Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Leveraged-Authorization Documentation #124

Merged
merged 4 commits into from
Dec 2, 2024
Merged

Add Leveraged-Authorization Documentation #124

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9cdb507
Add leveraged authorization documentation
Gabeblis Nov 22, 2024
89f23be
Fix wording
Gabeblis Nov 25, 2024
9705d4f
Remove "attest"
Gabeblis Nov 29, 2024
b15dbc6
Fix remark
Gabeblis Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 23 additions & 5 deletions content/documentation/ssp/4-ssp-template-to-oscal-mapping.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -915,10 +915,10 @@ Each system must define at least two data centers. There must be exactly one pri
---
## Leveraged FedRAMP-Authorized Services

If this system is leveraging the authorization of one or more systems, such as a SaaS running on an IaaS, each leveraged system must be represented within the `system-implementation` assembly. There must be one `leveraged-authorization` assembly and one matching `component` assembly for each leveraged authorization.
If this system is leveraging the authorization of one or more systems, such as a SaaS running on an IaaS, each leveraged system must be represented within the `system-implementation` assembly. There must be one `leveraged-authorization` assembly and one matching `component` assembly for each leveraged authorization. A leveraged authorization must define a FIPS-199 impact level (low, moderate, or high) that matches or exceeds the security sensitivity level of the leveraging system.

The `leveraged-authorization` assembly includes the leveraged system's name, point of contact (POC), and authorization date. The `component` assembly must be linked to the `leveraged-authorization` assembly using a property (prop) field with the name "leveraged-authorization-uuid" and the
UUID value of its associated `leveraged-authorization` assembly. The `component` assembly enables controls to reference it with the `by-component` responses described in the [*Control Implementation Descriptions*](/documentation/ssp/6-security-controls/#control-implementation-descriptions) section. The "implementation-point" property value must be set to "external".
UUID value of its associated `leveraged-authorization` assembly. The `component` assembly enables controls to reference it with the `by-component` responses described in the [*Control Implementation Descriptions*](/documentation/ssp/6-security-controls/#control-implementation-descriptions) section. The "implementation-point" property value must be set to "external". The component assembly must define an `authentication-method` with remarks that explain the method if authentication is used, justify the absence of authentication if not used, or provide an explanation of why authentication is not applicable.

If the leveraged system owner provides a UUID for their system, such as in an OSCAL-based Inheritance and Responsibility document (similar to a CRM), it should be provided as the inherited-uuid property value.

Expand Down Expand Up @@ -946,7 +946,10 @@ While a leveraged system has no need to represent content here, its SSP must inc
<short-name>E.I.P.</short-name>
</party>
</metadata>
<!-- cut import-profile, system-characteristics -->
<!-- cut import-profile, -->
<system-characteristics>
<security-sensitivity-level>fips-199-moderate</security-sensitivity-level>
</system-characteristics>
<system-implementation>
<leveraged-authorization uuid="11111111-3333-5555-0000-000000000001" >
<title>Name of Underlying System</title>
Expand All @@ -960,8 +963,18 @@ While a leveraged system has no need to represent content here, its SSP must inc
<party-uuid>uuid-of-leveraged-system-poc</party-uuid>
<date-authorized>2015-01-01</date-authorized>
</leveraged-authorization>
<!-- Leveraged authorization component -->
<component uuid="uuid-of-leveraged-system" type="system">
<!-- CSO name & service description -->
<component uuid="00000000-0000-0000-0000-000000000000" type="system">
<prop name="leveraged-authorization-uuid" value="11111111-3333-5555-0000-000000000001"/>
<prop name="implementation-point" value="external"/>
<prop ns="http://fedramp.gov/ns/oscal" name="nature-of-agreement" value="sla"/>
<prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
<remarks>
<p>This component has an authentication method which we document as required here.</p>
</remarks>
</prop>
</component>
<component uuid="uuid-of-leveraged-system" type="leveraged-system">
<title>Name of Leveraged System</title>
<description>
<p>Briefly describe leveraged system.</p>
Expand Down Expand Up @@ -1020,6 +1033,11 @@ FedRAMP defines the following allowed values for the nature-of-agreement propert
- other
- sla

FedRAMP defines the following allowed values for an authentication-method's value property:
- yes
- no
- not-applicable

{{</callout>}}

#### XPath Queries
Expand Down