Production release readiness & publication in MIDAS

[nikitawootten-nist]

User Story:

As a NIST OSCAL team member, in order to ensure this project is well-designed, implemented, tested, and documented, I want itemized list of NIST publication requirements for publishing research software, status, and supported evidence for individual items per and other relevant guidelines.

NOTE: this issue is derived from aj-stein-nist/nmetaschema#21

Goals:

The following NIST requirements must be met:

• NIST S 1801.03 (supplemented by this checklist)
  • How do you expect your code/software to be used (choose 1):
    • Code is informational (e.g. part of the supplemental information in a narrative publication) and not intended for re-use
    • Code itself is intended for re-use (e.g. in a specific scientific area) or the public is being invited to contribute to it
  • Developing and Testing:
    • A testing plan was developed, followed, and documented. The testing plan is available at a specified link. (see Create a TESTING.md document #31)
    • Continuous testing was conducted during updates and new builds. (see Automated unit testing #2)
    • Code includes appropriate IT security and privacy controls.
  • Documenting:
    • Documentation is available as appropriate as: (choose 1)
      • Integrated with the source code
      • On separate web pages (e.g. nist.gov, pages.nist.gov) (see API specifications #17)
      • In a separate publication (see https://pages.nist.gov/metaschema/)
      • Other
    • Documentation includes, as appropriate:
      • A readme (see Initialize repository #1)
      • Function-level documentation
      • Information about how a binary was produced
      • System requirements and prerequisites (e.g., OS version, memory, dependencies)
      • Installation instructions
      • User instructions/guides
      • API specifications #17
      • A changelog file (included in GitHub releases)
      • Specification of maturity level (i.e. is the software still being developed,, are you expecting feedback on performance and usability, is the project completed)
      • A communication to users of your intent to provide (or not provide) support (see Initialize repository #1 contribution notice)
  • License and disclaimers:
    • NIST license and disclaimers (see Initialize repository #1)
    • External collaborators who were part of this project have been credited
    • Third-party software licenses permit modification and/or redistribution (Third-party dependency licence reporting and validation #30)
      • Appropriate licensing is included (Third-party dependency licence reporting and validation #30)
      • Files modified by NIST contain notice that modifications are released to the public domain as appropriate (see import relationships between core, common, and extension schemas OSCAL#1 contribution notice)
• Fair Principles (supplemented by this checklist)
  • Findable (Will be satisfied by MIDAS entry)
    • (Meta)data are assigned a globally unique and persistent identifier
    • Data are described with rich metadata (defined by R1 below)
    • Metadata clearly and explicitly include the identifier of the data they describe
    • (Meta)data are registered or indexed in a searchable resource
  • Accessible (satisfied by NPM)
    • (Meta)data are retrievable by their identifier using a standardised communications protocol
    • Metadata are accessible, even when the data are no longer available
  • Interoperable (satisfied by NPM)
    • (Meta)data use a formal, accessible, shared, and broadly applicable language for knowledge representation.
    • (Meta)data use vocabularies that follow FAIR principles
    • (Meta)data include qualified references to other (meta)data
  • Reusable (satisfied by NPM)
    • (Meta)data are richly described with a plurality of accurate and relevant attributes
      • (Meta)data are released with a clear and accessible data usage license
      • (Meta)data are associated with detailed provenance
      • (Meta)data meet domain-relevant community standards

Dependencies:

The major epics describing the MVP:

• Design an OSCAL approach for mapping to security frameworks (e.g., NIST Cybersecurity Framework) OSCAL#5
• Set parameter values for controls within the context of the union of multiple profile standards OSCAL#14
• Document the composition of the profile schema and how it relates to the catalog schema OSCAL#15
• TBD...