content/ssp-misplaced-response-components-INVALID.xml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
5+
uuid="12345678-1234-4321-8765-123456789012">
6+
<system-implementation>
7+
<component uuid="55555555-0000-4000-9000-000000000005" type="this-system">
8+
<title>System To Be Authorized</title>
9+
<description>
10+
<p>This component reflects the system to be authorized.</p>
11+
<p>A proper SSP should reference this correctly within a given statement to document implemented requirements per FedRAMP requirements.</p>
12+
<p>This example SSP does not do that, it's invalid and has some problems.</p>
13+
</description>
14+
</component>
15+
</system-implementation>
16+
<control-implementation>
17+
<description>
18+
<p>Implementation of controls for the System to be Authorized</p>
19+
</description>
20+
<implemented-requirement uuid="bbbbbbbb-0000-4000-9000-00000000000b" control-id="cm-8">
21+
<prop name="control-origination" value="unsupported-origination" ns="https://fedramp.gov/ns/oscal"/>
22+
<statement statement-id="cm-8_stmt.a" uuid="cccccccc-0000-4000-9000-00000000000c"/>
23+
<by-component component-uuid="55555555-0000-4000-9000-000000000005" uuid="ce9c5b13-c9ea-40bb-bd4e-51e1520a4bce">
24+
<description>
25+
<p>This component reference would be valid if it was within the <code>statement</code> above, but it is not.</p>
26+
<p>This constraint violation for the invalid file should warn users and developers repurposing valid syntax for NIST's upstream OSCAL generic use cases is not valid specifically for FedRAMP.</p>
27+
</description>
28+
</by-component>
29+
</implemented-requirement>
30+
</control-implementation>
31+
</system-security-plan>

‎src/validations/constraints/content/ssp-missing-response-components-INVALID.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,14 @@
1111
<prop name="control-origination" value="unsupported-origination" ns="https://fedramp.gov/ns/oscal"/>
1212
<prop name="implementation-status" value="unsupported-status" ns="https://fedramp.gov/ns/oscal"/>
1313
<statement statement-id="ac-1_stmt.a" uuid="99999999-0000-4000-9000-000000000009">
14+
<!-- A require by-component reference is missing here, this missing assembly should trigger a constraint violation error. -->
1415
</statement>
1516
</implemented-requirement>
1617

1718
<implemented-requirement uuid="bbbbbbbb-0000-4000-9000-00000000000b" control-id="cm-8">
1819
<prop name="control-origination" value="unsupported-origination" ns="https://fedramp.gov/ns/oscal"/>
1920
<statement statement-id="cm-8_stmt.a" uuid="cccccccc-0000-4000-9000-00000000000c">
21+
<!-- A require by-component reference is missing here, this missing assembly should trigger a constraint violation error. -->
2022
</statement>
2123
</implemented-requirement>
2224
</control-implementation>

‎src/validations/constraints/fedramp-external-allowed-values.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@
107107
<enum value="network">A physical or virtual network.</enum>
108108
</allowed-values>
109109

110-
<allowed-values id="control-implementation-status" target="control-implementation/implemented-requirement/by-component/prop[@name='implementation-status']/@value" allow-other="no" level="ERROR">
110+
<allowed-values id="control-implementation-status" target="control-implementation/implemented-requirement/statement/by-component/prop[@name='implementation-status']/@value" allow-other="no" level="ERROR">
111111
<formal-name>Control Implementation Status</formal-name>
112112
<description>The implementation status of the control.</description>
113113
<enum value="implemented">Implemented</enum>

‎src/validations/constraints/fedramp-external-constraints.xml

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -168,10 +168,20 @@
168168
<context>
169169
<metapath target="/system-security-plan/control-implementation"/>
170170
<constraints>
171-
<expect id="missing-response-components" target="//statement" test="count(by-component) gt 0" level="ERROR">
172-
<formal-name>Missing Response Components</formal-name>
171+
<expect id="misplaced-response-components" target="implemented-requirement" test="not(exists(by-component))" level="WARNING">
172+
<formal-name>By-Component Reference for Implemented Requirements Misplaced</formal-name>
173173
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/6-security-controls/#response-overview"/>
174-
<message>Each implemented requirement MUST have at least one by-component reference to the source component implementing it.</message>
174+
<message>A FedRAMP SSP MUST identify how the system implements each control requirement implemented at the per-statement level, not in other locations allowed for non-FedRAMP use cases.</message>
175+
<remarks>
176+
<p>NIST maintains OSCAL models that allow implemented requirements for controls to have references to the implementing components in multiple locations to support multiple use cases.</p>
177+
<p>Despite the flexibility of NIST's upstream OSCAL models, FedRAMP only accepts OSCAL-based SSPs with the reference in one of those locations, see <code>missing-response-components</code> for more details about this requirement.</p>
178+
<p>A constraint violation with this warning indicates a given SSP uses one of the valid locations for all NIST use cases, but not the only FedRAMP required location.</p>
179+
</remarks>
180+
</expect>
181+
<expect id="missing-response-components" target="implemented-requirement/statement" test="count(by-component) ge 1" level="ERROR">
182+
<formal-name>By-Component Reference for Implemented Requirements Missing</formal-name>
183+
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/6-security-controls/#response-overview"/>
184+
<message>A FedRAMP SSP MUST identify how the system implements each control requirement implemented at the per-statement level and reference any component used to implement it.</message>
175185
</expect>
176186
</constraints>
177187
</context>

‎src/validations/constraints/unit-tests/misplaced-response-components-FAIL.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
test-case:
2+
name: Negative Test for misplaced-response-components
3+
description: >-
4+
This test case validates the behavior of constraint
5+
misplaced-response-components
6+
content: ../content/ssp-misplaced-response-components-INVALID.xml
7+
expectations:
8+
- constraint-id: misplaced-response-components
9+
result: fail

‎src/validations/constraints/unit-tests/misplaced-response-components-PASS.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
test-case:
2+
name: Positive Test for misplaced-response-components
3+
description: >-
4+
This test case validates the behavior of constraint
5+
misplaced-response-components
6+
content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml
7+
expectations:
8+
- constraint-id: misplaced-response-components
9+
result: pass

0 commit comments

Comments
 (0)