Add has-marking

features/fedramp_extensions.feature

@@ -95,6 +95,8 @@ Examples:
   | has-incident-response-plan-PASS.yaml |
   | has-information-system-contingency-plan-FAIL.yaml |
   | has-information-system-contingency-plan-PASS.yaml |
+  | has-marking-FAIL.yaml |
+  | has-marking-PASS.yaml |
   | has-network-architecture-FAIL.yaml |
   | has-network-architecture-PASS.yaml |
   | has-network-architecture-diagram-FAIL.yaml |
@@ -240,6 +242,7 @@ Examples:
   | has-identity-assurance-level |
   | has-incident-response-plan |
   | has-information-system-contingency-plan |
+  | has-marking |
   | has-network-architecture |
   | has-network-architecture-diagram |
   | has-network-architecture-diagram-caption |

src/validations/constraints/content/ssp-all-VALID.xml

@@ -11,6 +11,7 @@
     <oscal-version>1.1.2</oscal-version>
     <document-id scheme="https://example.com/identifiers">SSP-2024-002</document-id>
     <prop name="fedramp-version" ns="https://fedramp.gov/ns/oscal" value="fedramp-3.0.0rc1-oscal-1.1.2"/>
+    <prop name="marking" value="cui"/>
 
     <role id="creator">
       <title>Document Creator</title>

src/validations/constraints/content/ssp-has-marking-INVALID.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+  <metadata>
+  </metadata>
+</system-security-plan>

src/validations/constraints/fedramp-external-constraints.xml

@@ -5,7 +5,7 @@
     <!-- ================== -->
 
     <context>
-        <metapath target="//metadata"/>
+    	<metapath target="/(assessment-plan|assessment-results|plan-of-action-and-milestones|system-security-plan)/metadata"/>
         <constraints>
             <expect id="fedramp-version" target="." test="prop[@name='fedramp-version'][@ns='https://fedramp.gov/ns/oscal']">
                 <formal-name>Fedramp Version</formal-name>
@@ -16,6 +16,11 @@
                     <p>FedRAMP maintains an official list of the versions on <a href="https://github.com/GSA/fedramp-automation/releases">the fedramp-automation releases page</a>. Unless noted otherwise, a valid version is <a href="https://github.com/GSA/fedramp-automation/tags">a published tag name</a>.</p>
                 </remarks>
             </expect>
+            <expect id="has-marking" target="." test="prop[@name='marking']" level="ERROR">
+                <formal-name>FedRAMP data sensitivity classification identifier.</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/general-concepts/4-expressing-common-fedramp-template-elements-in-oscal/"/>
+                <message>A FedRAMP document's metadata MUST specify a data sensitivity classification.</message>
+            </expect>
         </constraints>
     </context>
 

src/validations/constraints/unit-tests/has-marking-FAIL.yaml

@@ -0,0 +1,8 @@
+# Driver for the invalid has-marking constraint unit test.
+test-case:
+  name: The invalid has-marking constraint unit test.
+  description: Test that the SSP metadata does not contain the "marking" property.
+  content: ../content/ssp-has-marking-INVALID.xml
+  expectations:
+  - constraint-id: has-marking
+    result: fail

src/validations/constraints/unit-tests/has-marking-PASS.yaml

@@ -0,0 +1,8 @@
+# Driver for the valid has-marking constraint unit test.
+test-case:
+  name: The valid has-marking constraint unit test.
+  description: Test that the SSP metadata contains the "marking" property.
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+  - constraint-id: has-marking
+    result: pass