POA&M - remediations/lifecycle ="planned" error

[Telos-sa]

Extended Description

• Validation error seems to be referencing the wrong structure, or json is not being translated back into xml appropriately.
  Json structure the response objects are collected within "remediations". The schematron is looking for "response".

Preconditions

• Preconditions…

Acceptance Criteria

• More acceptance criteria… Review and determine if the schematron rule needs to be repointed, or if the issue is in the method of converting from json to xml. Once determined, fix as appropriate so the error no longer presents when the lifecycle="planned" is present but located within remediations.

Story Tasks

• [ ] Tasks…

Definition of Done

• [X ] Acceptance criteria met
• [ ] Unit test coverage of our code > 95%
• [ ] Automated code quality checks passed
• [ ] Security reviewed and reported
• [ ] Reviewed against plain language guidelines
• [ ] Code must be self-documenting
• [ ] No local tech debt
• [ ] Load/performance tests passed – needs to be created/automated
• [ ] Documentation updated
• [ ] Architectural Decision Record completed as necessary for significant design choices
• [ ] PR reviewed & approved
• [ ] Source code merged FakeSubmissionPackage.zip

[Telos-sa]

Evidence provided that showing planned is included. And provided submission package for review as well (fake data)

[volpet2014]

Is this for Rev 4 or Rev 5 or both?

[Telos-sa]

REV 4 is the location.

[dimitri-zhurkin-vitg]

There is a discrepancy between NIST OSCAL JSON structure (https://pages.nist.gov/OSCAL-Reference/models/v1.1.1/plan-of-action-and-milestones/json-outline/) and NIST OSCAL XML structure (https://pages.nist.gov/OSCAL-Reference/models/v1.1.1/plan-of-action-and-milestones/xml-outline/).

We'll discuss this issue with NIST.

[vitggsa]

FYI - NIST has identified that the SAR has the same discrepancy. Just following up.

[david-waltermire]

This relates to https://github.com/usnistgov/OSCAL/issues/1956.

[david-waltermire]

This was discussed on the 12/6/2023 FedRAMP Early Adopters Workgroup call.

On the call, the FedRAMP PMO recommended that the OSCAL syntax be kept as-is and that the discrepancy be explained in the associated OSCAL documentation. There was general agreement that leaving it as-is was the right thing to do. There were no concerns raised with this way forward on the call.

Based on the discussion result, this issue can be closed. This relates OSCAL issues https://github.com/usnistgov/OSCAL/issues/1618 and https://github.com/usnistgov/OSCAL/issues/1956. https://github.com/usnistgov/OSCAL/issues/1956 can be closed.