Discrepancy between baseline XML response-points and SSP Appendix A response-points

[Telos-sa]

• This is a ...

  • [X] fix - something needs to be different.
  • [ ] enhancement - Something could be better.
  • [ ] investigation - Something needs to be investigated further.

• This relates to ...

  • [ ] the FedRAMP OSCAL Registry (Excel File)
  • [ ] the Guide to OSCAL-based FedRAMP Content (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • [X] the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • [ ] General/Overall
  • [X] Other

• Describe the problem. The response-points listed in the baseline OSCAL XMLs are different than what are listed in the SSP Appendix A pdf.

• Example The Moderate Baseline OSCAL response-points: https://raw.githubusercontent.com/GSA/fedramp-automation/916ae4e8c16331fc6d9dd8fa997dbf5f36af3784/src/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml

  

  SSP Appendix A response points:

  

There is additional levels of response-points included in the XML that are not in the Appendix A pdf.

• Desired Change Align the response-points in the OSCAL baselines with what is listed in the SSP Appendix A

[Rene2mt]

See the proposed fix in PR https://github.com/GSA/fedramp-automation/pull/502