-
Notifications
You must be signed in to change notification settings - Fork 183
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
removed all source and generated content files. Updated readmes to po…
…int to the new content repository.
- Loading branch information
1 parent
515b797
commit 01c0aa9
Showing
89 changed files
with
7 additions
and
921,151 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,9 +1,3 @@ | ||
# OSCAL Examples | ||
|
||
This directory contains OSCAL examples in both XML and JSON formats. Some examples are considered provisional "finished" versions of OSCAL catalogs and profiles; they are not authoritative but are intended as demonstrations of OSCAL. Other examples are works in progress. Each subdirectory within the examples directory clearly indicates the current status of its example files. | ||
|
||
The structure and contents of the examples directory are as follows: | ||
|
||
* [fedramp.gov](fedramp.gov): This directory contains examples in XML and JSON formats of the low, moderate, and high baselines defined by FedRAMP (the Federal Risk and Authorization Management Program). | ||
* [nist.gov/SP800-53/rev4](nist.gov/SP800-53/rev4): This directory contains examples in XML and JSON formats of the low, moderate, and high baselines defined by NIST Special Publication (SP) 800-53 Revision 4. | ||
|
||
All OSCAL content examples have been moved to the [OSCAL content GitHub repository](https://github.com/usnistgov/oscal-content). |
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,31 +1,3 @@ | ||
# Federal Risk and Authorization Management Program (FedRAMP) Profile Examples | ||
# Content Moved | ||
|
||
The following representations of the "High", "Moderate" and "Low" baselines (profiles) are derived from [source data](https://www.fedramp.gov/documents/) defined by FedRAMP: | ||
|
||
- [FedRAMP High Security Controls](https://www.fedramp.gov/assets/resources/documents/FedRAMP_High_Security_Controls.xlsx) | ||
- [FedRAMP MODERATE Security Controls](https://www.fedramp.gov/assets/resources/documents/FedRAMP_Moderate_Security_Controls.xlsx) | ||
- [FedRAMP LOW Security Controls](https://www.fedramp.gov/assets/resources/documents/FedRAMP_Low_Security_Controls.xlsx) | ||
|
||
Machine made OSCAL Profile versions: | ||
|
||
- [FedRAMP HIGH Baseline OSCAL Profile](xml/FedRAMP_HIGH-baseline_profile.xml) | ||
- [FedRAMP MODERATE Baseline OSCAL Profile](xml/FedRAMP_MODERATE-baseline_profile.xml) | ||
- [FedRAMP LOW Baseline OSCAL Profile](xml/FedRAMP_LOW-baseline_profile.xml) | ||
|
||
[JSON versions](json) are also available for the OSCAL profiles above containing equivalent content. | ||
|
||
Each one of these captures the (indicated) spreadsheet data and represents it as an OSCAL profile, calling controls in from the appropriate SP 800-53 rev4 baselines or when necessary from the SP 800-53 rev4 catalog. | ||
|
||
Specific FedRAMP guidance and parameter constraints are provided for each control. | ||
|
||
### Extraction / conversion process | ||
|
||
All control information from NIST SP 800-53 revision 4 and all FedRAMP control baseline details are correlated in an MS Access database, which is part of the MS Office 2016 product suite. | ||
The FedRAMP profiles are created with MS Access Visual Basic for Applications (VBA) code, which queries the information and creates OSCAL-compliant XML using MSXML Document Object Model (DOM) Version 6. | ||
This tool represents a proof-of-concept. Open-source tools may be developed in the future. | ||
|
||
### Special considerations | ||
|
||
Note also the profiles here make reference to profiles and catalogs stored in the neighbor '[SP 800-53](../nist.gov/SP800-53)' directory, on which they are dependent. | ||
|
||
Also note that (at least according to Schematron `oscal-profiles-sources.sch`), several of the OSCAL invocations in these profiles could be rewritten to exclude rather than include controls. In a number of cases, invoking controls by exclusion will be much more concise than the same control set (selection) expressed by inclusion; the Schematron detects and reports on this. | ||
All OSCAL FedRAMP content have been moved to the [OSCAL content GitHub repository](https://github.com/usnistgov/oscal-content/tree/master/fedramp.gov). |
1 change: 0 additions & 1 deletion
1
content/fedramp.gov/json/FedRAMP_HIGH-baseline-resolved-profile_catalog-min.json
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.