Closed wendellpiez closed 2 years ago
@wendellpiez Would you please make a PR with the following adjusted text?
If the object fetched cannot be found, or does not parse as an OSCAL catalog or profile, the tool MUST cease processing and provide an error.
Discussed in https://github.com/usnistgov/OSCAL/discussions/1308
Language suggested by @david-waltermire-nist:
For implementation, this implies that formal validation need not always be asserted (and processors are not required to cease for nominal validation errors that do not affect outputs), but that inputs that are clearly not correct (e.g., not OSCAL or not the right kind of OSCAL) can be defended against.