OSCAL extension - mappings

[bjcbusiness]

OSCAL has defined a schema for declaring mappings between elements. Has there been any thought about how (and whether) to implement this in trestle?

Reference: https://pages.nist.gov/OSCAL-Reference/models/prototype-mapping-model/mapping/

[degenaro]

Thanks for this timely inquiry! The reference you cite is a work-in-progress.

A bit of history. The mapping model was proposed perhaps 2 or more years ago, and a draft model was created by the NIST OSCAL team slightly different from the current proposal, but not drastically different. There is an old trestle branch that supports the older OSCAL 1.0.2. models plus the old draft mapping model. Just as a coincidence, I created another branch this morning that supports OSCAL 1.1.2 in a hackish kind of way plus the old draft mapping model. What I mean by this is that the version check code has been hacked to accept 1.1.2 without actually code to provide such support, so caveat emptor. All should work well, if you are just being backward compatible with the other models. Using new features (beyond 1.0.2) would presumably not work. That branch is here: https://github.com/oscal-compass/compliance-trestle/tree/bridge/synthesize-cd.
All of this is not officially supported by trestle, but it does work and minimal effort to fix things if necessary would be entertained.

With luck, the new mapping model will be presented by the NIST OSCAL team to the community in the near future. Whether trestle will try to adopt a pre-release version of the mapping model or wait for official release is TBD (my guess is the latter). You are welcome to attend the regular CNCF oscal-compass community meeting to discuss. See https://github.com/oscal-compass.

[bjcbusiness]

Hello, That's great news! Thank you for working on that. Later on I'll take a look and see whether I can manage. I'm completely new to compliance-trestle and figure I should get comfortable with the released version, then take a closer look at the "bleeding edge" stuff. The mappings extension is very important, I think-at least based on the number of mapping spreadsheet tables that I'm sure we've all written or used. Regards Ben From: Lou DeGenaro ***@***.***> Sent: Tuesday, July 9, 2024 3:26 PM To: oscal-compass/compliance-trestle ***@***.***> Subject: Re: [oscal-compass/compliance-trestle] OSCAL extension - mappings (Discussion #1615) Thanks for this timely inquiry! The reference you cite is a work-in-progress. A bit of history. The mapping model was proposed perhaps 2 or more years ago, and a draft model was created by the NIST OSCAL team slightly different from the current proposal, but not drastically different. There is an old trestle branch that supports the older OSCAL 1.0.2. models plus the old draft mapping model. Just as a coincidence, I created another branch this morning that supports OSCAL 1.1.2 in a hackish kind of way plus the old draft mapping model. What I mean by this is that the version check code has been hacked to accept 1.1.2 without actually code to provide such support, so caveat emptor. All should work well, if you are just being backward compatible with the other models. Using new features (beyond 1.0.2) would presumably not work. That branch is here: https://github.com/oscal-compass/compliance-trestle/tree/bridge/synthesize-cd. All of this is not officially supported by trestle, but it does work and minimal effort to fix things if necessary would be entertained. With luck, the new mapping model will be presented by the NIST OSCAL team to the community in the near future. Whether trestle will try to adopt a pre-release version of the mapping model or wait for official release is TBD (my guess is the latter). You are welcome to attend the regular CNCF oscal-compass community meeting to discuss. See https://github.com/oscal-compass. - Reply to this email directly, view it on GitHub<#1615 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BHHDEZZ5B22XDL5NEYNF7FLZLPXH7AVCNFSM6AAAAABKSVOCFOVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TSOJZGM2TI>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>