search

usnistgov / oscal-content

NIST SP 800-53 content and other OSCAL content examples
Other
290 stars 122 forks source link

800-53 rev5 control title deficiencies #112

Closed GaryGapinski closed 1 year ago

GaryGapinski commented 2 years ago

Describe the bug

Errors in control titles (/catalog//control/title elements).

See attached.

Who is the bug affecting?

Users of oscal-content.

What is affected by this bug?

Use of oscal-content to present control information.

When does this occur?

As of this writing.

How do we replicate the issue?

See attached.

{What are the steps to reproduce the behavior?

Perform a text comparison of control titles amongst the sources.

Expected behavior (i.e. solution)

Corrected control titles

Other Comments

XML conversions of the spreadsheets were used.

One class of errors is mishandled abbreviations/acronyms.

There are errors not only in the OSCAL content but in the spreadsheets (the OSCAL content can/could be correct).

Comparisons to the normative SP 800-53 rev5 PDF document rendition are of course not possible (because it is PDF and as well someone chose to CAPITALIZE ALL CONTROL ENHANCEMENT TITLES).

Attachment: table.zip

wendellpiez commented 2 years ago

The table includes around 25 items, maybe half of which are errors in the source OSCAL.

For the others, the spreadsheet-extractor XSLTs must be examined to rectify if they are failing.

Use this opportunity also to document the spreadsheet extractor for future uses.

david-waltermire commented 2 years ago

@wendellpiez Can you analyze where the errors are occurring and create a checklist in this issue identifying the classes and quantities of errors that need to be fixed. We can use this to verify the result of your fixes after the repairs are made.

wendellpiez commented 2 years ago

Noting that errors, where they are found, tend to be in the neighborhood of punctuation such as / (solidus) and ( ) (parentheses).

We could do some top-down inspection to help validate that we have them all.

wendellpiez commented 2 years ago

To look for (at least):

GaryGapinski commented 2 years ago

em dash directly followed by word character

That only works if one anticipates Chicago style. The superior AP style uses spaces around the em dash..

wendellpiez commented 2 years ago

Turns out that's not a problem anywhere in any case. 😎

wendellpiez commented 2 years ago

Worksheet

AC-20(3)

Should this be "Non-organizationally-owned"? Otherwise I don't see an issue. Rev 5 PDF has "NON-ORGANIZATIONALLY OWNED SYSTEMS" (all caps) for the enhancement title (revised from Rev 4 "NON-ORGANIZATIONALLY OWNED SYSTEMS / COMPONENTS / DEVICES").
OSCAL catalog Use of External Systems | Non-organizationally Owned Systems — Restricted Use
800-53 spreadsheet Use of External Systems | Non-organizationally Owned Systems — Restricted Use
800-53b spreadsheet Use of External Systems | Non-organizationally Owned Systems — Restricted Use

CM-7(4)

Apparent lapse in profile spreadsheet extraction (enhancement title dropped after em dash).
OSCAL catalog Least Functionality | Unauthorized Software — Deny-by-exception
800-53 spreadsheet Least Functionality | Unauthorized Software — Deny-by-exception
800-53b spreadsheet Least Functionality | Unauthorized Software

CM-7(5)

Apparent lapse in profile spreadsheet extraction (enhancement title dropped after em dash).
OSCAL catalog Least Functionality | Authorized Software — Allow-by-exception
800-53 spreadsheet Least Functionality | Authorized Software — Allow-by-exception
800-53b spreadsheet Least Functionality | Authorized Software

CP-9(7)

Apparent lapse in profile spreadsheet extraction (enhancement title dropped after em dash).
OSCAL catalog System Backup | Dual Authorization for Deletion or Destruction
800-53 spreadsheet System Backup | Dual Authorization for Deletion or Destruction
800-53b spreadsheet System Backup | Dual Authorization

IA-2

Spreadsheet extractor un-capitalizes after open parenthesis?

The same issue recurs in 13 enhancements when title is expanded.
OSCAL catalog Identification and Authentication (Organizational Users)
800-53 spreadsheet Identification and Authentication (organizational Users)
800-53b spreadsheet Identification and Authentication (organizational Users)

IA-5(15)

Requires correction in source.
OSCAL catalog Authenticator Management | Gsa-approved Products and Services
800-53 spreadsheet Authenticator Management | GSA-approved Products and Services
800-53b spreadsheet Authenticator Management | GSA-approved Products and Services

IA-8(5)

IA-8 title in current version has (correctly) "Identification and Authentication (Non-organizational Users)".

I have no accounting for why 'PIV' might become 'PVI'.
OSCAL catalog Identification and Authentication (non-organizational Users) | Acceptance of PIV-I Credentials
800-53 spreadsheet Identification and Authentication (non-organizational Users) | Acceptance of PVI-I Credentials
800-53b spreadsheet Identification and Authentication (non-organizational Users) | Acceptance of PIV-I Credentials

PE-13(1)

Apparent collapse of em dash to hyphen in spreadsheet extraction?
OSCAL catalog Fire Protection | Detection Systems — Automatic Activation and Notification
800-53 spreadsheet Fire Protection | Detection Systems — Automatic Activation and Notification
800-53b spreadsheet Fire Protection | Detection Systems – Automatic Activation and Notification

PE-13(2)

Another apparent collapse of em dash to hyphen in spreadsheet extraction?
OSCAL catalog Fire Protection | Suppression Systems — Automatic Activation and Notification
800-53 spreadsheet Fire Protection | Suppression Systems — Automatic Activation and Notification
800-53b spreadsheet Fire Protection | Suppression Systems – Automatic Activation and Notification

PE-19(1)

Very strange variance in 800-53b spreadsheet? (A word promoted up from control text?)
OSCAL catalog Information Leakage | National Emissions Policies and Procedures
800-53 spreadsheet Information Leakage | National Emissions Policies and Procedures
800-53b spreadsheet Information Leakage | National Emissions and Tempest Policies and Procedures

PS-3(3)

Very strange variance in 800-53b spreadsheet?
OSCAL catalog Personnel Screening | Information Requiring Special Protective Measures
800-53 spreadsheet Personnel Screening | Information Requiring Special Protective Measures
800-53b spreadsheet Personnel Screening | Information with Special Protective Measures

SA-4(7)

Requires correction in source.
OSCAL catalog Acquisition Process | Niap-approved Protection Profiles
800-53 spreadsheet Acquisition Process | NIAP-approved Protection Profiles
800-53b spreadsheet Acquisition Process | NIAP-approved Protection Profiles

SA-9(8)

Currently the catalog has "Processing and Storage Location — U.S. Jurisdiction". (This looks fine in the file sent with the bug report also.)
OSCAL catalog External System Services | Processing and Storage Location — U.s. Jurisdiction
800-53 spreadsheet External System Services | Processing and Storage Location — U.S. Jurisdiction
800-53b spreadsheet External System Services | Processing and Storage Location — U.S. Jurisdiction

SA-10(2)

Variance in 800-53b spreadsheet extraction? (word dropped).
OSCAL catalog Developer Configuration Management | Alternative Configuration Management Processes
800-53 spreadsheet Developer Configuration Management | Alternative Configuration Management Processes
800-53b spreadsheet Developer Configuration Management | Alternative Configuration Management

SR-2(1)

Requires correction in source.
OSCAL catalog Supply Chain Risk Management Plan | Establish Scrm Team
800-53 spreadsheet Supply Chain Risk Management Plan | Establish SCRM Team
800-53b spreadsheet Supply Chain Risk Management Plan | Establish SCRM Team

Summary / crunch

Requires correction in source

IA-5(15) - "GSA" SA-4(7) - "NIAP" SR-2(1) - "SCRM"

Variances in spreadsheet extraction

Scroll up for the details -

Look okay

wendellpiez commented 2 years ago

Current status: the single problem identified and confirmed in source data is corrected PR #137.

With respect to reported lapses in spreadsheet extraction logic, let's make a spinoff issue to track any down? There is nothing to correct in this repository for those (and nothing to be done if we cannot confirm a cause).

david-waltermire commented 1 year ago

The OSCAL content has been corrected and the NIST RMF team has been notified about the issues in the spreadsheets.