Risk Log Requirements

[TelosPO]

• This is a ...

  • [ ] concern - I think something needs to be different.
  • [ ] question - I didn't understand something.
  • [ ] kudos - I found something helpful and want to encourage it in future FedRAMP publications.
  • [X ] request - I would like to see something additional provided.

• This relates to ...

  • [ ] the FedRAMP OSCAL Registry (Excel File)
  • [ ] the Guide to OSCAL-based FedRAMP Content (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR) (PDF)
  • [X ] the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • [ ] the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • [ ] General/Overall
  • [ ] Other

NOTE: For feedback related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

• Where, exactly?

  • For the registry, please indicate the tab and cell, or other clear identifier
  • For the guide, please indicate the section number and printed page number (lower right corner)
  • For the OSCAL XML or JSON files, please indicate XML or JSON; and indicate the line number, field id, or other clear location identifier 4.4 page 20

• What is your feedback? What is the requirements for the risk log additionally what would be used for a status update type of change as this can get lengthy if we have to use any change.

• Is this report specifically related to the Word or Excel files from fedramp.gov? If so, please do not open an issue here. Follow the guidance in this repository's README and contact info@fedramp..gov.

• What version of OSCAL are you using? (Check our info on supported OSCAL versions)

• What action would you like to see from the FedRAMP PMO?

• Other information (e.g. detailed explanation, related issues, suggestions how to fix, links for us to have context, eg. slack, gitter, etc)

[sunstonesecure-robert]

just to surface relevant contextual info:

From Release Notes:

A "[risk-log/entry](https://pages.nist.gov/OSCAL/reference/latest/assessment-results/json-reference/#/assessment- results/results/risks/risk-log)" can be used to identify any action that relates to the assessment of or handling of a risk. This replaces > the "/assessment-results/results/risk/remediation-tracking", while proving more robust capabilities.

status update type of change

prop type has specified values for this, eg: status-update

can get lengthy

there can be infinite entries so in theory you could break up a massive update into smaller parts arbitrarily or conceptually

as I see it the description is essentially a XML string type which MAY add a constraint on max length - this is a great question - does OSCAL impose such a constraint?