usnistgov / OSCAL

Open Security Controls Assessment Language (OSCAL)
https://pages.nist.gov/OSCAL/
Other
673 stars 182 forks source link

Standardize Accepted-Value Reference props for Implementation parameters #896

Open ghost opened 3 years ago

ghost commented 3 years ago

User Story:

As an OSCAL Application Developer, I would like a standard format to describe references to other assemblies in an implementation parameter

Goals:

Something along these lines would suffice.

  {
          "statements": {
              "ac-1-smt-a-1-a": {
                  "uuid": "c504f6c4-7a24-4e39-b8a3-590a04fe8847",
                  "by-components": {
                      "4e3c-1243-8181-47d38-c9f91-f192a92935": {
                          "uuid": "4e3c1243-8181-47d3-8c9f-91f192a92935",
                          "props": [
                              {
                                  "value": "partially implemented",
                                  "ns": "https://oscal.test.gov",
                                  "uuid": "05cb81ad-32c3-4944-9a10-2db579b6fb2a",
                                  "name": "implementation-status"
                              }
                          ],
                          "description": "This System Component require biometric login",
                          "parameter-settings": {
                              "ac-1-prm-1": {
                                  "props": [
                                      {
                                          "ns": "https://oscal.test.gov",
                                          "name": "role-id",
                                          "value": "asset-administrator"
                                      }
                                  ],
                                  "values": [
                                      "Asset Administrator"
                                  ]
                              },
                              "ac-1-prm-2": {
                                  "values": [
                                      "Mission/business process-level"
                                  ]
                              }
                          }
                      }
                  }
              }
          }
      }

There are parameters that seem to describe component-references, party references role and/or party references and probably more. It's a large catalog.

Dependencies:

Accepted Value standardization consensus

Acceptance Criteria

david-waltermire commented 3 years ago

@SilentEsper Can you provide a list of the property names that are concerning you? A bit more detail will help us figure out how best to address this.

david-waltermire commented 2 years ago

We can add props. We should also consider supporting responsible role here.