[Feedback]: Not clear how to represent Appendix Q: Cryptographic Modules

[devbytyler]

This is a ...

request - need something additional provided

This relates to ...

• [ ] the FedRAMP OSCAL Registry
• [ ] the FedRAMP OSCAL baselines
• [ ] the Guide to OSCAL-based FedRAMP Content
• [X] the Guide to OSCAL-based FedRAMP System Security Plans (SSP)
• [ ] the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP)
• [ ] the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR)
• [ ] the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M)
• [ ] the FedRAMP SSP OSCAL Template (JSON or XML Format)
• [ ] the FedRAMP SAP OSCAL Template (JSON or XML Format)
• [ ] the FedRAMP SAR OSCAL Template (JSON or XML Format)
• [ ] the FedRAMP POA&M OSCAL Template (JSON or XML Format)
• [ ] the FedRAMP OSCAL Validations

What is your feedback?

The guide for OSCAL-based FedRAMP SSPs is unclear how to represent several concepts of Appendix Q, namely:

• The relationship between a "source" product/validation pair and "destination" product/validation pair.
• The reference number column, which is supposed to correlate back the "Ports, Protocols, and Services" table.
• Encryption Type (DAR only)
• The "Usage" column, comprising of free text and checkboxes for TLS for DIT.
• The "Notes" column.

For the last two item mentioned, the template language implies that "usage" and "notes" is commentary on the row itself, meaning that the "row" would require some type of data structure to capture the details.

Currently, the only direction given is to link validation and product components together, but that leaves the rest of the data unrepresented.

Internally, we've discussed representing the row as a "data-flow" component to capture the details, but we try to avoid going wild west as much as possible and would appreciate some official direction.

Talked this over with @david-waltermire and @Rene2mt a few weeks back and we agreed this required further discussion.

Where, exactly?

Pages 34 and 35 of the Guide to OSCAL-based FedRAMP System Security Plans (SSP)

Other information

No response

[aj-stein-gsa]

Thanks for the feedback. Constraints, and most importantly clearer documentation and examples, should come in tasks from the upcoming #809 epic. Stay tuned for more details.

UPDATE: Apologies, I made a typo slip up, edited from 807 tracker to 809 as intended.