[Question]: How to attach Separation of Duties Matrix to OSCAL SSP

This is a ...

request - need something additional provided

This relates to ...

[ ] the FedRAMP OSCAL Registry
[ ] the FedRAMP OSCAL baselines
[ ] the Guide to OSCAL-based FedRAMP Content
[X] the Guide to OSCAL-based FedRAMP System Security Plans (SSP)
[ ] the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP)
[ ] the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR)
[ ] the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M)
[X] the FedRAMP SSP OSCAL Template (JSON or XML Format)
[ ] the FedRAMP SAP OSCAL Template (JSON or XML Format)
[ ] the FedRAMP SAR OSCAL Template (JSON or XML Format)
[ ] the FedRAMP POA&M OSCAL Template (JSON or XML Format)
[X] the FedRAMP OSCAL Validations

What is your feedback?

When validating an OSCAL SSP with the enhanced oscal-cli (v2.2.0) and the fedramp-external-constraints.xml, the oscal-cli yields the following validation error: [ERROR] [/system-security-plan/back-matter[1]] A FedRAMP SSP must have a Separation of Duties Matrix attached.

We were under the impression that the separation of duties is defined in system-implementation>users>authorized-privileges>functions-performed like so:

"authorized-privileges":[
    {
        "title":"Student Privileges",
        "description":"What functions students can perform",
        "functions-performed":[
            "Learn New Skills",
            "Make Friends",
            "Get House Points"
        ]
    }
]

Is there a Separation of Duties document that is supposed to be linked in back-matter? Or how is this supposed to be attached?

Where, exactly?

enhanced oscal-cli v2.2.0
fedramp-external-constraints.xml
OSCAL SSP v1.1.2

Other information

No response

GSA / fedramp-automation