Documents for rev 5 have requirements outside of OSCAL - Inventory

[Telos-sa]

Action Item

This is a ...

• [ X] fix - Something needs to be different.
• [ ] enhancement - Something could be better.
• [ X] investigation - Something needs to be investigated further.

This relates to ...

• [ X ] the FedRAMP SSP OSCAL Template (JSON or XML Format)

NOTE: For issues related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

Describe the problem or enhancement

The following columns are not in the rev5 OSCAL requirement, but are in the SSP AppendixM:

• End-of-Life
• Diagram Label
• In Lestest Scan

The following column requires additional details:

• software/Database Inventories : Confirm that ALL components should be included within this single column? The props in rev 5 allow for software name, but shouldn't it be a series of implemented components. What is the purpose of the prop for stoftware, and how is this different than implemented component?

Goals:

Ensure the OSCAL product and the inventory document are the same

Acceptance Criteria

• [ X] All FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.
• [ ] A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

[Telos-sa]

Please also add VLAN/Network ID to the request. Want to understand what information should be captured here that is not in the information data flow diagram. Or if we should just be capturing the diagrams per each interconnection/service/data in transit data flow diagram.

[Telos-sa]

Identified Additional Issues between the Inventory workbook template and the OSCAL SSP guide.

• Function is listed as a prop only required for software/DB types. However inventory workbook template lists Function as Mandatroy for all assets/components

Here is OSCAL Requirement: