Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Controls - SSP control implementations specify responsible role #1008

Open
13 of 15 tasks
Tracked by #810
Rene2mt opened this issue Dec 16, 2024 · 0 comments · Fixed by #1014
Open
13 of 15 tasks
Tracked by #810

Security Controls - SSP control implementations specify responsible role #1008

Rene2mt opened this issue Dec 16, 2024 · 0 comments · Fixed by #1014

Comments

@Rene2mt
Copy link
Member

Rene2mt commented Dec 16, 2024

Constraint Task

As a consumer of FedRAMP automated completeness checks, I want to make sure that every control implementation statement has at least one responsible-role for every by-component.

Intended Outcome

  • Every by-component assembly must have one or more responsible-role assemblies

Syntax Type

This is a mix of required, optional, and/or extended syntax.

Allowed Values

There are no relevant allowed values.

Metapath(s) to Content

- context='//control-implementation/implemented-requirement/statement/by-component'
- target='./'
- count(./responsible-role) >= 1

Purpose of the OSCAL Content

This validation check helps reviewers ensure that submitted SSP control implementation statements identify all the responsible roles for each component

Dependencies

No response

Acceptance Criteria

  • All OSCAL adoption content affected by the change in this issue have been updated in accordance with the Documentation Standards.
    • Explanation is present and accurate
    • sample content is present and accurate
    • Metapath is present, accurate, and does not throw a syntax exception using oscal-cli metaschema metapath eval -e "expression".
  • All constraints associated with the review task have been created
  • The appropriate example OSCAL file is updated with content that demonstrates the FedRAMP-compliant OSCAL presentation.
  • The constraint conforms to the FedRAMP Constraint Style Guide.
    • All automated and manual review items that identify non-conformance are addressed; or technical leads (David Waltermire; AJ Stein) have approved the PR and “override” the style guide requirement.
  • Known good test content is created for unit testing.
  • Known bad test content is created for unit testing.
  • Unit testing is configured to run both known good and known bad test content examples.
  • Passing and failing unit tests, and corresponding test vectors in the form of known valid and invalid OSCAL test files, are created or updated for each constraint.
  • A Pull Request (PR) is submitted that fully addresses the goals section of the User Story in the issue.
  • This issue is referenced in the PR.

Other information

See #810 (comment) for additional details.

@Rene2mt Rene2mt moved this from 🆕 New to 📋 Backlog in FedRAMP Automation Dec 16, 2024
@Rene2mt Rene2mt moved this from 📋 Backlog to 🔖 Ready in FedRAMP Automation Dec 16, 2024
@Gabeblis Gabeblis self-assigned this Dec 17, 2024
@Gabeblis Gabeblis moved this from 🔖 Ready to 🏗 In progress in FedRAMP Automation Dec 17, 2024
@Gabeblis Gabeblis linked a pull request Dec 17, 2024 that will close this issue
7 tasks
@Gabeblis Gabeblis moved this from 🏗 In progress to 👀 In review in FedRAMP Automation Dec 17, 2024
@Gabeblis Gabeblis moved this from 👀 In review to 🚢 Ready to Ship in FedRAMP Automation Dec 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: 🚢 Ready to Ship
Development

Successfully merging a pull request may close this issue.

3 participants