Objective Scope (Which are required?)

[Telos-sa]

• This is a ...

  • [ ] concern - I think something needs to be different.
  • [ X ] question - I didn't understand something.
  • [ ] kudos - I found something helpful and want to encourage it in future FedRAMP publications.
  • [ ] request - I would like to see something additional provided.

• This relates to ...

  • [ ] the FedRAMP OSCAL Registry (Excel File)
  • [ ] the Guide to OSCAL-based FedRAMP Content (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • [ X ] the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • [ X ] the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR) (PDF)
  • [ X ] the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • [ ] the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • [ ] General/Overall
  • [ ] Other

NOTE: For feedback related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

• Where, exactly?

  • For the guide, please indicate the section number and printed page number (lower right corner)

• What is your feedback? Need to understand if FedRAMP is expecting results under component "this-system" or if all results should be based on location, inventory, and user.

• What version of OSCAL are you using? (Check our info on supported OSCAL versions) 1.0.5

• What action would you like to see from the FedRAMP PMO? Determine the scoping for SAP, SAR, and POAM. IE POAMs can be at the this-system level, but tests are scoped for location... Need additional clarification on requirements

• Other information (e.g. detailed explanation, related issues, suggestions how to fix, links for us to have context, eg. slack, gitter, etc)