usnistgov / OSCAL

Open Security Controls Assessment Language (OSCAL)
https://pages.nist.gov/OSCAL/
Other
660 stars 178 forks source link

Profile support for selection 'with-parent-controls' #1218

Open wendellpiez opened 2 years ago

wendellpiez commented 2 years ago

User Story:

The Profile Resolution specification draft mentions with-parent-controls but the current profile XSD and JSON Schema do not support it.

Goals:

Dependencies:

As currently described in the draft spec, this feature is implemented in the New Improved Profile Resolver currently staged in PR #1207.

Unit tests are also under development.

Acceptance Criteria

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

aj-stein-nist commented 2 years ago

This is a not defect in the current extant Metaschema model, it is a defect in the spec. The spec needs to be updated in the spec for a subsequent profile resolution spec revision. The with-parent-based controls needs to be redefined to make use of the link depends-on relationship which is more appropriate for a variety of relationships, not just parent alone (per conversation in today's triage conversation).