cli validator not accounting for IAAS when reviewing PE controls for leveraged authorizations

[Telos-sa]

Describe the bug

If the accreditation boundary cloud-service-model is/contains iaas, the requirement for a leveraged authorization is still resulting in an error from the cli-validator

Who is the bug affecting?

Any accreditation boundary with cloud-service-model containing/is IAAS

Is this report specifically related to the Word or Excel files from fedramp.gov?

NO

What version of OSCAL are you using? (Check our info on supported OSCAL versions)

1.0.2

What is affected by this bug?

IAAS authorizations will have an error for every PE control. This error is causing a lot of "noise" for the team to sort through {Describe the impact the bug is having.}

When does this occur?

Any export without a leveraged authorization will have this error.

How do we replicate the issue?

Provided the SSP and the validation reports for rev. ew.

Expected behavior (i.e. solution)

Rule should be, (pseudo code) if "iaas" in cloud-service-model continue else: trigger the rule requirement

Other Comments

{Add any other context about the problem here.}

[Telos-sa]

Validations.zip forgot to attach reports

[Telos-sa]

@Telos-sa ignore any additional errors with this issue. FedRAMP team adding a caveat to the rule to ignore if cloud-service-model contains "iaas"

[volpet2014]

This has been addressed as part of the Early Adopter's workgroup and subsequent updates to the Schematron Ruleset.