Tutorial: Extension Mechanisms

[david-waltermire]

User Story:

As an OSCAL content creator or consumer, I need guidance on how to use the various OSCAL extension points (i.e., property and links) to provide extended data.

This relates to a question posed in #542.

Goals:

• Create a tutorial illustrating the use of the OSCAL extension mechanisms.

Dependencies:

None.

Acceptance Criteria

• All OSCAL website and readme documentation affected by the changes in this issue have been updated. Changes to the OSCAL website can be made in the docs/content directory of your branch.
• A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.
• The CI-CD build process runs without any reported errors on the PR. This can be confirmed by reviewing that all checks have passed in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

[david-waltermire]

Also consider part in this tutorial.

[ohsh6o]

As a community member, I would love to contribute in whatever way you deem helpful on this effort.

[ohsh6o]

I have provided my ongoing work on an example component with an extension for security tool parameters in the OSCAL discussion forum and would love feedback and know how I can work with those assigned to further this effort, if this extension work will help.

[Rene2mt]

This work is in progress. For a preview of what will be covered in the tutorial, please see my draft outline here. I welcome any feedback.

[ohsh6o]

Provided some initial feedback as an outside peer, hope that helps and is not too forward.

I looked at this because there is some overlap with FedRAMP Guidance in Section 3.1 in this document on page 28, along with other parts of this document and others here. These are slightly out of date, and the draft versions are in a shared drive we use with NIST (you have access).

This is great and would like to align our resources with this once this is official. Thanks for publishing your outline!

[Rene2mt]

Tutorial is ready for review (see PR#1031). I do plan to expand on the final XML, JSON, YAML that is presented at the end of the tutorial to make sure it is a fully complete sample SSP. Once I have a full, well-formed OSCAL SSP (incorporating the props and links examples that are already in the tutorial), I will add another PR to add the item to the OSCAL-content repo.

[aj-stein-nist]

Interesting follow-up requests for clarity on best practices with using OSCAL @ns for namespacing and extending OSCAL data here, relevant to perhaps touching up AC and working this issue to completion in 1.1.0?

https://gitter.im/usnistgov-OSCAL/Lobby?at=6273c50314df4e44f20e9e86

/cc @1z10 @mruge