Analysis of Feedback and Refinement of OSCAL SSP Specification

[brian-ruf]

User Story:

As a FedRAMP Cloud Service Provider, I need to submit my FedRAMP-complaint System Security Plan in a machine-readable format that is OSCAL compliant/aligned, as defined by the FedRAMP PMO in cooperation with the NIST OSCAL effort. As the FedRAMP PMO, we need to share SSP content with leveraging agencies in a machine-readable formation that is OSCAL compliant/aligned.

Goals:

This represents a long-term issue to track progress against supporting FedRAMP SSPs.

The ultimate goal is to enable third-party tool development that CSPs can use to develop FedRAMP-compliant SSPs with the guidance of an "expert system". CSPs can then submit SSP content to the FedRAMP PMO in a standardized machine-readable format that enables the PMO to perform automated compliance analysis.

The goal of this issue is to receive feedback on Issue #246, assess and validate that feedback, and refine the OSCAL SSP specification.

Dependencies:

This issue builds on prior work from #246 and the OSCAL implementation layer concepts defined in issues #213, #214 , #215 , #216, and #217.

SSP samples will be generated in issue #364. Concepts will be documented on the website in issue #363.

Acceptance Criteria

1. Provide structured data modeling of a FedRAMP SSP, including cardinality.
2. Provide an OSCAL compliant/aligned specification for FedRAMP SSP content.
3. Provide real-world example SSP content expressed in the OSCAL format.

NOTE: A compliant FedRAMP SSP includes several attachments. Some of these documents contain very straight-forward structured data (such as system inventory), and some is strictly unstructured information (such as user guides). This effort will eventually include those highly structured attachments.

[brian-ruf]

Updated mock-up, reflects up-front metadata approach now present in all OSCAL layers. As we turn attention from MR 1 (catalogs and profiles) to MR 2 (Implementation, including SSPs and vendor product files), we will start working with this model.

OSCAL Implementation Layer System Security Plan (SSP) Mock Up (v2).zip

[david-waltermire]

@brianrufgsa I think we might have addressed this through the combination of work we have been doing on the SSP models and the FedRAMP guide. Can this be closed? Or do you think we have more work to do?

[david-waltermire]

Agreed. Closing.