SSP System Implementation constraints development

[Rene2mt]

This is a ...

improvement - something could be better

This relates to ...

• the FedRAMP OSCAL Registry
• the FedRAMP OSCAL baselines
• the Guide to OSCAL-based FedRAMP Content
• the Guide to OSCAL-based FedRAMP System Security Plans (SSP)
• the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP)
• the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR)
• the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M)
• the FedRAMP SSP OSCAL Template (JSON or XML Format)
• the FedRAMP SAP OSCAL Template (JSON or XML Format)
• the FedRAMP SAR OSCAL Template (JSON or XML Format)
• the FedRAMP POA&M OSCAL Template (JSON or XML Format)

User Story

As a FedRAMP stakeholder, I need to use FedRAMP's external constraints so that I can make sure my OSCAL SSP system-implementation content is valid in accordance with FedRAMP requirements.

Goals

The goal is to ensure the following FedRAMP validations are either developed as Metaschema-based constraints or dropped.

• user-type
• user-privilege
• user-sensitivity-level
• user-has-user-type
• user-has-privilege-level
• user-has-sensitivity-level
• user-privilege-level-has-allowed-value
• user-has-role-id
• user-has-authorized-privilege
• user-user-type-has-allowed-value
• interconnection-direction
• component-type
• interconnection-security
• scan-type
• virtual
• public
• allows-authenticated-scan
• no-description-text-in-component
• has-CMVP-validation
• has-CMVP-validation-reference
• has-CMVP-validation-details
• has-credible-CMVP-validation-reference
• has-consonant-CMVP-validation-reference
• has-consonant-CMVP-validation-details
• has-inventory-items
• has-unique-asset-id
• component-has-asset-type
• component-has-one-asset-type
• inventory-item-has-uuid
• has-asset-id
• has-one-asset-id
• inventory-item-has-asset-type
• inventory-item-has-one-asset-type
• inventory-item-has-virtual
• inventory-item-has-one-virtual
• inventory-item-has-public
• inventory-item-has-one-public
• inventory-item-has-scan-type
• inventory-item-has-one-scan-type
• inventory-item-has-one-allows-authenticated-scan
• inventory-item-has-one-baseline-configuration-name
• inventory-item-network-address
• ipv4-has-content
• ipv4-has-non-placeholder
• ipv6-has-content
• ipv6-has-non-placeholder
• has-this-system-component
• has-accessible-CMVP-validation-details
• has-allowed-virtual
• has-allowed-public
• has-allowed-allows-authenticated-scan
• has-allowed-is-scanned
• has-allowed-scan-type
• component-has-allowed-type
• inventory-item-has-allows-authenticated-scan
• inventory-item-has-baseline-configuration-name
• inventory-item-has-vendor-name
• inventory-item-has-one-vendor-name
• inventory-item-has-hardware-model
• inventory-item-has-one-hardware-model
• inventory-item-has-is-scanned
• inventory-item-has-one-is-scanned
• inventory-item-has-software-name
• inventory-item-has-one-software-name
• inventory-item-has-software-version
• inventory-item-has-one-software-version
• inventory-item-has-function
• inventory-item-has-one-function
• asset-type
• transport-type
• invalid-component-match
• has-credible-CMVP-validation-details
• has-allowed-asset-type
• has-prohibited-vendor-name
• has-email-and-DMARC
• FedRAMP-ATO-Identifier-exists
• responsible-role-has-role-definition
• responsible-role-has-user
• role-id-has-role-definition
• user-sensitivity-level-has-allowed-value
• authorized-privilege-has-title
• authorized-privilege-has-function-performed
• authorized-privilege-has-non-empty-title
• authorized-privilege-has-non-empty-function-performed
• interconnection-has-allowed-interconnection-direction-value
• interconnection-has-allowed-interconnection-security-value
• interconnection-has-interconnection-security-remarks
• interconnection-has-title
• interconnection-has-description
• interconnection-has-direction
• interconnection-has-information
• interconnection-has-protocol
• interconnection-has-service-processor
• interconnection-has-local-and-remote-addresses
• interconnection-has-circuit
• interconnection-has-interconnection-security
• interconnection-has-isa-poc-local
• interconnection-has-isa-poc-remote
• interconnection-has-isa-authorizing-official-local
• interconnection-has-isa-authorizing-official-remote
• interconnection-has-responsible-persons
• interconnection-has-distinct-isa-local
• interconnection-has-distinct-isa-remote
• interconnection-cites-interconnection-agreement
• interconnection-cites-interconnection-agreement-href
• interconnection-cites-attached-interconnection-agreement
• interconnection-protocol-has-port-range
• interconnection-protocol-has-name
• interconnection-protocol-port-range-has-transport
• interconnection-protocol-port-range-has-start
• has-expected-network-protocols
• has-DNS-authoritative-service
• interconnection-protocol-port-range-has-end
• has-DNS-zone
• has-well-formed-DNS-zone
• has-resolved-zone
• zone-has-DNSSEC

Dependencies

No response

Acceptance Criteria

• Metaschema-based external constraint is developed

• External constraint has PASS & FAIL unit tests

• Unit test content (e.g., valid and invalid SSP) is provided

• Constraints testing harness produces expected results when unit tests are run

• The constraint is documented and mentioned in the https://automate.fedramp.gov/documentation site (confirm by reviewing SSP sub-pages)

• All FedRAMP Documents Related to OSCAL Adoption (https://github.com/GSA/fedramp-automation) affected by the changes in this issue have been updated.

• A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.

Other information

No response

[aj-stein-gsa]

Per discussion today with ongoing work in #626 and upcoming work to follow on how we publish our progress against the public strategy doc, we will close this out issue to be replaced with the thematic objective and epic issue approach.

(For public stakeholders who follow these updates, more to follow.)