From 3b0ea7515df74b0c213065bc12ee988ef70b2461 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Tue, 22 Jun 2021 12:14:33 -0400 Subject: [PATCH 01/26] Consolidate Schematron and XSpec documents - resources/validations/src/ssp.sch has Schematron - resources/validations/test/ssp.xspec has XSpec --- resources/validations/src/ssp.sch | 1401 ++++++++++ resources/validations/test/ssp.xspec | 3670 ++++++++++++++++++++++++++ 2 files changed, 5071 insertions(+) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index dd206dde1..500e0aba8 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -10,6 +10,9 @@ uri="http://csrc.nist.gov/ns/oscal/1.0" /> + FedRAMP System Security Plan Validations @@ -477,4 +480,1402 @@ + + + Basic resource constraints + + + + + + + A <> element must have a uuid attribute + < uuid=" "> SHOULD have a title + < uuid=" "> must have an <rlink> element + + is referenced from within the document. + + + + Found unknown attachment type « » in resource + + + + A < > element must have an href attribute + + + + + + + + + There are media types. + A media-type attribute must have an allowed value. + + + + + + base64 attachments + + A resource should have a base64 element. + + should have a base64 element. + A resource must have only one base64 element. + + must not have more than one base64 element. + + + A base64 element has a filename attribute + + must have filename attribute. + A base64 element has a media-type attribute + + must have media-type attribute. + + + + A base64 element has content. + base64 element must have text content. + + + + + Constraints for specific attachments + + A FedRAMP + OSCAL SSP must attach the FedRAMP Master Acronym and Glossary. + A FedRAMP + OSCAL SSP must attach the FedRAMP Applicable Laws and Regulations. + + A FedRAMP OSCAL + SSP must attach a User Guide. + A FedRAMP + OSCAL SSP must attach Rules of Behavior. + + A FedRAMP OSCAL SSP must attach a Contingency Plan + + A FedRAMP OSCAL SSP must attach a Configuration Management Plan. + A + FedRAMP OSCAL SSP must attach an Incident Response Plan. + + A FedRAMP OSCAL SSP must attach a Separation of Duties Matrix. + + + + + Policy and Procedure attachments + A FedRAMP SSP must incorporate one policy document and one procedure document for each of the 17 NIST SP 800-54 Revision 4 control + families + + + + + + + + + + lacks policy reference(s) (via by-component link) + + + + + + + + lacks policy attachment resource(s) + + + + + + + + + lacks procedure reference(s) (via by-component link) + + + + + + + + lacks procedure attachment resource(s) + + + + + + + + + + Each SP 800-53 control family must have unique policy and unique procedure documents + + + + document is used in other controls (i.e., it is not unique to implemented-requirement ) + + + + + + + A FedRAMP OSCAL SSP must specify a Privacy Point of Contact + + + + A FedRAMP OSCAL SSP must incorporate a Privacy Point + of Contact role + + A FedRAMP OSCAL SSP must declare a + Privacy Point of Contact responsible party role reference + + A FedRAMP OSCAL + SSP must declare a Privacy Point of Contact responsible party role reference identifying the party by UUID + + + + A FedRAMP OSCAL SSP must define a Privacy Point of + Contact + + + + + + + A FedRAMP OSCAL SSP may need to incorporate a PIA and possibly a SORN + + + + + + incorrect value: should be "yes" or "no" + + + + + + Lacks privacy-sensitive designation + + Missing PTA/PIA qualifying question + #1. + + Missing PTA/PIA qualifying question + #2. + + Missing PTA/PIA qualifying question + #3. + + Missing PTA/PIA qualifying question + #4. + + One + or more of the four PTA questions is missing + + One + or more of the four PTA questions is a duplicate + + + + + + Missing + SORN ID + + + + + + This + FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis + + + + + + + Security Objectives Categorization (FIPS 199) + + + + + + A FedRAMP OSCAL SSP must specify a FIPS 199 categorization. + + A FedRAMP OSCAL SSP must specify a security impact level. + + + + + + + + + A FedRAMP OSCAL SSP must specify an allowed security-sensitivity-level. + + + + + + + + A FedRAMP OSCAL SSP must specify a confidentiality security objective. + + A FedRAMP OSCAL SSP must specify an integrity security objective. + + A FedRAMP OSCAL SSP must specify an availability security objective. + + + + + + + + + There are security-objective-levels: + + A FedRAMP OSCAL SSP must specify an allowed security objective value. + + + + + + + SP 800-60v2r1 Information Types: + + + + A FedRAMP OSCAL SSP must specify at least one information-type. + + + + + + A FedRAMP OSCAL SSP information-type must have a title. + + A FedRAMP OSCAL SSP information-type must have a description. + + A FedRAMP OSCAL SSP information-type must have at least one categorization. + + A FedRAMP OSCAL SSP information-type must have a confidentiality-impact. + + A FedRAMP OSCAL SSP information-type must have a integrity-impact. + + A FedRAMP OSCAL SSP information-type must have a availability-impact. + + + + + + A FedRAMP OSCAL SSP information-type categorization must have a system attribute. + + A FedRAMP OSCAL SSP information-type categorization must have a correct + system attribute. The correct value is "https://doi.org/10.6028/NIST.SP.800-60v2r1". + + A FedRAMP OSCAL SSP information-type categorization must have at least one + information-type-id. + + + + + + + + + Information Types + + + + + A FedRAMP OSCAL SSP information-type-id must have a SP 800-60v2r1 identifier. + + + + + + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a base + element. + + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a selected + element. + + + + + + + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact base or select + element must have an approved value. + + + + + + + + + A FedRAMP OSCAL SSP must specify system inventory items + + + + A FedRAMP OSCAL SSP must populate the system inventory + + + A FedRAMP OSCAL SSP must incorporate inventory-item elements + + A FedRAMP OSCAL SSP must incorporate inventory-item elements. + + + + FedRAMP SSP value constraints + + + asset-id property is unique + asset-id must be unique. + + + + + asset-type property has an allowed value + + asset-type property has an allowed value. + + + + + virtual property has an allowed value + + virtual property has an allowed value. + + + + + public property has an allowed value + + public property has an allowed value. + + + + + allows-authenticated-scan property has an allowed value + + allows-authenticated-scan property has an allowed value. + + + + + is-scanned property has an allowed value + + is-scanned property has an allowed value. + + + + + scan-type property has an allowed value + + scan-type property has an allowed value. + + + + + component has an allowed type + + component has an allowed type. + + + + FedRAMP OSCAL SSP inventory items + + + + All FedRAMP OSCAL SSP inventory-item elements + + inventory-item has a uuid + inventory-item has a uuid. + + inventory-item has an asset-id + inventory-item has an asset-id. + + inventory-item has only one asset-id + inventory-item has only one asset-id. + + inventory-item has an asset-type + inventory-item has an asset-type. + + inventory-item has only one asset-type + inventory-item has only one asset-type. + + inventory-item has virtual property + inventory-item has virtual property. + + inventory-item has only one virtual property + inventory-item has only one virtual property. + + inventory-item has public property + inventory-item has public property. + + inventory-item has only one public property + inventory-item has only one public property. + + inventory-item has scan-type property + inventory-item has scan-type property. + + inventory-item has only one scan-type property + inventory-item has only one scan-type property. + + + + + + "infrastructure" inventory-item has allows-authenticated-scan + "infrastructure" inventory-item has allows-authenticated-scan. + + "infrastructure" inventory-item has only one allows-authenticated-scan property + inventory-item has only one one-allows-authenticated-scan + property. + + "infrastructure" inventory-item has baseline-configuration-name + "infrastructure" inventory-item has baseline-configuration-name. + + "infrastructure" inventory-item has only one baseline-configuration-name + "infrastructure" inventory-item has only one + baseline-configuration-name. + + "infrastructure" inventory-item has a vendor-name property + + "infrastructure" inventory-item has a + vendor-name property. + + "infrastructure" inventory-item has a vendor-name property + + "infrastructure" inventory-item has + only one vendor-name property. + + "infrastructure" inventory-item has a hardware-model property + + "infrastructure" inventory-item has a + hardware-model property. + + "infrastructure" inventory-item has one hardware-model property + "infrastructure" inventory-item has + only one hardware-model property. + + "infrastructure" inventory-item has is-scanned property + "infrastructure" inventory-item has is-scanned property. + + "infrastructure" inventory-item has only one is-scanned property. + + has a scan-type property + + + + + + + "software or database" inventory-item has software-name property + + + "software or database" inventory-item has software-name property. + + "software or database" inventory-item has software-name property. + + "software or database" inventory-item has software-version property + + + "software or database" inventory-item has software-version property. + + "software or database" inventory-item has one software-version + property. + + "software or database" inventory-item has function + + "software or database" inventory-item has function property. + + "software or database" inventory-item has one function property. + + + FedRAMP OSCAL SSP components + + + + A FedRAMP OSCAL SSP component + + component has an asset type. + + component has one asset type. + + + + + + + + There must be a component that represents the entire system itself. It should be the only component with the component-type set to + "system". + + Missing system component + + + + + + + + + Information System Name, Title, and FedRAMP Identifier + + Missing system-id + + Missing system-name + + Missing system-name-short + + + + + + Information System Categorization and FedRAMP Baselines + + Missing + FedRAMP authorization type + + + + + + + XPath: The context for this error is + + + SHOULD optionally have a reference within the document (but does not) + + This element has a media-type="" which is not in the list of allowed media types. Allowed media types are . + + + should have a base64 element. + + must not have more than one base64 element. + + must have a filename attribute. + + must have a media-type attribute. + must have content. + + Invalid "". It must have one of the following values: . + Invalid "". It must have one of the following values: . + This FedRAMP OSCAL SSP lacks a FIPS 199 categorization. + This FedRAMP OSCAL SSP lacks a security impact level. + This FedRAMP OSCAL SSP lacks a confidentiality security objective. + This FedRAMP OSCAL SSP lacks an integrity security objective. + This FedRAMP OSCAL SSP lacks an availability security objective. + + A FedRAMP OSCAL SSP must incorporate inventory-item elements. + + This asset id is not unique. An asset id must be unique within the scope of a FedRAMP OSCAL SSP document. + + + should have a FedRAMP asset type (not ""). + + + must have an allowed value (not ""). + + + must have an allowed value (not ""). + + + must have an allowed value (not ""). + + + must have an allowed value (not ""). + + + must have an allowed value (not ""). + + + must have an allowed component type (not ""). + + + must have a uuid attribute. + + + must have an asset-id property. + + + must have only one asset-id property. + + + must have an asset-type property. + + + must have only one asset-type property. + + + must have virtual property. + + + must have only one virtual property. + + + must have public property. + + + must have only one public property. + + + must have scan-type property. + + + must have only one scan-type property. + + + must have allows-authenticated-scan property. + + + must have only one allows-authenticated-scan property. + + + must have baseline-configuration-name property. + + + must have only one baseline-configuration-name property. + + + must have a vendor-name property. + + + must have only one vendor-name property. + + + must have a hardware-model property. + + + must have only one hardware-model property. + + + must have is-scanned property. + + + must have only one is-scanned property. + + + must have software-name property. + + + must have only one software-name property. + + + must have software-version property. + + + must have only one software-version property. + + + "" must have function property. + + + "" must have only one function property. + + + must have an asset-type property. + + + must have only one asset-type property. + + + diff --git a/resources/validations/test/ssp.xspec b/resources/validations/test/ssp.xspec index 86e094f76..d7a4029a0 100644 --- a/resources/validations/test/ssp.xspec +++ b/resources/validations/test/ssp.xspec @@ -1398,4 +1398,3674 @@ + + + + + + + + + + + + + + + + + + + + + + + title + + + + + + + + title + + + + + + + + + + + rlink + + + + + + + + rlink + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + stuff + + + + + + + + + + stuff + + + + + + + + + + + + + + + stuff + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + stuff + + + + + + + + + + + + + + + + + + + + + + + + stuff + stuff + + + + + + + + + + + + + stuff + + + + + + + + + + + + + stuff + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + db234cb7-1776-425c-9ac4-b067c1723011 + + + + + + + + + + + + + + db234cb7-1776-425c-9ac4-b067c1723011 + + + + + + + + + + + + + + + + db234cb7-1776-425c-9ac4-b067c1723011 + + + + + + + + + + + + + + + + + + + + + + + + + + + + db234cb7-1776-425c-9ac4-b067c1723011 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + db234cb7-1776-425c-9ac4-b067c1723011 + + + + + + + + + + + + + + db234cb7-1776-425c-9ac4-b067c1723011 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Moderate + + + + + + + + Severe + + + + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + + + Moderate + + + + + + Severe + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + C.2.1.1 + + + + + + + + C.2.1.1 + + + + + + + + + C.2.1.1 + + + + + + + + X.2.1.1 + + + + + + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + + Moderate + + + + + + + + Moderate + + + + + + + + + + fips-199-moderate + + + + + + + + fips-199-none + + + + + + + + + + + fips-199-moderate + + + + + + + + fips-199-none + + + + + + + + + + + + Pending until all XSpec tests are correct + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 7c3ff9c9251c78fdc8bea515f21b78b5c8545ad6 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Tue, 22 Jun 2021 12:26:21 -0400 Subject: [PATCH 02/26] Correct build-relative document references --- resources/validations/src/ssp.sch | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 500e0aba8..fb652877c 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -486,7 +486,7 @@ + value="doc(concat($registry-base-path, '/fedramp_values.xml'))//fedramp:value-set[@name = 'attachment-type']//fedramp:enum/@value" /> @@ -550,7 +550,7 @@ + value="doc(concat($registry-base-path, '/fedramp_values.xml'))//fedramp:value-set[@name = 'media-type']//fedramp:enum/@value" /> There are --> + value="doc(concat($registry-base-path, '/fedramp_values.xml'))//fedramp:value-set[@name = 'security-sensitivity-level']//fedramp:enum/@value" />--> @@ -976,7 +976,7 @@ + value="doc(concat($registry-base-path, '/fedramp_values.xml'))//fedramp:value-set[@name = 'security-objective-level']//fedramp:enum/@value" />--> @@ -1077,7 +1077,7 @@ + value="doc(concat($registry-base-path, '/information-types.xml'))//fedramp:information-type/@id" /> + value="doc(concat($registry-base-path, '/fedramp_values.xml'))" /> A FedRAMP OSCAL SSP must specify system inventory items From 03d2331833b3650d7b85ee319547c5b885f209ca Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Tue, 22 Jun 2021 13:51:20 -0400 Subject: [PATCH 03/26] Add Digital Identity Determination validations - and apply XML formatting --- resources/validations/src/ssp.sch | 2275 ++++++--------- resources/validations/test/ssp.xspec | 3998 ++++++++++---------------- 2 files changed, 2518 insertions(+), 3755 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index fb652877c..066f6ff3b 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -2,17 +2,15 @@ xmlns:doc="https://fedramp.gov/oscal/fedramp-automation-documentation" xmlns:o="http://csrc.nist.gov/ns/oscal/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" - xmlns:xsl="http://www.w3.org/1999/XSL/Transform" - > + xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> - + FedRAMP System Security Plan Validations @@ -26,9 +24,10 @@ name="baselines-base-path" select="'../../../baselines/rev4/xml'" /> + value=" + doc(concat($registry-base-path, '/fedramp_values.xml')) | + doc(concat($registry-base-path, '/fedramp_threats.xml')) | + doc(concat($registry-base-path, '/information-types.xml'))" /> - - + + - - + + - + @@ -197,9 +206,9 @@ name="{$value-set/@name}"> + select="$element[@value = current()]" /> + value="{current()}" /> @@ -209,7 +218,7 @@ There are -   +   items total, with @@ -234,7 +243,7 @@ + value="$registry/f:fedramp-values/f:value-set[@name = 'security-sensitivity-level']" /> The registry values at the path ' ' are not present, this configuration is invalid. - [Section C Check 1.a] No sensitivty level found, no more validation processing can occur. - [Section C Check 1.a] is an invalid value of ' @@ -262,7 +271,7 @@ + value="$registry/f:fedramp-values/f:value-set[@name = 'control-implementation-status']" /> + value="$required-controls[o:prop[@name = 'CORE' and @ns = $registry-ns] and @id = $all-missing/@id]" /> The following - are required: + are required: - [Section C Check 3] This SSP has not implemented the most important core - : + : - [Section C Check 2] This SSP has not implemented - overall: + overall: - [Section C Check 2] This SSP has implemented extraneous - not needed given the selected profile: + not needed given the selected profile: + value="$ok-values => lv:analyze(//o:implemented-requirement/o:prop[@name = 'implementation-status'])" /> + value="./o:prop[@name = 'implementation-status']/@value" /> + value="lv:correct($registry/f:fedramp-values/f:value-set[@name = 'control-implementation-status'], $status)" /> + value="$selected-profile/o:catalog//o:part[@name = 'item']" /> - [Section C Check 2] Invalid status ' ' for @@ -341,8 +366,8 @@ test="exists($implemented)">[Section C Check 2] This SSP has implemented a statement for each of the following lettered response points for required controls: . - [Section C Check 2] This SSP has not implemented a statement for each of the following lettered response points for required controls: @@ -359,47 +384,52 @@ value="./o:remarks => normalize-space()" /> - [Section D Checks] Response statements for must have at least - with a description. There are + with a description. There are . - [Section D Checks] Response statement has a description not within a component. That was previously allowed, but not recommended. It will soon be syntactically invalid and deprecated. - [Section D Checks] Response statement has remarks not within a component. That was previously allowed, but not recommended. It will soon be syntactically invalid and deprecated. - - [Section D Checks] - Response statment - with component reference UUID ' - ' is not in the system implementation inventory, and cannot be used to define a control. - [Section D Checks] Response statement - has a component, but that component is missing a required description - node. + + [Section D Checks] + Response statment + with component reference UUID ' + ' is not in the system implementation inventory, and cannot be used to define a + control. + [Section D Checks] Response statement + has a component, but that component is missing a required description node. + @@ -407,8 +437,8 @@ value=". => normalize-space()" /> - [Section D Checks] Response statement component description for is too short with @@ -422,8 +452,8 @@ value=". => normalize-space()" /> - [Section D Checks] Response statement component remarks for is too short with @@ -441,27 +471,35 @@ value="$responsible-parties[not(@role-id = $roles/@id)]" /> - [Section C Check 2] This SSP has defined a responsible party with - not defined in the role: + not defined in the role: - [Section C Check 2] This SSP has defined a responsible party with - is not a defined party: + is not a defined party: - [Section B Check ????] This SSP includes back-matter resource missing a UUID - [Section B Check ????] This SSP references back-matter resource: @@ -470,72 +508,60 @@ value="@filename" /> - [Section B Check ????] This SSP has file name: - [Section B Check ????] This SSP has media type: - - + Basic resource constraints - - - + + - + - A <> element must have a uuid attribute - < uuid=" "> SHOULD have a title - < uuid=" "> must have an <rlink> element - - is referenced from within the document. + A < + > element must have a uuid attribute + < + uuid=" + "> SHOULD have a title + < + uuid=" + "> must have an <rlink> element + + is referenced from within the document. - - - Found unknown attachment type « » in + Found unknown attachment type « + » in + resource - - - A < > element must have an href attribute + + A < + > element must have an href attribute @@ -543,1339 +569,922 @@ role="warning" test="$WARNING and @media-type">the <> element SHOULD have a media-type attribute--> - - - - - There are media types. - A media-type attribute must have an allowed value. - + + + There are + media types. + A media-type attribute must have an allowed value. - base64 attachments - - A resource should have a base64 element. + + A resource should have a base64 element. - should have a base64 element. - A resource must have only one base64 element. + should have a base64 element. + A resource must have only one base64 element. - must not have more than one base64 element. + must not have more than one base64 element. - - A base64 element has a filename attribute + + A base64 element has a filename attribute - must have filename attribute. - A base64 element has a media-type attribute + must have filename attribute. + A base64 element has a media-type attribute - must have media-type attribute. + must have media-type attribute. - A base64 element has content. + A base64 element has content. base64 element must have text content. Constraints for specific attachments - - A FedRAMP - OSCAL SSP must attach the FedRAMP Master Acronym and Glossary. - A FedRAMP - OSCAL SSP must attach the FedRAMP Applicable Laws and Regulations. - - A FedRAMP OSCAL - SSP must attach a User Guide. - A FedRAMP - OSCAL SSP must attach Rules of Behavior. - - A FedRAMP OSCAL SSP must attach a Contingency Plan - - A FedRAMP OSCAL SSP must attach a Configuration Management Plan. - A - FedRAMP OSCAL SSP must attach an Incident Response Plan. - - A FedRAMP OSCAL SSP must attach a Separation of Duties Matrix. + + A + FedRAMP OSCAL SSP must attach the FedRAMP Master Acronym and Glossary. + A + FedRAMP OSCAL SSP must attach the FedRAMP Applicable Laws and Regulations. + + A + FedRAMP OSCAL SSP must attach a User Guide. + A + FedRAMP OSCAL SSP must attach Rules of Behavior. + + A FedRAMP OSCAL SSP must attach a Contingency Plan + + A FedRAMP OSCAL SSP must attach a Configuration Management Plan. + + A FedRAMP OSCAL SSP must attach an Incident Response Plan. + + A FedRAMP OSCAL SSP must attach a Separation of Duties Matrix. - Policy and Procedure attachments A FedRAMP SSP must incorporate one policy document and one procedure document for each of the 17 NIST SP 800-54 Revision 4 control - families - + families - - - - - - - lacks policy reference(s) (via by-component link) + + + + + lacks policy reference(s) (via by-component link) - - - - + - - - lacks policy attachment resource(s) - + + + lacks policy attachment resource(s) + - - - - - - lacks procedure reference(s) (via by-component link) + + + + lacks procedure reference(s) (via by-component link) - - - - + - - - lacks procedure attachment resource(s) - + + + lacks procedure attachment resource(s) + - - - - - + Each SP 800-53 control family must have unique policy and unique procedure documents - - - - + document is used in other controls (i.e., it is not unique to implemented-requirement ) - + @href = (: all controls except the current :) (//oscal:implemented-requirement[matches(@control-id, '^[a-z]{2}-1$')] except $ir) (: all their @hrefs :)/descendant::oscal:by-component/oscal:link[@rel = 'policy']/@href"> + document + is used in other controls (i.e., it is not unique to implemented-requirement + ) - - A FedRAMP OSCAL SSP must specify a Privacy Point of Contact - - - - A FedRAMP OSCAL SSP must incorporate a Privacy Point - of Contact role - - A FedRAMP OSCAL SSP must declare a - Privacy Point of Contact responsible party role reference - - A FedRAMP OSCAL - SSP must declare a Privacy Point of Contact responsible party role reference identifying the party by UUID - - - - A FedRAMP OSCAL SSP must define a Privacy Point of - Contact - + + A FedRAMP OSCAL SSP must incorporate a + Privacy Point of Contact role + A FedRAMP OSCAL SSP must + declare a Privacy Point of Contact responsible party role reference + A + FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference identifying the party by + UUID + + A FedRAMP OSCAL SSP must define a Privacy + Point of Contact - - A FedRAMP OSCAL SSP may need to incorporate a PIA and possibly a SORN - - - - - incorrect value: should be "yes" or "no" - + + incorrect value: should be "yes" or "no" - - - - Lacks privacy-sensitive designation - - Missing PTA/PIA qualifying question - #1. - - Missing PTA/PIA qualifying question - #2. - - Missing PTA/PIA qualifying question - #3. - - Missing PTA/PIA qualifying question - #4. - - + Lacks privacy-sensitive designation + Missing PTA/PIA qualifying + question #1. + Missing PTA/PIA qualifying + question #2. + Missing PTA/PIA qualifying + question #3. + Missing PTA/PIA qualifying + question #4. + One - or more of the four PTA questions is missing - - One or more of the +four PTA questions is missing + One - or more of the four PTA questions is a duplicate - + satisfies exists(oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = $name][2]))">One or more of +the four PTA questions is a duplicate - - - - Missing - SORN ID - + + + Missing SORN ID - - - - + This - FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis - + satisfies $answer = 'no' or oscal:resource[oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @name = 'type' and @value = 'pia']] (: a PIA is attached :)"> + This FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis - - + Security Objectives Categorization (FIPS 199) - - - + - - A FedRAMP OSCAL SSP must specify a FIPS 199 categorization. - - A FedRAMP OSCAL SSP must specify a security impact level. - + A FedRAMP OSCAL SSP must specify a FIPS 199 categorization. + A FedRAMP OSCAL SSP must specify a security impact level. - - - + - - - A FedRAMP OSCAL SSP must specify an allowed security-sensitivity-level. - + + A FedRAMP OSCAL SSP must specify an allowed + security-sensitivity-level. - - - + - - A FedRAMP OSCAL SSP must specify a confidentiality security objective. - - A FedRAMP OSCAL SSP must specify an integrity security objective. - - A FedRAMP OSCAL SSP must specify an availability security objective. - - + A FedRAMP OSCAL SSP must specify a confidentiality security + objective. + A FedRAMP OSCAL SSP must specify an integrity security objective. + A FedRAMP OSCAL SSP must specify an availability security + objective. - - - + - - There are security-objective-levels: - - A FedRAMP OSCAL SSP must specify an allowed security objective value. - + + There are + security-objective-levels: + + A FedRAMP OSCAL SSP must specify an allowed security objective + value. - - + SP 800-60v2r1 Information Types: - - - - A FedRAMP OSCAL SSP must specify at least one information-type. - + + A FedRAMP OSCAL SSP must specify at least one information-type. - - - - A FedRAMP OSCAL SSP information-type must have a title. - - A FedRAMP OSCAL SSP information-type must have a description. - - A FedRAMP OSCAL SSP information-type must have at least one categorization. - - A FedRAMP OSCAL SSP information-type must have a confidentiality-impact. - - A FedRAMP OSCAL SSP information-type must have a integrity-impact. - - A FedRAMP OSCAL SSP information-type must have a availability-impact. - + + A FedRAMP OSCAL SSP information-type must have a title. + A FedRAMP OSCAL SSP information-type must have a description. + A FedRAMP OSCAL SSP information-type must have at least one categorization. + A FedRAMP OSCAL SSP information-type must have a confidentiality-impact. + A FedRAMP OSCAL SSP information-type must have a integrity-impact. + A FedRAMP OSCAL SSP information-type must have a availability-impact. - - - - A FedRAMP OSCAL SSP information-type categorization must have a system attribute. - - A FedRAMP OSCAL SSP information-type categorization must have a correct - system attribute. The correct value is "https://doi.org/10.6028/NIST.SP.800-60v2r1". - - A FedRAMP OSCAL SSP information-type categorization must have at least one - information-type-id. - + + A FedRAMP OSCAL SSP information-type categorization must have a system attribute. + A FedRAMP OSCAL SSP information-type categorization must have a + correct system attribute. The correct value is "https://doi.org/10.6028/NIST.SP.800-60v2r1". + A FedRAMP OSCAL SSP information-type categorization must have at least one + information-type-id. - - - - + Information Types - - - + - A FedRAMP OSCAL SSP information-type-id must have a SP 800-60v2r1 identifier. - + A FedRAMP OSCAL SSP information-type-id must have a SP 800-60v2r1 + identifier. - - - - A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a base - element. - - A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a selected - element. - + + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a base + element. + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a + selected element. - - - - - A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact base or select - element must have an approved value. + + + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact base or + select element must have an approved value. + + + + Digital Identity Determination + + A + FedRAMP OSCAL SSP must have a Digital Identity Determination property. + A FedRAMP OSCAL SSP may have a Digital Identity Determination + identity-assurance-level property. + A FedRAMP OSCAL SSP may have a Digital Identity Determination + authenticator-assurance-level property. + A FedRAMP OSCAL SSP may have a Digital Identity Determination + federation-assurance-level property. + + + + A FedRAMP OSCAL SSP must have a Digital Identity Determination property with an + allowed value. + + + + + A FedRAMP OSCAL SSP should have an allowed Digital Identity Determination + identity-assurance-level property. + + + + + A FedRAMP OSCAL SSP should have an allowed Digital Identity Determination + authenticator-assurance-level property. + + + + + A FedRAMP OSCAL SSP should have an allowed Digital Identity Determination + federation-assurance-level property. - - - - - + A FedRAMP OSCAL SSP must specify system inventory items - - - + A FedRAMP OSCAL SSP must populate the system inventory - A FedRAMP OSCAL SSP must incorporate inventory-item elements - - A FedRAMP OSCAL SSP must incorporate inventory-item elements. - + A FedRAMP OSCAL SSP must incorporate inventory-item elements. - FedRAMP SSP value constraints - - + asset-id property is unique - asset-id must be unique. - + asset-id must be unique. - - + asset-type property has an allowed value - - asset-type property has an allowed value. - + + asset-type property has an allowed value. - - + virtual property has an allowed value - - virtual property has an allowed value. - + + virtual property has an allowed value. - - + public property has an allowed value - - public property has an allowed value. - + + public property has an allowed value. - - + allows-authenticated-scan property has an allowed value - - allows-authenticated-scan property has an allowed value. - + + allows-authenticated-scan property has an allowed value. - - + is-scanned property has an allowed value - - is-scanned property has an allowed value. - + + is-scanned property has an allowed value. - - + scan-type property has an allowed value - - scan-type property has an allowed value. - + + scan-type property has an allowed value. - - + component has an allowed type - - component has an allowed type. - + + component has an allowed type. - FedRAMP OSCAL SSP inventory items - - - + All FedRAMP OSCAL SSP inventory-item elements - inventory-item has a uuid - inventory-item has a uuid. - + inventory-item has a uuid. inventory-item has an asset-id - inventory-item has an asset-id. - + inventory-item has an asset-id. inventory-item has only one asset-id - inventory-item has only one asset-id. - + inventory-item has only one asset-id. inventory-item has an asset-type - inventory-item has an asset-type. - + inventory-item has an asset-type. inventory-item has only one asset-type - inventory-item has only one asset-type. - + inventory-item has only one asset-type. inventory-item has virtual property - inventory-item has virtual property. - + inventory-item has virtual property. inventory-item has only one virtual property - inventory-item has only one virtual property. - + inventory-item has only one virtual property. inventory-item has public property - inventory-item has public property. - + inventory-item has public property. inventory-item has only one public property - inventory-item has only one public property. - + inventory-item has only one public property. inventory-item has scan-type property - inventory-item has scan-type property. - + inventory-item has scan-type property. inventory-item has only one scan-type property - inventory-item has only one scan-type property. - + inventory-item has only one scan-type property. - - - + "infrastructure" inventory-item has allows-authenticated-scan - "infrastructure" inventory-item has allows-authenticated-scan. - + "infrastructure" inventory-item has + allows-authenticated-scan. "infrastructure" inventory-item has only one allows-authenticated-scan property - inventory-item has only one one-allows-authenticated-scan - property. - + inventory-item has only one one-allows-authenticated-scan + property. "infrastructure" inventory-item has baseline-configuration-name - "infrastructure" inventory-item has baseline-configuration-name. - + "infrastructure" inventory-item has + baseline-configuration-name. "infrastructure" inventory-item has only one baseline-configuration-name - "infrastructure" inventory-item has only one - baseline-configuration-name. - + "infrastructure" inventory-item has only one + baseline-configuration-name. "infrastructure" inventory-item has a vendor-name property - "infrastructure" inventory-item has a - vendor-name property. - + "infrastructure" inventory-item has a + vendor-name property. "infrastructure" inventory-item has a vendor-name property - "infrastructure" inventory-item has - only one vendor-name property. - + "infrastructure" + inventory-item has only one vendor-name property. "infrastructure" inventory-item has a hardware-model property - "infrastructure" inventory-item has a - hardware-model property. - + "infrastructure" inventory-item has + a hardware-model property. "infrastructure" inventory-item has one hardware-model property - "infrastructure" inventory-item has - only one hardware-model property. - + "infrastructure" + inventory-item has only one hardware-model property. "infrastructure" inventory-item has is-scanned property - "infrastructure" inventory-item has is-scanned property. - - "infrastructure" inventory-item has only one is-scanned property. - + "infrastructure" inventory-item has is-scanned property. + "infrastructure" inventory-item has only one is-scanned + property. has a scan-type property - - + - "software or database" inventory-item has software-name property - - "software or database" inventory-item has software-name property. - - "software or database" inventory-item has software-name property. - + "software or database" inventory-item has software-name property. + "software or database" inventory-item has software-name + property. "software or database" inventory-item has software-version property - - "software or database" inventory-item has software-version property. - - "software or database" inventory-item has one software-version - property. - + "software or database" inventory-item has software-version + property. + "software or database" inventory-item has one software-version + property. "software or database" inventory-item has function - "software or database" inventory-item has function property. - - "software or database" inventory-item has one function property. - + "software or database" inventory-item has function property. + "software or database" inventory-item has one function property. FedRAMP OSCAL SSP components - - - + A FedRAMP OSCAL SSP component - - component has an asset type. - - component has one asset type. - + component has an asset type. + component has one asset type. - - - + There must be a component that represents the entire system itself. It should be the only component with the component-type set to - "system". - - Missing system component - + "system". + Missing system component - - - - - + Information System Name, Title, and FedRAMP Identifier - - Missing system-id - - Missing system-name - - Missing system-name-short - + Missing system-id + Missing system-name + Missing system-name-short - - - + Information System Categorization and FedRAMP Baselines - - Missing - FedRAMP authorization type - + + Missing FedRAMP authorization type - - - XPath: The context for this error is - - - SHOULD optionally have a reference within the document (but does not) - - This element has a media-type="" which is not in the list of allowed media types. Allowed media types are . - - - should have a base64 element. - - must not have more than one base64 element. - - must have a filename attribute. - - must have a media-type attribute. - must have content. - - Invalid "". It must have one of the following values: . - Invalid "". It must have one of the following values: . - This FedRAMP OSCAL SSP lacks a FIPS 199 categorization. - This FedRAMP OSCAL SSP lacks a security impact level. - This FedRAMP OSCAL SSP lacks a confidentiality security objective. - This FedRAMP OSCAL SSP lacks an integrity security objective. - This FedRAMP OSCAL SSP lacks an availability security objective. - - A FedRAMP OSCAL SSP must incorporate inventory-item elements. - - This asset id is not unique. An asset id must be unique within the scope of a FedRAMP OSCAL SSP document. - - - should have a FedRAMP asset type (not ""). - - - must have an allowed value (not ""). - - - must have an allowed value (not ""). - - - must have an allowed value (not ""). - - - must have an allowed value (not ""). - - - must have an allowed value (not ""). - - - must have an allowed component type (not ""). - - - must have a uuid attribute. - - - must have an asset-id property. - - - must have only one asset-id property. - - - must have an asset-type property. - - - must have only one asset-type property. - - - must have virtual property. - - - must have only one virtual property. - - - must have public property. - - - must have only one public property. - - - must have scan-type property. - - - must have only one scan-type property. - - - must have allows-authenticated-scan property. - - - must have only one allows-authenticated-scan property. - - - must have baseline-configuration-name property. - - - must have only one baseline-configuration-name property. - - - must have a vendor-name property. - - - must have only one vendor-name property. - - - must have a hardware-model property. - - - must have only one hardware-model property. - - - must have is-scanned property. - - - must have only one is-scanned property. - - - must have software-name property. - - - must have only one software-name property. - - - must have software-version property. - - - must have only one software-version property. - - - "" must have function property. - - - "" must have only one function property. - - - must have an asset-type property. - - - must have only one asset-type property. - + XPath: The context for this error is + + + SHOULD optionally have a reference within the document (but does not) + This + element has a media-type=" + " which is not in the list of allowed media types. Allowed media types are + . + + should have a base64 element. + + must not have more than one base64 element. + + must have a filename attribute. + + must have a media-type attribute. + + must have content. + Invalid + " + ". It must have one of the following + values: + . + Invalid + " + ". It must have one of the following + values: + . + This FedRAMP OSCAL SSP lacks a FIPS 199 categorization. + This FedRAMP OSCAL SSP lacks a security impact level. + This FedRAMP OSCAL SSP lacks a confidentiality security + objective. + This FedRAMP OSCAL SSP lacks an integrity security + objective. + This FedRAMP OSCAL SSP lacks an availability security + objective. + A FedRAMP OSCAL SSP must incorporate inventory-item elements. + This asset id + is not unique. An asset id must be unique within the scope of a FedRAMP OSCAL SSP + document. + + should have a FedRAMP asset type + (not " + "). + + must have an allowed value + (not " + "). + + must have an allowed value + (not " + "). + + must have an allowed value + (not " + "). + + must have an allowed value + (not " + "). + + must have an allowed value + (not " + "). + + must have an allowed component type + (not " + "). + + must have a uuid attribute. + + must have an asset-id property. + + must have only one asset-id property. + + must have an asset-type property. + + must have only one asset-type property. + + must have virtual property. + + must have only one virtual property. + + must have public property. + + must have only one public property. + + must have scan-type property. + + must have only one scan-type property. + + must have allows-authenticated-scan property. + + must have only one allows-authenticated-scan property. + + must have baseline-configuration-name property. + + must have only one baseline-configuration-name property. + + must have a vendor-name property. + + must have only one vendor-name property. + + must have a hardware-model property. + + must have only one hardware-model property. + + must have is-scanned property. + + must have only one is-scanned property. + + must have software-name property. + + must have only one software-name property. + + must have software-version property. + + must have only one software-version property. + + " + " must have function property. + + " + " must have only one function property. + + must have an asset-type property. + + must have only one asset-type property. - diff --git a/resources/validations/test/ssp.xspec b/resources/validations/test/ssp.xspec index d7a4029a0..f1e10039b 100644 --- a/resources/validations/test/ssp.xspec +++ b/resources/validations/test/ssp.xspec @@ -210,7 +210,7 @@ - + @@ -231,7 +231,7 @@ - + @@ -255,7 +255,7 @@ - + @@ -1003,7 +1003,7 @@ - + @@ -1029,7 +1029,7 @@ - + @@ -1044,38 +1044,38 @@ - + + label="DI Worksheet" /> - + + label="PTA" /> - + + label="CIS Workbook" /> - + + label="FIPS-199" /> - + + label="Inventory" /> @@ -1109,7 +1109,8 @@ - + @@ -1130,7 +1131,8 @@ - + @@ -1151,7 +1153,8 @@ - + @@ -1169,7 +1172,8 @@ - + @@ -1187,7 +1191,8 @@ - + @@ -1208,7 +1213,8 @@ - + @@ -1229,7 +1235,8 @@ - + @@ -1398,240 +1405,162 @@ - - - - - + + + + - + - + - + - + - + - - - + + - + title - + - + - + title - + - - - + + - + rlink - + - + - + rlink - + - - - - + + - - + + - + - + - + - + - + - + - - - - + + - + - stuff + stuff - + - + - + - stuff + stuff - + - - - - + - + - stuff + stuff - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + - - - + - + - stuff + stuff - - + - + - + db234cb7-1776-425c-9ac4-b067c1723011 - + - + - - + + - + - - + + db234cb7-1776-425c-9ac4-b067c1723011 - + - + - + - + - + - + - + - - + + - + - - + + db234cb7-1776-425c-9ac4-b067c1723011 - + - + - + - + - - + + - + - + - - + + - + - - + + db234cb7-1776-425c-9ac4-b067c1723011 - + - + - + - + - - + + db234cb7-1776-425c-9ac4-b067c1723011 - + - + - - - - + + + + - - + + - + - + - + - - - - + + + + - - + + - + - - - - - + + + - + Moderate - + - + - + Moderate - + - - - + + - + - + - + - + - + - - - + + - + Moderate - + - + - + Severe - + - - - + + - + Moderate - + - + - + Moderate - + - + - + Moderate - + - + - + Moderate - + - + - + Moderate - + - + - + Moderate - + - - - + + - Moderate + Moderate - + - + - Severe + Severe - + - - - - - - + + + - + - + - + - + - + - - - - + + - + - + - + - + - + - - + - + - + - + - + - + - - + - + - + - + - + - + - - + - + - + - + - + - + - - + - + - + - + - + - + - - + - + - + - + - + - + - - - - - + + - + - + - + - + - + - - + - + - + - + - + - + - - + - + C.2.1.1 - + - + - + C.2.1.1 - + - - + - + C.2.1.1 - + - + - + X.2.1.1 - + - - - - - + + - + Moderate - + - + - + Moderate - + - - + - + Moderate - + - + - + Moderate - + - - - + + - + fips-199-moderate - + - + - + fips-199-none - + - - - + + - + fips-199-moderate - + - + - + fips-199-none - + - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Pending until all XSpec tests are correct - - - - - + + + - + - + - + - + - + - - - - + + - - + + - + - + - - + + - - + + - + - - - + + - - + + - + - + - - + + - + - - + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - + + - + - - - + + - + - + - + - + - + - - - + + + + + + + + - + - - - - - + - - - - + + - + - + - + - + - - - - - + + + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - - + + + - + - - + - - + + - + - + - - + + - - - - - + + + + - - + + - + - + - - - + + + - + - - - + + - - + + - + - + - - - + + + - + - - + - - + + - + - + - - + + - - - - - + + + + - - + + - + - + - - - + + + - + - - + - - + + - + - + - - + + - - - - - + + + + - - + + - + - + - - - + + + - + - - - + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - - + + + - + - - + - - - + + + - + - + - - - + + + - - - - - + + + + - - - + + + - + - + - - - - + + + + - + - - + - - - + + + - + - + - - - + + + - - - - - + + + + - - - + + + - + - + - - - + + + - + - - + - - + + + - + - + - - + + + - - - - - + + + + - - + + + - + - + - - - + + + + - + - - - + + - - + + + - + - + - - + + + - + - - - + + - - + + + - + - + - - - + + + + - + - - - + + - - + + + - + - + - - + + + - + - - - + + - - + + + - + - + - - - + + + + - + - - - + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - - + + + - + - - - + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - - + + + - + - - - + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - - + + + - + - - - + + - - + + - + - + - - + + - + - - - + + - - + + - + - + - - - + + + - + - - + - - + + - + - + - - + + - + - - - - - From eb9f8931087a223bb7f2e1c26eca38a0557a546d Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Wed, 23 Jun 2021 03:26:59 -0400 Subject: [PATCH 04/26] Add media-types --- resources/xml/fedramp_values.xml | 64 ++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/resources/xml/fedramp_values.xml b/resources/xml/fedramp_values.xml index 432eaa402..339d34754 100644 --- a/resources/xml/fedramp_values.xml +++ b/resources/xml/fedramp_values.xml @@ -539,5 +539,69 @@ Penetration Test Lead + + + Resource Media Types + A subset of IANA media types expected to be encountered. + + + + application/gzip + application/msword + application/octet-stream + application/pdf + application/vnd.ms-excel + application/vnd.ms-works + application/vnd.oasis.opendocument.graphics + application/vnd.oasis.opendocument.presentation + application/vnd.oasis.opendocument.spreadsheet + application/vnd.oasis.opendocument.text + application/vnd.openxmlformats-officedocument.presentationml.presentation + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet + application/vnd.openxmlformats-officedocument.wordprocessingml.document + application/x-bzip + application/x-bzip2 + application/x-tar + application/zip + image/bmp + image/jpeg + image/png + image/tiff + image/webp + image/svg+xml + text/csv + text/html + text/plain + + From 083ac2ba9ccc684a95b213c0caab662548ad091b Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Wed, 23 Jun 2021 05:03:15 -0400 Subject: [PATCH 05/26] Minor refactoring - use global $fedramp-values variable - change some assertion messages to affirmative - attempt to minimize HTML Tidy's erroneous whitespace handling - remove OBE TODOs --- resources/validations/src/ssp.sch | 149 ++++++++++++------------------ 1 file changed, 59 insertions(+), 90 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 066f6ff3b..41d88594d 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -518,34 +518,29 @@ + + Basic resource constraints + value="$fedramp-values//fedramp:value-set[@name = 'attachment-type']//fedramp:enum/@value" /> - - A < - > element must have a uuid attribute + test="@uuid">A resource must have a uuid attribute. < - uuid=" - "> SHOULD have a title + test="oscal:title">A resource SHOULD have a title. < - uuid=" - "> must have an <rlink> element + test="oscal:rlink">A resource must have a rlink element - is referenced from within the document. + test="@uuid = (//@href[matches(., '^#')] ! substring-after(., '#'))">A resource should be referenced from within the + document. + value="$fedramp-values//fedramp:value-set[@name = 'media-type']//fedramp:enum/@value" /> There are media types. @@ -611,9 +606,6 @@ test="@media-type">A base64 element has a media-type attribute must have media-type attribute. - - - + value="$fedramp-values//fedramp:value-set[@name = 'security-sensitivity-level']//fedramp:enum/@value" />--> + value="$fedramp-values//fedramp:value-set[@name = 'security-objective-level']//fedramp:enum/@value" />--> - A FedRAMP OSCAL SSP must specify system inventory items @@ -1163,7 +1153,7 @@ the four PTA questions is a duplicate inventory-item has only one one-allows-authenticated-scan + test="not(oscal:prop[@name = 'allows-authenticated-scan'][2])">inventory-item has one-allows-authenticated-scan property. "infrastructure" inventory-item has baseline-configuration-name XPath: The context for this error is - SHOULD optionally have a reference within the document (but does not) + id="resource-is-referenced-diagnostic">This resource SHOULD optionally have a reference within the document (but does + not). This - element has a media-type=" + element has a media-type=" " which is not in the list of allowed media types. Allowed media types are . - should have a base64 element. + xmlns="http://csrc.nist.gov/ns/oscal/1.0">This resource should have a base64 element. - must not have more than one base64 element. + xmlns="http://csrc.nist.gov/ns/oscal/1.0">This resource must not have more than one base64 element. - must have a filename attribute. + xmlns="http://csrc.nist.gov/ns/oscal/1.0">This base64 must have a filename attribute. - must have a media-type attribute. + xmlns="http://csrc.nist.gov/ns/oscal/1.0">This base64 must have a media-type attribute. - must have content. - Invalid - " + xmlns="http://csrc.nist.gov/ns/oscal/1.0">This base64 must have content. + Invalid security-sensitivity-level " ". It must have one of the following values: . @@ -1364,12 +1348,12 @@ the four PTA questions is a duplicate document. - should have a FedRAMP asset type + should have a FedRAMP asset type (not " "). - must have an allowed value + must have an allowed value (not " "). (not " "). - must have a uuid attribute. + id="inventory-item-has-uuid-diagnostic">This inventory-item must have a uuid attribute. - must have an asset-id property. + id="has-asset-id-diagnostic">This inventory-item must have an asset-id property. - must have only one asset-id property. + id="has-one-asset-id-diagnostic">This inventory-item must have only one asset-id property. - must have an asset-type property. + id="inventory-item-has-asset-type-diagnostic">This inventory-item must have an asset-type property. - must have only one asset-type property. + id="inventory-item-has-one-asset-type-diagnostic">This inventory-item must have only one asset-type + property. - must have virtual property. + id="inventory-item-has-virtual-diagnostic">This inventory-item must have virtual property. - must have only one virtual property. + id="inventory-item-has-one-virtual-diagnostic">This inventory-item must have only one virtual property. - must have public property. + id="inventory-item-has-public-diagnostic">This inventory-item must have public property. - must have only one public property. + id="inventory-item-has-one-public-diagnostic">This inventory-item must have only one public property. - must have scan-type property. + id="inventory-item-has-scan-type-diagnostic">This inventory-item must have scan-type property. - must have only one scan-type property. + id="inventory-item-has-one-scan-type-diagnostic">This inventory-item must have only one scan-type property. - must have allows-authenticated-scan property. + id="inventory-item-has-allows-authenticated-scan-diagnostic">This inventory-item must have allows-authenticated-scan + property. - must have only one allows-authenticated-scan property. + id="inventory-item-has-one-allows-authenticated-scan-diagnostic">This inventory-item must have only one + allows-authenticated-scan property. - must have baseline-configuration-name property. + id="inventory-item-has-baseline-configuration-name-diagnostic">This inventory-item must have baseline-configuration-name + property. - must have only one baseline-configuration-name property. + id="inventory-item-has-one-baseline-configuration-name-diagnostic">This inventory-item must have only one + baseline-configuration-name property. - must have a vendor-name property. + id="inventory-item-has-vendor-name-diagnostic">This inventory-item must have a vendor-name property. - must have only one vendor-name property. + id="inventory-item-has-one-vendor-name-diagnostic">This inventory-item must have only one vendor-name + property. - must have a hardware-model property. + id="inventory-item-has-hardware-model-diagnostic">This inventory-item must have a hardware-model property. - must have only one hardware-model property. + id="inventory-item-has-one-hardware-model-diagnostic">This inventory-item must have only one hardware-model + property. - must have is-scanned property. + id="inventory-item-has-is-scanned-diagnostic">This inventory-item must have is-scanned property. - must have only one is-scanned property. + id="inventory-item-has-one-is-scanned-diagnostic">This inventory-item must have only one is-scanned + property. - must have software-name property. + id="inventory-item-has-software-name-diagnostic">This inventory-item must have software-name property. - must have only one software-name property. + id="inventory-item-has-one-software-name-diagnostic">This inventory-item must have only one software-name + property. - must have software-version property. + id="inventory-item-has-software-version-diagnostic">This inventory-item must have software-version property. - must have only one software-version property. + id="inventory-item-has-one-software-version-diagnostic">This inventory-item must have only one software-version + property. " From b78019e36659e2b8ad9550da0db9b6ede0818ec7 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Wed, 23 Jun 2021 10:54:57 -0400 Subject: [PATCH 06/26] Add FIPS 140 (CMVP) validations - use @pending rather than x:pending for system inventory unit tests - make pending "when the media-type attribute lacks an allowed value " XSpec test --- resources/validations/src/ssp.sch | 16 + resources/validations/test/ssp.xspec | 1440 ++++++++++++++------------ 2 files changed, 817 insertions(+), 639 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 41d88594d..61e5a0b7e 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -810,6 +810,22 @@ the four PTA questions is a duplicate This FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis + + + FIPS 140 Validation + + A FedRAMP OSCAL SSP must + incorporate one or more FIPS 140 validated products. + + + A validation component or inventory-item must have a validation-reference + property. + + Security Objectives Categorization (FIPS 199) diff --git a/resources/validations/test/ssp.xspec b/resources/validations/test/ssp.xspec index f1e10039b..e957aa82b 100644 --- a/resources/validations/test/ssp.xspec +++ b/resources/validations/test/ssp.xspec @@ -2757,6 +2757,170 @@ + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + + + FIPS 140-2 Validation + +

FIPS 140-2 Validation

+ + + + + + + + + + @@ -3372,34 +3536,227 @@ - - Pending until all XSpec tests are correct - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - + + + - + - + - - - - - + + + - + - + @@ -3407,7 +3764,7 @@ value="1" /> - @@ -3415,811 +3772,616 @@ - - + value="2" /> - - + + + + + + + + + + + + + + + + + - + - - + + - - + - + - - + + - - + + + + + + + + + + + + + + + + + - + - - + + - - + + + + + + + + + + + + + + + + + - + - - + + - - + - + + + - - + + + - - + - + + + - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + - + - + - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - + + + + + + + + + + + + + + + + + + + + + - + + - + - + - + + - - - - - - - - - - - - - - - - - - - - + - + + + + + + + + + + + + + + + + + + + + + - + + - + - + - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - + + + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + - + - + + - + - + + + - + - + - - - - - - - - - - - - - - - - - - - + + + + + + + + - + + + - + - + - + - + + - + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + - - - - - - - - - - - - - - - - - - - + + + + + + + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + - - - - - - - - - - - - - - - - - - - + + + + + + + + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + - - - - - - - - - - - - - - - - - + + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + - - - - - - - - - - - - - - - - - + + + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + - - - - - - - - - - - - - - - - - + + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + - - - - - - - - - - - - - - - - - + + + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + - + + + - + - + - + - + + - + - + + + + + + + + + + + + + + + + + - + From 2c9f9243a8752fbfffdd75e03f03e26ae4f6fbc4 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Wed, 23 Jun 2021 14:19:15 -0400 Subject: [PATCH 07/26] Reference diagnostics in FIPS 199 validations - change occurrences of SHOULD to should - change "FIPS 140 validated products" to "FIPS 140 validated modules" --- resources/validations/src/ssp.sch | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 61e5a0b7e..661c12f70 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -13,6 +13,7 @@ uri="https://fedramp.gov/ns/oscal" /> + FedRAMP System Security Plan Validations A resource must have a uuid attribute. A resource SHOULD have a title. + test="oscal:title">A resource should have a title. A resource must have a rlink element @@ -562,7 +563,7 @@ document--> + test="$WARNING and @media-type">the <> element should have a media-type attribute--> @@ -817,7 +818,7 @@ the four PTA questions is a duplicate A FedRAMP OSCAL SSP must - incorporate one or more FIPS 140 validated products. + incorporate one or more FIPS 140 validated modules. Security Objectives Categorization (FIPS 199) - A FedRAMP OSCAL SSP must specify a FIPS 199 categorization. - A FedRAMP OSCAL SSP must specify a security impact level. @@ -852,14 +855,17 @@ the four PTA questions is a duplicate - A FedRAMP OSCAL SSP must specify a confidentiality security objective. - A FedRAMP OSCAL SSP must specify an integrity security objective. - A FedRAMP OSCAL SSP must specify an availability security objective. @@ -1308,7 +1314,7 @@ the four PTA questions is a duplicate XPath: The context for this error is This resource SHOULD optionally have a reference within the document (but does + id="resource-is-referenced-diagnostic">This resource should optionally have a reference within the document (but does not). This element has a media-type=" From 1a527654dccc8417689e240f1151927497254cb3 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Wed, 23 Jun 2021 19:31:03 -0400 Subject: [PATCH 08/26] Add assertion diagnostics --- resources/validations/src/ssp.sch | 216 +++++++++++++++++++++++------- 1 file changed, 166 insertions(+), 50 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 661c12f70..f2afddac0 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -522,19 +522,24 @@ + + Basic resource constraints - A resource must have a uuid attribute. - A resource should have a title. - A resource must have a rlink element - Found unknown attachment type « - » in - resource + A resource should have an allowed attachment-type property. - A < - > element must have an href attribute + test="@href">A resource rlink must have an href attribute. @@ -619,45 +620,54 @@ Constraints for specific attachments - A FedRAMP OSCAL SSP must attach the FedRAMP Master Acronym and Glossary. - A FedRAMP OSCAL SSP must attach the FedRAMP Applicable Laws and Regulations. - - A FedRAMP OSCAL SSP must attach a User Guide. - A FedRAMP OSCAL SSP must attach Rules of Behavior. - A FedRAMP OSCAL SSP must attach a Contingency Plan - A FedRAMP OSCAL SSP must attach a Configuration Management Plan. - A FedRAMP OSCAL SSP must attach an Incident Response Plan. - @@ -673,46 +683,36 @@ - - - - lacks policy reference(s) (via by-component link) - + test="descendant::oscal:by-component/oscal:link[@rel = 'policy']">A FedRAMP SSP must incorporate a policy document for each + of the 17 NIST SP 800-54 Revision 4 control families. - - - - lacks policy attachment resource(s) - - + satisfies exists(//oscal:resource[oscal:prop[@name = 'type' and @value = 'policy']][@uuid = $ref])">A FedRAMP SSP must +incorporate a policy document for each of the 17 NIST SP 800-54 Revision 4 control families. - - - - lacks procedure reference(s) (via by-component link) - + test="descendant::oscal:by-component/oscal:link[@rel = 'procedure']">A FedRAMP SSP must incorporate a procedure document for + each of the 17 NIST SP 800-54 Revision 4 control families. - - - - lacks procedure attachment resource(s) - - + satisfies exists(//oscal:resource[oscal:prop[@name = 'type' and @value = 'procedure']][@uuid = $ref])">A FedRAMP SSP must +incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 control families. @@ -1307,19 +1307,51 @@ the four PTA questions is a duplicate Information System Categorization and FedRAMP Baselines - Missing FedRAMP authorization type + A FedRAMP OSCAL SSP must have a FedRAMP authorization type XPath: The context for this error is + This resource lacks a uuid attribute. + This resource lacks a title. + This resource lacks a rlink element This resource should optionally have a reference within the document (but does not). This element has a media-type=" " which is not in the list of allowed media types. Allowed media types are . + Found unknown attachment type « + » in + resource + A < + > element must have an href attribute This resource should have a base64 element. @@ -1335,6 +1367,90 @@ the four PTA questions is a duplicate This base64 must have content. + This FedRAMP OSCAL SSP lacks the FedRAMP Master Acronym and Glossary. + This FedRAMP OSCAL SSP lacks the FedRAMP Applicable Laws and + Regulations. + This FedRAMP OSCAL SSP lacks the FedRAMP Logo. + This FedRAMP OSCAL SSP lacks a User Guide. + This FedRAMP OSCAL SSP lacks a Contingency Plan + This FedRAMP OSCAL SSP lacks a Rules of Behavior. + This FedRAMP OSCAL SSP lacks a Configuration Management Plan. + This FedRAMP OSCAL SSP lacks an Incident Response Plan. + This FedRAMP OSCAL SSP lacks a Separation of Duties Matrix. + + + + lacks policy reference(s) (via by-component link) + + + + + lacks policy attachment resource(s) + + + + + + lacks procedure reference(s) (via by-component link) + + + + + lacks procedure attachment resource(s) + + Invalid security-sensitivity-level " ". It must have one of the following values: From 10fe1ed289d89177289121a716f7a315a99c81b2 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Thu, 24 Jun 2021 08:46:32 -0400 Subject: [PATCH 09/26] Add assertion diagnostics --- resources/validations/src/ssp.sch | 978 +++++++++++++++++++----------- 1 file changed, 634 insertions(+), 344 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index f2afddac0..36c619695 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -1,3 +1,4 @@ + + value="doc(concat($registry-base-path, '/fedramp_values.xml')) | doc(concat($registry-base-path, '/fedramp_threats.xml')) | doc(concat($registry-base-path, '/information-types.xml'))" /> - + + - + + - The registry values at the path ' ' are not present, this configuration is invalid. - [Section C Check 1.a] No sensitivty level found, no more validation processing can occur. - [Section C Check 1.a] @@ -294,8 +268,9 @@ ' control' else ' controls'" />are required: - - . + [Section C Check 3] This SSP has not implemented the most important @@ -306,7 +281,8 @@ else ' controls'" />: - [Section C Check 2] This SSP has not implemented @@ -317,7 +293,8 @@ else ' controls'" />overall: - [Section C Check 2] This SSP has implemented @@ -335,8 +312,7 @@ - - + . - [Section C Check 2] Invalid status ' @@ -367,7 +344,8 @@ test="exists($implemented)">[Section C Check 2] This SSP has implemented a statement for each of the following lettered response points for required controls: . - [Section C Check 2] This SSP has not implemented a statement for each of the following lettered @@ -385,7 +363,8 @@ value="./o:remarks => normalize-space()" /> - [Section D Checks] Response statements for @@ -399,7 +378,8 @@ . - [Section D Checks] Response statement @@ -407,7 +387,8 @@ will soon be syntactically invalid and deprecated. - [Section D Checks] Response statement @@ -417,7 +398,8 @@ - [Section D Checks] @@ -425,7 +407,8 @@ with component reference UUID ' ' is not in the system implementation inventory, and cannot be used to define a control. - [Section D Checks] Response statement @@ -438,7 +421,8 @@ value=". => normalize-space()" /> - [Section D Checks] Response statement component description for @@ -453,7 +437,8 @@ value=". => normalize-space()" /> - [Section D Checks] Response statement component remarks for @@ -472,8 +457,10 @@ value="$responsible-parties[not(@role-id = $roles/@id)]" /> - [Section C Check 2] This SSP has defined a responsible party with not defined in the role: - [Section C Check 2] This SSP has defined a responsible party with - [Section B Check ????] This SSP includes back-matter resource missing a UUID - [Section B Check ????] This SSP references back-matter resource: @@ -509,12 +502,16 @@ value="@filename" /> - [Section B Check ????] This SSP has file name: - [Section B Check ????] This SSP has media type: @@ -582,37 +579,28 @@ base64 attachments - A resource should have a base64 element. - - should have a base64 element. - A resource must have only one base64 element. - - must not have more than one base64 element. - A base64 element has a filename attribute - - must have filename attribute. - A base64 element must have a filename attribute. + A base64 element has a media-type attribute - - must have media-type attribute. - A base64 element must have a media-type attribute. + A base64 element has content. - base64 element must have text content. + test="matches(normalize-space(), '^[A-Za-z0-9+/]+$')">A base64 element must have content. @@ -716,39 +704,41 @@ incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 co - Each SP 800-53 control family must have unique policy and unique procedure documents - - document - is used in other controls (i.e., it is not unique to implemented-requirement - ) + Policy and procedure documents must have unique per-control-family associations. A FedRAMP OSCAL SSP must specify a Privacy Point of Contact - A FedRAMP OSCAL SSP must incorporate a Privacy Point of Contact role - A FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference - A FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference identifying the party by UUID - A FedRAMP OSCAL SSP must define a Privacy Point of Contact @@ -759,69 +749,84 @@ incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 co - incorrect value: should be "yes" or "no" + A PTA/PIA qualifying question must have an allowed answer. - A FedRAMP OSCAL SSP must have a privacy-sensitive designation + Lacks privacy-sensitive designation - A FedRAMP OSCAL SSP must have + PTA/PIA qualifying question #1. + Missing PTA/PIA qualifying - question #1. - A FedRAMP OSCAL SSP must have + PTA/PIA qualifying question #2. + Missing PTA/PIA qualifying - question #2. - A FedRAMP OSCAL SSP must have + PTA/PIA qualifying question #3. + Missing PTA/PIA qualifying - question #3. - A FedRAMP OSCAL SSP must have + PTA/PIA qualifying question #4. + Missing PTA/PIA qualifying - question #4. - One or more of the -four PTA questions is missing - A FedRAMP OSCAL SSP +must have all four PTA questions. + One or more of -the four PTA questions is a duplicate + satisfies exists(oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = $name][2]))">A FedRAMP OSCAL +SSP must have duplicate PTA questions. - - Missing SORN ID + A FedRAMP OSCAL SSP may have a SORN ID - - This FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis + This FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis. FIPS 140 Validation - A FedRAMP OSCAL SSP must incorporate one or more FIPS 140 validated modules. - A validation component or inventory-item must have a validation-reference property. @@ -879,7 +884,7 @@ the four PTA questions is a duplicate There are security-objective-levels: - + . SP 800-60v2r1 Information Types: - A FedRAMP OSCAL SSP must specify at least one information-type. - A FedRAMP OSCAL SSP information-type must have a title. - A FedRAMP OSCAL SSP information-type must have a description. - A FedRAMP OSCAL SSP information-type must have at least one categorization. - A FedRAMP OSCAL SSP information-type must have a confidentiality-impact. - A FedRAMP OSCAL SSP information-type must have a integrity-impact. - A FedRAMP OSCAL SSP information-type must have a availability-impact. - A FedRAMP OSCAL SSP information-type categorization must have a system attribute. - A FedRAMP OSCAL SSP information-type categorization must have a correct system attribute. The correct value is "https://doi.org/10.6028/NIST.SP.800-60v2r1". - A FedRAMP OSCAL SSP information-type categorization must have at least one information-type-id. @@ -931,20 +946,23 @@ the four PTA questions is a duplicate - Information Types - A FedRAMP OSCAL SSP information-type-id must have a SP 800-60v2r1 identifier. - A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a base element. - A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact must have a selected element. @@ -952,7 +970,8 @@ the four PTA questions is a duplicate - A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact base or select element must have an approved value. @@ -961,19 +980,23 @@ the four PTA questions is a duplicate Digital Identity Determination - A FedRAMP OSCAL SSP must have a Digital Identity Determination property. - A FedRAMP OSCAL SSP may have a Digital Identity Determination identity-assurance-level property. - A FedRAMP OSCAL SSP may have a Digital Identity Determination authenticator-assurance-level property. - A FedRAMP OSCAL SSP may have a Digital Identity Determination federation-assurance-level property. @@ -982,7 +1005,8 @@ the four PTA questions is a duplicate role="error"> - A FedRAMP OSCAL SSP must have a Digital Identity Determination property with an allowed value. @@ -993,7 +1017,8 @@ the four PTA questions is a duplicate value="('IAL1', 'IAL2', 'IAL3')" />--> - A FedRAMP OSCAL SSP should have an allowed Digital Identity Determination identity-assurance-level property. @@ -1004,7 +1029,8 @@ the four PTA questions is a duplicate value="('AAL1', 'AAL2', 'AAL3')" />--> - A FedRAMP OSCAL SSP should have an allowed Digital Identity Determination authenticator-assurance-level property. @@ -1015,7 +1041,8 @@ the four PTA questions is a duplicate value="('FAL1', 'FAL2', 'FAL3')" />--> - A FedRAMP OSCAL SSP should have an allowed Digital Identity Determination federation-assurance-level property. @@ -1025,7 +1052,6 @@ the four PTA questions is a duplicate A FedRAMP OSCAL SSP must specify system inventory items - A FedRAMP OSCAL SSP must populate the system inventory A FedRAMP OSCAL SSP must incorporate inventory-item elements FedRAMP SSP value constraints - asset-id property is unique asset-id must be unique. + test="count(//oscal:prop[@name = 'asset-id'][@value = current()/@value]) = 1">An asset-id must be unique. - asset-type property has an allowed value asset-type property has an allowed value. + test="@value = $asset-types">asset-type property must have an allowed value. - virtual property has an allowed value virtual property has an allowed value. + test="@value = $virtuals">virtual property must have an allowed value. - public property has an allowed value public property has an allowed value. + test="@value = $publics">public property must have an allowed value. - allows-authenticated-scan property has an allowed value test="@value = $allows-authenticated-scans">allows-authenticated-scan property has an allowed value. - is-scanned property has an allowed value is-scanned property has an allowed value. + test="@value = $is-scanneds">is-scanned property must have an allowed value. - scan-type property has an allowed value scan-type property has an allowed value. + test="@value = $scan-types">scan-type property must have an allowed value. - component has an allowed type component has an allowed type. + test="@type = $component-types">A component must have an allowed type. FedRAMP OSCAL SSP inventory items - All FedRAMP OSCAL SSP inventory-item elements - inventory-item has a uuid inventory-item has a uuid. - inventory-item has an asset-id + test="@uuid">An inventory-item has a uuid. inventory-item has an asset-id. - inventory-item has only one asset-id + test="oscal:prop[@name = 'asset-id']">An inventory-item must have an asset-id. inventory-item has only one asset-id. - inventory-item has an asset-type + test="count(oscal:prop[@name = 'asset-id']) = 1">An inventory-item must have only one asset-id. inventory-item has an asset-type. - inventory-item has only one asset-type + test="oscal:prop[@name = 'asset-type']">An inventory-item must have an asset-type. inventory-item has only one asset-type. - inventory-item has virtual property + test="count(oscal:prop[@name = 'asset-type']) = 1">An inventory-item must have only one asset-type. inventory-item has virtual property. - inventory-item has only one virtual property + test="oscal:prop[@name = 'virtual']">An inventory-item must have a virtual property. inventory-item has only one virtual property. - inventory-item has public property + test="count(oscal:prop[@name = 'virtual']) = 1">An inventory-item must have only one virtual property. inventory-item has public property. - inventory-item has only one public property + test="oscal:prop[@name = 'public']">An inventory-item must have a public property. inventory-item has only one public property. - inventory-item has scan-type property + test="count(oscal:prop[@name = 'public']) = 1">An inventory-item must have only one public property. inventory-item has scan-type property. - inventory-item has only one scan-type property + test="oscal:prop[@name = 'scan-type']">An inventory-item must have a scan-type property. inventory-item has only one scan-type property. + test="count(oscal:prop[@name = 'scan-type']) = 1">An inventory-item has only one scan-type property. - "infrastructure" inventory-item has allows-authenticated-scan "infrastructure" inventory-item has allows-authenticated-scan. - "infrastructure" inventory-item has only one allows-authenticated-scan property inventory-item has one-allows-authenticated-scan + test="not(oscal:prop[@name = 'allows-authenticated-scan'][2])">An inventory-item has one-allows-authenticated-scan property. - "infrastructure" inventory-item has baseline-configuration-name "infrastructure" inventory-item has baseline-configuration-name. - "infrastructure" inventory-item has only one baseline-configuration-name "infrastructure" inventory-item has only one baseline-configuration-name. - "infrastructure" inventory-item has a vendor-name property "infrastructure" inventory-item has a vendor-name property. - "infrastructure" inventory-item has a vendor-name property "infrastructure" - inventory-item has only one vendor-name property. - "infrastructure" inventory-item has a hardware-model property + inventory-item must have only one vendor-name property. "infrastructure" inventory-item has - a hardware-model property. - "infrastructure" inventory-item has one hardware-model property + test="oscal:prop[(: @ns = 'https://fedramp.gov/ns/oscal' and :)@name = 'hardware-model']">"infrastructure" inventory-item + must have a hardware-model property. "infrastructure" - inventory-item has only one hardware-model property. - "infrastructure" inventory-item has is-scanned property + inventory-item must have only one hardware-model property. "infrastructure" inventory-item has is-scanned property. + test="oscal:prop[@name = 'is-scanned']">"infrastructure" inventory-item must have is-scanned property. "infrastructure" inventory-item has only one is-scanned + test="not(oscal:prop[@name = 'is-scanned'][2])">"infrastructure" inventory-item must have only one is-scanned property. - has a scan-type property - "software or database" inventory-item has software-name property "software or database" inventory-item has software-name property. + test="oscal:prop[@name = 'software-name']">"software or database" inventory-item must have a software-name + property. "software or database" inventory-item has software-name + test="not(oscal:prop[@name = 'software-name'][2])">"software or database" inventory-item must have a software-name property. - "software or database" inventory-item has software-version property "software or database" inventory-item has software-version + test="oscal:prop[@name = 'software-version']">"software or database" inventory-item must have a software-version property. "software or database" inventory-item has one software-version + test="not(oscal:prop[@name = 'software-version'][2])">"software or database" inventory-item must have one software-version property. - "software or database" inventory-item has function "software or database" inventory-item has function property. + test="oscal:prop[@name = 'function']">"software or database" inventory-item must have a function property. "software or database" inventory-item has one function property. + test="not(oscal:prop[@name = 'function'][2])">"software or database" inventory-item must have one function + property. FedRAMP OSCAL SSP components - A FedRAMP OSCAL SSP component component has an asset type. + test="oscal:prop[@name = 'asset-type']">A component must have an asset type. component has one asset type. + test="oscal:prop[@name = 'asset-type']">A component must have one asset type. - There must be a component that represents the entire system itself. It should be the only component with the component-type set to - "system". - Missing system component + test="oscal:component[@type = 'system']">A FedRAMP OSCAL SSP must have a system component. - Information System Name, Title, and FedRAMP Identifier - Missing system-id - A FedRAMP OSCAL SSP must have a system-id. + Missing system-name - A FedRAMP OSCAL SSP must have a system-name. + Missing system-name-short + test="oscal:system-name-short">A FedRAMP OSCAL SSP must have a system-name-short. - Information System Categorization and FedRAMP Baselines - - A FedRAMP OSCAL SSP must have a FedRAMP authorization type + A FedRAMP OSCAL SSP must have a FedRAMP authorization type. - XPath: The context for this error is - + The registry values at the path ' + ' are not present, this configuration is invalid. + [Section C Check 1.a] No sensitivty level found, no more validation processing + can occur. + [Section C Check 1.a] + is an invalid value of ' + ', not an allowed value of + . No more validation processing can occur. + [Section C Check 3] This SSP has not implemented the most important + core + : + . + [Section C Check 2] This SSP has not implemented + + overall: + . + [Section C Check 2] This SSP has implemented + extraneous + not needed given the selected profile: + . + [Section C Check 2] Invalid status ' + ' for + , must be + . + [Section C Check 2] This SSP has not implemented a statement for each of the + following lettered response points for required controls: + . + [Section D Checks] Response statements for + must have at least + + with a description. There are + . + [Section D Checks] Response statement + has a description not within a component. That was previously allowed, but not recommended. It will + soon be syntactically invalid and deprecated. + [Section D Checks] Response statement + has remarks not within a component. That was previously allowed, but not recommended. It will soon + be syntactically invalid and deprecated. + [Section D Checks] Response statment + with component reference UUID ' + ' is not in the system implementation inventory, and cannot be used to define a + control. + [Section D Checks] Response statement + has a component, but that component is missing a required description node. + [Section D Checks] Response statement component description for + is too short with + characters. It must be + characters long. + [Section D Checks] Response statement component remarks for + is too short with + characters. It must be + characters long. + [Section C Check 2] This SSP has defined a responsible party with + + not defined in the role: + . + [Section C Check 2] This SSP has defined a responsible party with + + is not a defined party: + . + [Section B Check ????] This SSP includes back-matter resource missing a + UUID. + [Section B Check ????] This SSP references back-matter resource: + . + [Section B Check ????] This SSP has file name: + . + [Section B Check ????] This SSP has media type: + . This resource lacks a uuid attribute. This resource lacks a title. - This resource lacks a rlink element + id="resource-has-title-diagnostic">This resource lacks a title. + This resource lacks a rlink element. This resource should optionally have a reference within the document (but does - not). - This - element has a media-type=" - " which is not in the list of allowed media types. Allowed media types are - . - Found unknown attachment type « + id="resource-is-referenced-diagnostic">This resource lacks a reference within the document (but does not). + Found unknown attachment type « » in resource - A < - > element must have an href attribute + 'untitled'" />resource. + This rlink lacks an href attribute. + This + has a media-type=" + " which is not in the list of allowed media types. Allowed media types are + . This resource should have a base64 element. This resource must not have more than one base64 element. This base64 must have a filename attribute. This base64 must have a media-type attribute. This base64 must have content. - This FedRAMP OSCAL SSP lacks the FedRAMP Master Acronym and Glossary. - This FedRAMP OSCAL SSP lacks the FedRAMP Applicable Laws and - Regulations. - This FedRAMP OSCAL SSP lacks the FedRAMP Logo. - This FedRAMP OSCAL SSP lacks a User Guide. - This FedRAMP OSCAL SSP lacks a Contingency Plan - This FedRAMP OSCAL SSP lacks a Rules of Behavior. - This FedRAMP OSCAL SSP lacks a Configuration Management Plan. - This FedRAMP OSCAL SSP lacks an Incident Response Plan. - This FedRAMP OSCAL SSP lacks a Separation of Duties Matrix. - - - - lacks policy reference(s) (via by-component link) - - - - - lacks policy attachment resource(s) - - - - - - lacks procedure reference(s) (via by-component link) - - - - - lacks procedure attachment resource(s) - - - Invalid security-sensitivity-level " - ". It must have one of the following - values: - . - Invalid - " - ". It must have one of the following - values: - . + This FedRAMP OSCAL SSP lacks the FedRAMP Master Acronym and Glossary. + This FedRAMP OSCAL SSP lacks the FedRAMP Applicable Laws and + Regulations. + This FedRAMP OSCAL SSP lacks the FedRAMP Logo. + This FedRAMP OSCAL SSP lacks a User Guide. + This FedRAMP OSCAL SSP lacks a Rules of Behavior. + This FedRAMP OSCAL SSP lacks a Contingency Plan. + This FedRAMP OSCAL SSP lacks a Configuration Management + Plan. + This FedRAMP OSCAL SSP lacks an Incident Response Plan. + This FedRAMP OSCAL SSP lacks a Separation of Duties Matrix. + + + + lacks policy reference(s) (via by-component link). + + + + lacks policy attachment resource(s) + . + + + + lacks procedure reference(s) (via by-component link). + + + + lacks procedure attachment resource(s) + . + A policy or procedure reference was incorrectly re-used. + This FedRAMP OSCAL SSP lacks a Privacy Point of Contact role. + This FedRAMP OSCAL SSP lacks a Privacy Point of Contact responsible + party role reference. + This FedRAMP OSCAL SSP lacks a Privacy Point of Contact responsible + party role reference identifying the party by UUID. + This FedRAMP OSCAL SSP lacks a Privacy Point of Contact. + This property has an incorrect value: should be "yes" or "no". + The privacy-sensitive designation is missing. + The PTA/PIA qualifying question #1 is missing. + The PTA/PIA qualifying question #2 is missing. + The PTA/PIA qualifying question #3 is missing. + The PTA/PIA qualifying question #4 is missing. + One or more of the four PTA questions is missing. + One or more of the four PTA questions is a duplicate. + The SORN ID is missing. + This FedRAMP OSCAL SSP lacks a Privacy Impact Analysis. + A FedRAMP OSCAL SSP does not declare one or more FIPS 140 validated + modules. + A validation component or inventory-item lacks a validation-reference + property. This FedRAMP OSCAL SSP lacks a FIPS 199 categorization. This FedRAMP OSCAL SSP lacks a security impact level. + Invalid security-sensitivity-level " + ". It must have one of the following + values: + . This FedRAMP OSCAL SSP lacks a confidentiality security @@ -1478,120 +1623,265 @@ the four PTA questions is a duplicate doc:context="oscal:security-impact-level" id="has-security-objective-availability-diagnostic">This FedRAMP OSCAL SSP lacks an availability security objective. + Invalid + " + ". It must have one of the following + values: + . + A FedRAMP OSCAL SSP lacks at least one + information-type. + A FedRAMP OSCAL SSP information-type lacks a title. + A FedRAMP OSCAL SSP information-type lacks a description. + A FedRAMP OSCAL SSP information-type lacks at least one + categorization. + A FedRAMP OSCAL SSP information-type lacks a + confidentiality-impact. + A FedRAMP OSCAL SSP information-type lacks a + integrity-impact. + A FedRAMP OSCAL SSP information-type lacks a + availability-impact. + A FedRAMP OSCAL SSP information-type categorization lacks a system + attribute. + A FedRAMP OSCAL SSP information-type categorization lacks a + correct system attribute. The correct value is "https://doi.org/10.6028/NIST.SP.800-60v2r1". + A FedRAMP OSCAL SSP information-type categorization lacks at least one + information-type-id. + A FedRAMP OSCAL SSP information-type-id lacks a SP 800-60v2r1 + identifier. + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact + lacks a base element. + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or + availability-impact lacks a selected element. + A FedRAMP OSCAL SSP information-type confidentiality-, + integrity-, or availability-impact base or select element lacks an approved value. + This FedRAMP OSCAL SSP lacks a Digital Identity Determination + property. + A FedRAMP OSCAL SSP may lack a Digital Identity Determination + identity-assurance-level property. + A FedRAMP OSCAL SSP may lack a Digital Identity Determination + authenticator-assurance-level property. + A FedRAMP OSCAL SSP may lack a Digital Identity Determination + federation-assurance-level property. + This FedRAMP OSCAL SSP lacks a Digital Identity Determination property with + an allowed value. + A FedRAMP OSCAL SSP may lack an allowed Digital Identity Determination + identity-assurance-level property. + A FedRAMP OSCAL SSP may lack an allowed Digital Identity + Determination authenticator-assurance-level property. + A FedRAMP OSCAL SSP may lack an allowed Digital Identity Determination + federation-assurance-level property. A FedRAMP OSCAL SSP must incorporate inventory-item elements. + doc:context="/oscal:system-security-plan/oscal:system-implementation" + id="has-inventory-items-diagnostic">This FedRAMP OSCAL SSP lacks inventory-item elements. This asset id is not unique. An asset id must be unique within the scope of a FedRAMP OSCAL SSP document. - should have a FedRAMP asset type + should have a FedRAMP asset type (not " "). - must have an allowed value + must have an allowed value (not " "). must have an allowed value (not " "). must have an allowed value (not " "). must have an allowed value (not " "). must have an allowed value (not " "). must have an allowed component type (not " "). This inventory-item must have a uuid attribute. This inventory-item must have an asset-id property. This inventory-item must have only one asset-id property. This inventory-item must have an asset-type property. This inventory-item must have only one asset-type property. This inventory-item must have virtual property. This inventory-item must have only one virtual property. This inventory-item must have public property. This inventory-item must have only one public property. This inventory-item must have scan-type property. This inventory-item must have only one scan-type property. This inventory-item must have allows-authenticated-scan property. This inventory-item must have only one allows-authenticated-scan property. This inventory-item must have baseline-configuration-name property. This inventory-item must have only one baseline-configuration-name property. This inventory-item must have a vendor-name property. This inventory-item must have only one vendor-name property. This inventory-item must have a hardware-model property. This inventory-item must have only one hardware-model property. This inventory-item must have is-scanned property. This inventory-item must have only one is-scanned property. This inventory-item must have software-name property. This inventory-item must have only one software-name property. This inventory-item must have software-version property. This inventory-item must have only one software-version property. " " must have function property. " " must have only one function property. must have an asset-type property. must have only one asset-type property. + This FedRAMP OSCAL SSP lacks a system component. + This FedRAMP OSCAL SSP lacks a system-id. + This FedRAMP OSCAL SSP lacks a system-name. + This FedRAMP OSCAL SSP lacks a system-name-short. + This FedRAMP OSCAL SSP lacks a FedRAMP authorization type. From 65bc2759b033001a269a3cdb7940b112e328294f Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Thu, 24 Jun 2021 11:54:02 -0400 Subject: [PATCH 10/26] Change stage 2 content - Change assertion statements to have a positive statement of the constraint - Comment out dysfuntional doc-available() "resource-rlink-required" rule. - Change sch:report role from "positive" to "information". - Comment out informational sch:report items. --- resources/validations/src/ssp.sch | 162 +++++++++------------------ resources/validations/test/ssp.xspec | 11 +- 2 files changed, 57 insertions(+), 116 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 36c619695..7f103c976 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -223,22 +223,17 @@ The registry values at the path ' - ' are not present, this configuration is invalid. + test="count($registry/f:fedramp-values/f:value-set) > 0">The registry values are available. [Section C Check 1.a] No sensitivty level found, no more validation processing can - occur. + test="$sensitivity-level != ''">[Section C Check 1.a] Sensitivity level is defined. [Section C Check 1.a] - is an invalid value of ' - ', not an allowed value of - . No more validation processing can occur. + test="empty($ok-values) or not(exists($corrections))">[Section C Check 1.a] Sensitivity level has allowed value. - The following are required: - . + .--> [Section C Check 3] This SSP has not implemented the most important - core - : - + test="not(exists($core-missing))">[Section C Check 3] This SSP has implemented the most important controls. [Section C Check 2] This SSP has not implemented - - overall: - + test="not(exists($all-missing))">[Section C Check 2] This SSP has implemented all required controls. [Section C Check 2] This SSP has implemented - extraneous - not needed given the selected profile: - + test="not(exists($extraneous))">[Section C Check 2] This SSP has no implemented controls. - - . + .--> [Section C Check 2] Invalid status ' - ' for - , must be - - [Section C Check 2] Status is correct. + [Section C Check 2] This SSP has not implemented a statement for each of the following lettered - response points for required controls: - . + test="not(exists($missing))">[Section C Check 2] This SSP has required response points. [Section D Checks] Response statements for - must have at least - - with a description. There are - . + test="$components-count >= $required-components-count">[Section D Checks] Response statements have sufficient + components. [Section D Checks] Response statement - has a description not within a component. That was previously allowed, but not recommended. It - will soon be syntactically invalid and deprecated. + test=". => empty()">[Section D Checks] Response statement does not have a description not within a component. [Section D Checks] Response statement - has remarks not within a component. That was previously allowed, but not recommended. It will - soon be syntactically invalid and deprecated. + test=". => empty()">[Section D Checks] Response statement does not have remarks not within a component. [Section D Checks] - Response statment - with component reference UUID ' - ' is not in the system implementation inventory, and cannot be used to define a - control. + Response statment cites a component in the system implementation inventory. [Section D Checks] Response statement - has a component, but that component is missing a required description node. + test="./o:description => exists()">[Section D Checks] Response statement has a component which has a required description + node. [Section D Checks] Response statement component description for - is too short with - characters. It must be - characters long. + test="$description-length >= $required-length">[Section D Checks] Response statement component description has adequate + length. [Section D Checks] Response statement component remarks for - is too short with - characters. It must be - characters long. + test="$remarks-length >= $required-length">[Section D Checks] Response statement component remarks have adequate + length. [Section C Check 2] This SSP has defined a responsible party with - - not defined in the role: - + test="not(exists($extraneous-roles))">[Section C Check 2] This SSP has defined a responsible party with no extraneous + roles. [Section C Check 2] This SSP has defined a responsible party with - - is not a defined party: - + test="not(exists($extraneous-parties))">[Section C Check 2] This SSP has defined a responsible party with no extraneous + parties. [Section B Check ????] This SSP includes back-matter resource missing a UUID - - - [Section B Check ????] This SSP references back-matter resource: - + test="./@uuid">[Section B Check ????] This SSP has back-matter resources each with a UUID. + + @@ -506,14 +448,12 @@ doc:organizational-id="section-b.?????" id="resource-base64-available-filenamne" role="error" - test="./@filename">[Section B Check ????] This SSP has file name: - + test="./@filename">[Section B Check ????] This base64 has a filename attribute. [Section B Check ????] This SSP has media type: - + test="./@media-type">[Section B Check ????] This base64 has a filename attribute. @@ -567,9 +507,9 @@ role="error"> - There are - media types. + media types.--> value="$fedramp-values//fedramp:value-set[@name = 'security-objective-level']//fedramp:enum/@value" />--> - There are security-objective-levels: - . + .--> ' are not present, this configuration is invalid. [Section C Check 1.a] No sensitivty level found, no more validation processing + id="no-security-sensitivity-level-diagnostic">[Section C Check 1.a] No sensitivity level found, no more validation processing can occur. - + @@ -1106,8 +1106,8 @@ - + @@ -1503,7 +1503,8 @@ - + From ac24c95e5aff4c7834bb8652f04c9ec07c20424a Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Thu, 24 Jun 2021 13:48:39 -0400 Subject: [PATCH 11/26] Correct minor errors in assertion messages --- resources/validations/src/ssp.sch | 94 +++++++++++++++---------------- 1 file changed, 46 insertions(+), 48 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 7f103c976..533e2296d 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -278,7 +278,7 @@ doc:organizational-id="section-c.2" id="extraneous-implemented-requirements" role="warn" - test="not(exists($extraneous))">[Section C Check 2] This SSP has no implemented controls. + test="not(exists($extraneous))">[Section C Check 2] This SSP has no extraneous implemented controls. [Section C Check 2] Status is correct. + test="not(exists($corrections))">[Section C Check 2] Implementation status is correct. A FedRAMP OSCAL SSP must have a system-id. + test="oscal:system-id[@identifier-type = 'https://fedramp.gov/']">A FedRAMP OSCAL SSP must have a FedRAMP system-id. "). This inventory-item must have a uuid attribute. + id="inventory-item-has-uuid-diagnostic">This inventory-item lacks a uuid attribute. This inventory-item must have an asset-id property. + id="has-asset-id-diagnostic">This inventory-item lacks an asset-id property. This inventory-item must have only one asset-id property. + id="has-one-asset-id-diagnostic">This inventory-item has more than one asset-id property. This inventory-item must have an asset-type property. + id="inventory-item-has-asset-type-diagnostic">This inventory-item lacks an asset-type property. This inventory-item must have only one asset-type - property. + id="inventory-item-has-one-asset-type-diagnostic">This inventory-item has more than one asset-type property. This inventory-item must have virtual property. + id="inventory-item-has-virtual-diagnostic">This inventory-item lacks virtual property. This inventory-item must have only one virtual property. + id="inventory-item-has-one-virtual-diagnostic">This inventory-item has more than one virtual property. This inventory-item must have public property. + id="inventory-item-has-public-diagnostic">This inventory-item lacks public property. This inventory-item must have only one public property. + id="inventory-item-has-one-public-diagnostic">This inventory-item has more than one public property. This inventory-item must have scan-type property. + id="inventory-item-has-scan-type-diagnostic">This inventory-item lacks scan-type property. This inventory-item must have only one scan-type property. + id="inventory-item-has-one-scan-type-diagnostic">This inventory-item has more than one scan-type property. This inventory-item must have allows-authenticated-scan + id="inventory-item-has-allows-authenticated-scan-diagnostic">This inventory-item lacks allows-authenticated-scan property. This inventory-item must have only one + id="inventory-item-has-one-allows-authenticated-scan-diagnostic">This inventory-item has more than one allows-authenticated-scan property. This inventory-item must have baseline-configuration-name + id="inventory-item-has-baseline-configuration-name-diagnostic">This inventory-item lacks baseline-configuration-name property. This inventory-item must have only one + id="inventory-item-has-one-baseline-configuration-name-diagnostic">This inventory-item has more than one baseline-configuration-name property. This inventory-item must have a vendor-name property. + id="inventory-item-has-vendor-name-diagnostic">This inventory-item lacks a vendor-name property. This inventory-item must have only one vendor-name + id="inventory-item-has-one-vendor-name-diagnostic">This inventory-item has more than one vendor-name property. This inventory-item must have a hardware-model property. + id="inventory-item-has-hardware-model-diagnostic">This inventory-item lacks a hardware-model property. This inventory-item must have only one hardware-model + id="inventory-item-has-one-hardware-model-diagnostic">This inventory-item has more than one hardware-model property. This inventory-item must have is-scanned property. + id="inventory-item-has-is-scanned-diagnostic">This inventory-item lacks is-scanned property. This inventory-item must have only one is-scanned - property. + id="inventory-item-has-one-is-scanned-diagnostic">This inventory-item has more than one is-scanned property. This inventory-item must have software-name property. + id="inventory-item-has-software-name-diagnostic">This inventory-item lacks software-name property. This inventory-item must have only one software-name + id="inventory-item-has-one-software-name-diagnostic">This inventory-item has more than one software-name property. This inventory-item must have software-version property. + id="inventory-item-has-software-version-diagnostic">This inventory-item lacks software-version property. This inventory-item must have only one software-version + id="inventory-item-has-one-software-version-diagnostic">This inventory-item has more than one software-version property. " - " must have function property. + " lacks function property. " - " must have only one function property. + " has more than one function property. - must have an asset-type property. + lacks an asset-type property. - must have only one asset-type property. + has more than one asset-type property. This FedRAMP OSCAL SSP lacks a system component. This FedRAMP OSCAL SSP lacks a system-id. + id="has-system-id-diagnostic">This FedRAMP OSCAL SSP lacks a FedRAMP system-id. This FedRAMP OSCAL SSP lacks a system-name. From fad3ffa5bfb8fe53275291edb8bf5d7404e6699f Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Thu, 24 Jun 2021 13:49:31 -0400 Subject: [PATCH 12/26] Add XSL transform to produce an HTML5 rendition of rules --- resources/validations/src/rules.css | 104 ++++ resources/validations/src/rules.xsl | 757 ++++++++++++++++++++++++++++ 2 files changed, 861 insertions(+) create mode 100644 resources/validations/src/rules.css create mode 100644 resources/validations/src/rules.xsl diff --git a/resources/validations/src/rules.css b/resources/validations/src/rules.css new file mode 100644 index 000000000..a205700df --- /dev/null +++ b/resources/validations/src/rules.css @@ -0,0 +1,104 @@ +caption { + font-weight: bold; + font-size: large; +} + +thead tr { + background-color: #e0e0e0; + color: inherit; +} + +thead th { + vertical-align: bottom; + text-align: left; + white-space: normal; +} + +thead td { +} + +tbody tr { + vertical-align: top; +} + +tbody th { + text-align: left; + background-color: #e8e8e8; + color: inherit; +} + +tbody tr { + background-color: #f0f0f0; + color: inherit; +} + +code code { + color: inherit; +} + +.highlight { + background-color: powderblue; +} +.highlight-missed { + background-color: yellow; +} + +.missing { + background-color: orange; +} + +.NB { + background-color: thistle; +} + +.FedRAMP-ns { + background-color: chartreuse; +} + +.context-item { + font-variant: small-caps; +} + +.role-error, +.role-fatal { + color: red; +} + +.role-warning { + color: orange; +} + +blockquote { + background: #f9f9f9; + border-left: 10px solid #ccc; + margin: 1.5em 10px; + padding: 0.5em 10px; + quotes: "\201C" "\201D" "\2018" "\2019"; + width: 50%; +} + +*[title] { + cursor: help; +} + +.assertion, +.diagnostic { + font-style: italic; +} +.assertion { + font-weight: bold; +} +.assertion:before { + content: "assertion: "; + font-style: normal; + font-weight: normal; +} +.diagnostic:before { + content: "diagnostic: "; + font-style: normal; +} + +.substitution { + font-family: monospace; + background-color: lightgrey; +} diff --git a/resources/validations/src/rules.xsl b/resources/validations/src/rules.xsl new file mode 100644 index 000000000..a75e0f919 --- /dev/null +++ b/resources/validations/src/rules.xsl @@ -0,0 +1,757 @@ + + + + FedRAMP Rules and Validation Logic + + + + + + + + + Context + + + + + < + + + + + + </> + + + /> + + + + + + + + + + + =" + + " + + + + + + + + + + + + + + + + {base-uri()} is not static-base-uri() + + + + + + + <xsl:value-of + select="$title" /> + + + + + + + + + +

+ +

+ +

+ Last updated { format-dateTime(current-dateTime(), '[MNn] [D] [Y] [H01]:[m01] [ZN,*-3]') }. +

+ +

Information from fedramp_values.xml and FedRAMP_extensions.xml is presented.

+ + + +

Some items for discussion and decision:

+
    +
  • How much context should accompany Schematron messages?
      +
    • For FedRAMP OSCAL SSP submitters
      • +
    • For FedRAMP OSCAL SSP reviewers
      • +
    +
    • +
  • Can/shall Schematron be a structured form of FedRAMP rule definitions? (A Schematron document may include arbitrary + information cast as XML in one or more XML namespaces.)
      +
    • Could it be the sole source?
      • +
    +
    • +
  • Shall plainlanguage.gov prose style be used?
    • +
  • Will fedramp-automation structured documentation be inclusive of Section 508 accommodations?
    • +
+ + + + + + + + + + +

Rules

+

NB: When FedRAMP rules and validation logic is discussed, there is a minor mismatch between a general concept of a rule + versus rule representation in Schematron. The former is what SSP reviewers (and perhaps submitters) hold; the latter might be + expressed as multiple Schematron <rule>, <assert>, and <report> elements. + The same word with different meanings in both venues is unfortunate.

+

The following table lists assertions - Schematron assert and report elements - with the Schematron id, + source document, and constraint statement. Each of these is subordinate to a context defined in a parent Schematron + rule element.

+ +

The Schematron documentation describes a rule> as

+
+

A list of assertions tested within the context specified by the required context attribute.

+

NOTE: It is not an error if a rule never fires in a document. In order to test that a document always has some context, a + new pattern should be created from the context of the document, with an assertion requiring the element or attribute.

+

When the rule element has the attribute abstract with a value true, then the rule is an abstract rule. An abstract rule + shall not have a context attribute. An abstract rule is a list of assertions that will be invoked by other rules belonging + to the same pattern using the extends element. Abstract rules provide a mechanism for reducing schema size.

+
+

The Schematron documentation (in the Schematron schema) states the following about constraint statements:

+
+

An assertion made about the context nodes. The data content is a natural-language assertion. The natural-language + assertion shall be a positive statement of a constraint. +

+

NOTE: The natural-language assertion may contain information about actual values in addition to expected values and may + contain diagnostic information. Users should note, however, that the diagnostic element is provided for such + information to encourage clear statement of the natural-language assertion.

+
+

Schematron assertions (assert and report elements) may employ a @diagnostics attribute + which cites one or more diagnostic message identifiers. Such messages are described as

+
+

A natural-language message giving more specific details concerning a failed assertion, such as found versus expected values + and repair hints.

+

NOTE: In multiple languages may be supported by using a different diagnostic element for each language, with the + appropriate xml:lang language attribute, and referencing all the unique identifiers of the diagnostic elements in the + diagnostics attribute of the assertion.

+
+ + + + + + + + + + + + + + + + + + + + + + + + +
+
List of assertions
+

There are Schematron assertions as of this update

+
IDStatement
+ + + + + + (missing assertion id) + + + + +
+ + + +
+
+ context: + + + +
+
+ test: + + + +
+
+ role: + + + +
+ + +
+ + + + + + + +
+ + + + + + +
+ affirmative XSpec test: + +
+ + +
+ affirmative XSpec test: + + no coverage + +
+ + + + + +
+ negative XSpec test: + +
+ + +
+ negative XSpec test: + + no coverage + +
+ + + +
+ FedRAMP note: {@doc:*} +
+ + +
+ +

FedRAMP Values

+

The fedramp_values.xml document contains value enumerations for various FedRAMP OSCAL document elements.

+ + + + + + + + + + + + + + + +
fedramp_values.xml constraints
NameValuesContext(s) - Light blue highlights use of name in context. Yellow highlights absence of name in context.
+ +

FedRAMP Extensions

+

The FedRAMP_extensions.xml document contains OSCAL schema extensions for FedRAMP OSCAL documents.

+ + + + + + + + + + + + + + + +
FedRAMP_extensions.xml constraints
NameValuesContext(s) - Light blue highlights use of name in context. Yellow highlights absence of name in context.
+ + + + + + + + + + + +
+ context: + + + +
+
+ {local-name()}: + + + +
+
+ role: + + + + + + + + not specified + + +
+
+ text: + + + +
+ +
+ rule: + the context item + + + +
+ + + + + + +
+ diagnostic: + + + + : + + + +
+ + + + + + + + + + + + + +
+ + + +
+ + + +
+ + + +
+ + +
+ or any other value +
+ + + + +
+ + + +
+ + + + + + + + + : + + + + + + + + + Remarks: + + + + + + + + + + +
+ + + +
+ + + +
+ + + +
+ + + + +
+ + + +
+ + + + + + + + + : + + + + + + + + + Remarks: + + + + + + + + + + + + + + \[@ns='https://fedramp.gov/ns/oscal'\]|@ns = 'https://fedramp.gov/ns/oscal' + + + + + + + ☚ Note the + @ns + + + + + + + + + + + + + + \[@ns='https://fedramp.gov/ns/oscal'\]|@ns = 'https://fedramp.gov/ns/oscal' + + + + + + + + + + + + + + + + + + + + + + ☚ Note the + @ns + + + + From 187490de7147e0ce6be641c1f5dc9fe79d99cb2b Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Thu, 24 Jun 2021 14:10:48 -0400 Subject: [PATCH 13/26] Restoret informational sch:report items. --- resources/validations/src/ssp.sch | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 533e2296d..c9fe0798f 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -254,7 +254,7 @@ value="$required-controls[o:prop[@name = 'CORE' and @ns = $registry-ns] and @id = $all-missing/@id]" /> - + . - + . [Section C Check 2] Implementation status is correct. - + . Date: Thu, 24 Jun 2021 14:33:15 -0400 Subject: [PATCH 14/26] Use full words for assertion roles This will simplify the options in the UI. --- resources/validations/src/ssp.sch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index c9fe0798f..5fe6a6e7a 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -272,12 +272,12 @@ [Section C Check 2] This SSP has implemented all required controls. [Section C Check 2] This SSP has no extraneous implemented controls. @@ -481,7 +481,7 @@ test="oscal:rlink">A resource must have a rlink element A resource should be referenced from within the document. From 8cdb94d400d693b96ad4aa604dee757f8a2f2861 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Fri, 25 Jun 2021 11:14:36 -0400 Subject: [PATCH 15/26] Minor edits - improve base64 regex - add checklist references --- resources/validations/src/ssp.sch | 128 +++++++++++++++--------------- 1 file changed, 66 insertions(+), 62 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 5fe6a6e7a..5d5b53426 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -540,7 +540,8 @@ A base64 element must have content. + test="matches(normalize-space(), '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/][AQgw]==|[A-Za-z0-9+/]{2}[AEIMQUYcgkosw048]=)?$')">A + base64 element must have content. @@ -557,8 +558,8 @@ doc:attachment="§15 Attachment 12" id="has-fedramp-citations" role="error" - test="oscal:resource[oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @name = 'type' and @value = 'fedramp-citations']]">A - FedRAMP OSCAL SSP must attach the FedRAMP Applicable Laws and Regulations. + test="oscal:resource[oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @name = 'type' and @value = 'fedramp-citations']]"> + [Section B Check 3.12] A FedRAMP OSCAL SSP must attach the FedRAMP Applicable Laws and Regulations. + test="oscal:resource[oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @name = 'type' and @value = 'user-guide']]">[Section + B Check 3.2] A FedRAMP OSCAL SSP must attach a User Guide. A - FedRAMP OSCAL SSP must attach Rules of Behavior. + test="oscal:resource[oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @name = 'type' and @value = 'rules-of-behavior']]"> + [Section B Check 3.5] A FedRAMP OSCAL SSP must attach Rules of Behavior. - A FedRAMP OSCAL SSP must attach a Contingency Plan + [Section B Check 3.6] A FedRAMP OSCAL SSP must attach a Contingency Plan - A FedRAMP OSCAL SSP must attach a Configuration Management Plan. + [Section B Check 3.7] A FedRAMP OSCAL SSP must attach a Configuration Management Plan. - A FedRAMP OSCAL SSP must attach an Incident Response Plan. + [Section B Check 3.8] A FedRAMP OSCAL SSP must attach an Incident Response Plan. - A FedRAMP OSCAL SSP must attach a Separation of Duties Matrix. + [Section B Check 3.11] A FedRAMP OSCAL SSP must attach a Separation of Duties Matrix. @@ -614,8 +615,8 @@ A FedRAMP SSP must incorporate a policy document for each - of the 17 NIST SP 800-54 Revision 4 control families. + test="descendant::oscal:by-component/oscal:link[@rel = 'policy']">[Section B Check 3.1] A FedRAMP SSP must incorporate a + policy document for each of the 17 NIST SP 800-54 Revision 4 control families. A FedRAMP SSP must -incorporate a policy document for each of the 17 NIST SP 800-54 Revision 4 control families. + satisfies exists(//oscal:resource[oscal:prop[@name = 'type' and @value = 'policy']][@uuid = $ref])">[Section B Check 3.1] A +FedRAMP SSP must incorporate a policy document for each of the 17 NIST SP 800-54 Revision 4 control families. A FedRAMP SSP must incorporate a procedure document for - each of the 17 NIST SP 800-54 Revision 4 control families. + test="descendant::oscal:by-component/oscal:link[@rel = 'procedure']">[Section B Check 3.1] A FedRAMP SSP must incorporate a + procedure document for each of the 17 NIST SP 800-54 Revision 4 control families. A FedRAMP SSP must -incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 control families. + satisfies exists(//oscal:resource[oscal:prop[@name = 'type' and @value = 'procedure']][@uuid = $ref])">[Section B Check 3.1] +A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 control families. @@ -652,7 +653,7 @@ incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 co test=" (: the current @href is in :) @href = (: all controls except the current :) (//oscal:implemented-requirement[matches(@control-id, '^[a-z]{2}-1$')] except $ir) (: all their @hrefs :)/descendant::oscal:by-component/oscal:link[@rel = 'policy']/@href"> - Policy and procedure documents must have unique per-control-family associations. + [Section B Check 3.1] Policy and procedure documents must have unique per-control-family associations. @@ -662,26 +663,26 @@ incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 co A FedRAMP OSCAL SSP must incorporate a - Privacy Point of Contact role + test="/oscal:system-security-plan/oscal:metadata/oscal:role[@id = 'privacy-poc']">[Section B Check 3.4] A FedRAMP OSCAL SSP + must incorporate a Privacy Point of Contact role A FedRAMP OSCAL SSP must - declare a Privacy Point of Contact responsible party role reference + test="/oscal:system-security-plan/oscal:metadata/oscal:responsible-party[@role-id = 'privacy-poc']">[Section B Check 3.4] A + FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference A - FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference identifying the party by - UUID + test="/oscal:system-security-plan/oscal:metadata/oscal:responsible-party[@role-id = 'privacy-poc']/oscal:party-uuid">[Section + B Check 3.4] A FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference identifying the + party by UUID A FedRAMP OSCAL SSP must define a Privacy - Point of Contact + test="/oscal:system-security-plan/oscal:metadata/oscal:party[@uuid = $poc-uuid]">[Section B Check 3.4] A FedRAMP OSCAL SSP + must define a Privacy Point of Contact @@ -692,48 +693,50 @@ incorporate a procedure document for each of the 17 NIST SP 800-54 Revision 4 co A PTA/PIA qualifying question must have an allowed answer. + test="current()/@value = ('yes', 'no')">[Section B Check 3.4] A PTA/PIA qualifying question must have an allowed + answer. A FedRAMP OSCAL SSP must have a privacy-sensitive designation + test="oscal:prop[@name = 'privacy-sensitive']">[Section B Check 3.4] A FedRAMP OSCAL SSP must have a privacy-sensitive + designation A FedRAMP OSCAL SSP must have - PTA/PIA qualifying question #1. + test="oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = 'pta-1']">[Section B Check 3.4] A + FedRAMP OSCAL SSP must have PTA/PIA qualifying question #1. A FedRAMP OSCAL SSP must have - PTA/PIA qualifying question #2. + test="oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = 'pta-2']">[Section B Check 3.4] A + FedRAMP OSCAL SSP must have PTA/PIA qualifying question #2. A FedRAMP OSCAL SSP must have - PTA/PIA qualifying question #3. + test="oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = 'pta-3']">[Section B Check 3.4] A + FedRAMP OSCAL SSP must have PTA/PIA qualifying question #3. A FedRAMP OSCAL SSP must have - PTA/PIA qualifying question #4. + test="oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = 'pta-4']">[Section B Check 3.4] A + FedRAMP OSCAL SSP must have PTA/PIA qualifying question #4. A FedRAMP OSCAL SSP -must have all four PTA questions. + satisfies exists(oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = $name])">[Section B Check +3.4] A FedRAMP OSCAL SSP must have all four PTA questions. A FedRAMP OSCAL -SSP must have no duplicate PTA questions. + satisfies exists(oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = $name][2]))">[Section B Check +3.4] A FedRAMP OSCAL SSP must have no duplicate PTA questions. @@ -741,7 +744,7 @@ SSP must have no duplicate PTA questions. id="has-sorn" role="error" test="/oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = 'pta-4' and @value = 'yes'] and oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = 'sorn-id' and @value != '']"> - A FedRAMP OSCAL SSP may have a SORN ID + [Section B Check 3.4] A FedRAMP OSCAL SSP may have a SORN ID @@ -751,7 +754,7 @@ SSP must have no duplicate PTA questions. test=" every $answer in //oscal:system-information/oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and matches(@name, '^pta-\d$')] satisfies $answer = 'no' or oscal:resource[oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @name = 'type' and @value = 'pia']] (: a PIA is attached :)"> - This FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis. + [Section B Check 3.4] This FedRAMP OSCAL SSP must incorporate a Privacy Impact Analysis. @@ -923,23 +926,23 @@ SSP must have no duplicate PTA questions. A - FedRAMP OSCAL SSP must have a Digital Identity Determination property. + test="oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'security-eauth' and @name = 'security-eauth-level']"> + [Section B Check 3.3] A FedRAMP OSCAL SSP must have a Digital Identity Determination property. A FedRAMP OSCAL SSP may have a Digital Identity Determination - identity-assurance-level property. + test="oscal:prop[@name = 'identity-assurance-level']">[Section B Check 3.3] A FedRAMP OSCAL SSP may have a Digital Identity + Determination identity-assurance-level property. A FedRAMP OSCAL SSP may have a Digital Identity Determination - authenticator-assurance-level property. + test="oscal:prop[@name = 'authenticator-assurance-level']">[Section B Check 3.3] A FedRAMP OSCAL SSP may have a Digital + Identity Determination authenticator-assurance-level property. A FedRAMP OSCAL SSP may have a Digital Identity Determination - federation-assurance-level property. + test="oscal:prop[@name = 'federation-assurance-level']">[Section B Check 3.3] A FedRAMP OSCAL SSP may have a Digital Identity + Determination federation-assurance-level property. @@ -948,8 +951,8 @@ SSP must have no duplicate PTA questions. A FedRAMP OSCAL SSP must have a Digital Identity Determination property with an - allowed value. + test="@value = $security-eauth-levels">[Section B Check 3.3] A FedRAMP OSCAL SSP must have a Digital Identity Determination + property with an allowed value. + @@ -1407,6 +1407,28 @@ + + + + + + + + + + + + + + + + + + @@ -1490,6 +1512,30 @@ label="that is an anomaly" /> + + + + + + + + + + + + + + + + + + + + + + @@ -1522,7 +1568,7 @@ stuff + media-type="text/plain">RmVkUkFNUAo= @@ -1554,7 +1600,7 @@ stuff + media-type="text/plain">RmVkUkFNUAo= @@ -1566,7 +1612,7 @@ + media-type="text/plain">RmVkUkFNUAo=--> @@ -1580,14 +1626,14 @@ stuff + media-type="text/plain">RmVkUkFNUAo= stuff + media-type="text/plain">RmVkUkFNUAo= - @@ -1595,7 +1641,7 @@ - stuff + RmVkUkFNUAo= @@ -1608,7 +1654,7 @@ - stuff + RmVkUkFNUAo= @@ -1622,7 +1668,7 @@ + media-type="text/plain">xxx From c179806e21f1ee09e94f4c592e3aac04069a9c65 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Fri, 25 Jun 2021 12:42:28 -0400 Subject: [PATCH 17/26] Relegate XSpec errors to pending --- resources/validations/test/ssp.xspec | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/resources/validations/test/ssp.xspec b/resources/validations/test/ssp.xspec index 0cf8e0cce..03b09f8cd 100644 --- a/resources/validations/test/ssp.xspec +++ b/resources/validations/test/ssp.xspec @@ -9,8 +9,7 @@ true false true - + @@ -1418,7 +1417,8 @@ - + RmVkUkFNUAo= + media-type="text/plain">RmVkUkFNUAo= @@ -1620,15 +1620,16 @@ - + RmVkUkFNUAo= + media-type="text/plain">RmVkUkFNUAo= RmVkUkFNUAo= + media-type="text/plain">RmVkUkFNUAo= From bf36a5f13a1b1438226bc8d38de79c29f996148d Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Mon, 28 Jun 2021 11:06:04 -0400 Subject: [PATCH 18/26] Adopt editorial changes - Use indefinite article ahead of element/attribute names - End assertion messages witha period. - Correct typos. - Remove "Section B" prefixes. - Expand initialisms and acornyms --- resources/validations/src/ssp.sch | 80 +++++++++++++++---------------- 1 file changed, 39 insertions(+), 41 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 5d5b53426..f636e822b 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -233,7 +233,7 @@ doc:organizational-id="section-c.1.a" id="invalid-security-sensitivity-level" role="fatal" - test="empty($ok-values) or not(exists($corrections))">[Section C Check 1.a] Sensitivity level has allowed value. + test="empty($ok-values) or not(exists($corrections))">[Section C Check 1.a] Sensitivity level has an allowed value. [Section D Checks] - Response statment cites a component in the system implementation inventory. + Response statement cites a component in the system implementation inventory. [Section B Check ????] This SSP has back-matter resources each with a UUID. + test="./@uuid">This SSP has back-matter resources each with a UUID. @@ -448,12 +448,12 @@ doc:organizational-id="section-b.?????" id="resource-base64-available-filenamne" role="error" - test="./@filename">[Section B Check ????] This base64 has a filename attribute. + test="./@filename">This base64 has a filename attribute. [Section B Check ????] This base64 has a filename attribute. + test="./@media-type">This base64 has a filename attribute. @@ -553,54 +553,54 @@ id="has-fedramp-acronyms" role="error" test="oscal:resource[oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @name = 'type' and @value = 'fedramp-acronyms']]">A - FedRAMP OSCAL SSP must attach the FedRAMP Master Acronym and Glossary. + FedRAMP OSCAL SSP must have the FedRAMP Master Acronym and Glossary attached. - [Section B Check 3.12] A FedRAMP OSCAL SSP must attach the FedRAMP Applicable Laws and Regulations. + [Section B Check 3.12] A FedRAMP OSCAL SSP must have the FedRAMP Applicable Laws and Regulations attached. + FedRAMP OSCAL SSP must have the FedRAMP Logo attached. [Section - B Check 3.2] A FedRAMP OSCAL SSP must attach a User Guide. + B Check 3.2] A FedRAMP OSCAL SSP must have a User Guide attached. - [Section B Check 3.5] A FedRAMP OSCAL SSP must attach Rules of Behavior. + [Section B Check 3.5] A FedRAMP OSCAL SSP must have Rules of Behavior. - [Section B Check 3.6] A FedRAMP OSCAL SSP must attach a Contingency Plan + [Section B Check 3.6] A FedRAMP OSCAL SSP must have a Contingency Plan attached. - [Section B Check 3.7] A FedRAMP OSCAL SSP must attach a Configuration Management Plan. + [Section B Check 3.7] A FedRAMP OSCAL SSP must have a Configuration Management Plan attached. - [Section B Check 3.8] A FedRAMP OSCAL SSP must attach an Incident Response Plan. + [Section B Check 3.8] A FedRAMP OSCAL SSP must have an Incident Response Plan attached. - [Section B Check 3.11] A FedRAMP OSCAL SSP must attach a Separation of Duties Matrix. + [Section B Check 3.11] A FedRAMP OSCAL SSP must have a Separation of Duties Matrix attached. @@ -664,25 +664,25 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 id="has-privacy-poc-role" role="error" test="/oscal:system-security-plan/oscal:metadata/oscal:role[@id = 'privacy-poc']">[Section B Check 3.4] A FedRAMP OSCAL SSP - must incorporate a Privacy Point of Contact role + must incorporate a Privacy Point of Contact role. [Section B Check 3.4] A - FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference + FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference. [Section B Check 3.4] A FedRAMP OSCAL SSP must declare a Privacy Point of Contact responsible party role reference identifying the - party by UUID + party by UUID. [Section B Check 3.4] A FedRAMP OSCAL SSP - must define a Privacy Point of Contact + must define a Privacy Point of Contact. @@ -693,7 +693,7 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 [Section B Check 3.4] A PTA/PIA qualifying question must have an allowed + test="current()/@value = ('yes', 'no')">[Section B Check 3.4] A Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question must have an allowed answer. [Section B Check 3.4] A FedRAMP OSCAL SSP must have a privacy-sensitive - designation + designation. [Section B Check 3.4] A - FedRAMP OSCAL SSP must have PTA/PIA qualifying question #1. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #1. [Section B Check 3.4] A - FedRAMP OSCAL SSP must have PTA/PIA qualifying question #2. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #2. [Section B Check 3.4] A - FedRAMP OSCAL SSP must have PTA/PIA qualifying question #3. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #3. [Section B Check 3.4] A - FedRAMP OSCAL SSP must have PTA/PIA qualifying question #4. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #4. - [Section B Check 3.4] A FedRAMP OSCAL SSP may have a SORN ID + [Section B Check 3.4] A FedRAMP OSCAL SSP may have a SORN ID. @@ -1257,7 +1257,7 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 ' are not present, this configuration is invalid. [Section C Check 1.a] No sensitivity level found, no more validation processing + id="no-security-sensitivity-level-diagnostic">[Section C Check 1.a] No sensitivity level was found As a result, no more validation processing can occur. [Section D Checks] Response statment + id="invalid-component-match-diagnostic">[Section D Checks] Response statement with component reference UUID ' ' is not in the system implementation inventory, and cannot be used to define a control. @@ -1371,20 +1371,18 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 . [Section B Check ????] This SSP includes back-matter resource missing a + id="resource-uuid-required-diagnostic">This SSP includes back-matter resource missing a UUID. [Section B Check ????] This SSP references back-matter resource: + id="resource-rlink-required-diagnostic">This SSP references back-matter resource: . [Section B Check ????] This SSP has file name: - . + id="resource-base64-available-filenamne-diagnostic">This base64 lacksd a filename attribute. [Section B Check ????] This SSP has media type: - . + id="resource-base64-available-media-type-diagnostic">This base64 lacksd a media-type attribute. This resource lacks a uuid attribute. @@ -1514,16 +1512,16 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 id="has-privacy-sensitive-designation-diagnostic">The privacy-sensitive designation is missing. The PTA/PIA qualifying question #1 is missing. + id="has-pta-question-1-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #1 is missing. The PTA/PIA qualifying question #2 is missing. + id="has-pta-question-2-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #2 is missing. The PTA/PIA qualifying question #3 is missing. + id="has-pta-question-3-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #3 is missing. The PTA/PIA qualifying question #4 is missing. + id="has-pta-question-4-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #4 is missing. One or more of the four PTA questions is missing. @@ -1726,19 +1724,19 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 id="inventory-item-has-one-asset-type-diagnostic">This inventory-item has more than one asset-type property. This inventory-item lacks virtual property. + id="inventory-item-has-virtual-diagnostic">This inventory-item lacks a virtual property. This inventory-item has more than one virtual property. This inventory-item lacks public property. + id="inventory-item-has-public-diagnostic">This inventory-item lacks a public property. This inventory-item has more than one public property. This inventory-item lacks scan-type property. + id="inventory-item-has-scan-type-diagnostic">This inventory-item lacks a scan-type property. This inventory-item has more than one scan-type property. From 2238c9d24a4411d0d1e82564ee0f5ceaf40ac662 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Mon, 28 Jun 2021 11:31:27 -0400 Subject: [PATCH 19/26] Juxtapose assertion and diagnostic and highlight both --- resources/validations/src/rules.css | 7 +++-- resources/validations/src/rules.xsl | 40 ++++++++++++++--------------- 2 files changed, 25 insertions(+), 22 deletions(-) diff --git a/resources/validations/src/rules.css b/resources/validations/src/rules.css index a205700df..a5156d1de 100644 --- a/resources/validations/src/rules.css +++ b/resources/validations/src/rules.css @@ -85,10 +85,13 @@ blockquote { .diagnostic { font-style: italic; } -.assertion { +.assertion, +.diagnostic { font-weight: bold; + font-size:larger; } -.assertion:before { +.assertion:before, +.diagnostic:before { content: "assertion: "; font-style: normal; font-weight: normal; diff --git a/resources/validations/src/rules.xsl b/resources/validations/src/rules.xsl index a75e0f919..c5d82e753 100644 --- a/resources/validations/src/rules.xsl +++ b/resources/validations/src/rules.xsl @@ -260,6 +260,26 @@ select="node()" /> + + +
+ + + + + + + +
+ +
context: @@ -281,26 +301,6 @@ select="@role" />
- - -
- - - - - - - -
- - Date: Mon, 28 Jun 2021 11:34:41 -0400 Subject: [PATCH 20/26] Adopt editorial changes --- resources/validations/src/rules.xsl | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/resources/validations/src/rules.xsl b/resources/validations/src/rules.xsl index c5d82e753..7b4a211f5 100644 --- a/resources/validations/src/rules.xsl +++ b/resources/validations/src/rules.xsl @@ -147,15 +147,15 @@
  • For FedRAMP OSCAL SSP reviewers
    • -
  • Can/shall Schematron be a structured form of FedRAMP rule definitions? (A Schematron document may include arbitrary - information cast as XML in one or more XML namespaces.) From 66a3f9551f1e16661757b1b9edeed4195386896f Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Mon, 28 Jun 2021 11:44:35 -0400 Subject: [PATCH 21/26] Terminate transform if input document is not available --- resources/validations/src/rules.xsl | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/resources/validations/src/rules.xsl b/resources/validations/src/rules.xsl index 7b4a211f5..ac0e93f00 100644 --- a/resources/validations/src/rules.xsl +++ b/resources/validations/src/rules.xsl @@ -167,6 +167,12 @@ + + The expected input document {.} is not available. + From 89eddeaae3629dd7c5963b5daa9f459e506a1853 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Mon, 28 Jun 2021 11:46:33 -0400 Subject: [PATCH 22/26] Apply XML formatting --- resources/validations/src/ssp.sch | 52 ++++++++++++++++++------------- 1 file changed, 30 insertions(+), 22 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index f636e822b..4e929f727 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -233,7 +233,8 @@ doc:organizational-id="section-c.1.a" id="invalid-security-sensitivity-level" role="fatal" - test="empty($ok-values) or not(exists($corrections))">[Section C Check 1.a] Sensitivity level has an allowed value. + test="empty($ok-values) or not(exists($corrections))">[Section C Check 1.a] Sensitivity level has an allowed + value. - [Section B Check 3.12] A FedRAMP OSCAL SSP must have the FedRAMP Applicable Laws and Regulations attached. + [Section B Check 3.12] A FedRAMP OSCAL SSP must have the FedRAMP Applicable Laws and Regulations attached. + FedRAMP OSCAL SSP must have the FedRAMP Logo attached. [Section - B Check 3.2] A FedRAMP OSCAL SSP must have a User Guide attached. + B Check 3.2] A FedRAMP OSCAL SSP must have a User Guide attached. - [Section B Check 3.6] A FedRAMP OSCAL SSP must have a Contingency Plan attached. + [Section B Check 3.6] A FedRAMP OSCAL SSP must have a Contingency Plan attached. - [Section B Check 3.7] A FedRAMP OSCAL SSP must have a Configuration Management Plan attached. + [Section B Check 3.7] A FedRAMP OSCAL SSP must have a Configuration Management Plan attached. - [Section B Check 3.8] A FedRAMP OSCAL SSP must have an Incident Response Plan attached. + [Section B Check 3.8] A FedRAMP OSCAL SSP must have an Incident Response Plan attached. - [Section B Check 3.11] A FedRAMP OSCAL SSP must have a Separation of Duties Matrix attached. + [Section B Check 3.11] A FedRAMP OSCAL SSP must have a Separation of Duties Matrix attached. @@ -693,8 +694,8 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 [Section B Check 3.4] A Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question must have an allowed - answer. + test="current()/@value = ('yes', 'no')">[Section B Check 3.4] A Privacy Threshold Analysis (PTA)/Privacy Impact Analysis + (PIA) qualifying question must have an allowed answer. @@ -707,22 +708,26 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 id="has-pta-question-1" role="error" test="oscal:prop[@ns = 'https://fedramp.gov/ns/oscal' and @class = 'pta' and @name = 'pta-1']">[Section B Check 3.4] A - FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #1. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question + #1. [Section B Check 3.4] A - FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #2. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question + #2. [Section B Check 3.4] A - FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #3. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question + #3. [Section B Check 3.4] A - FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #4. + FedRAMP OSCAL SSP must have Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question + #4. ' are not present, this configuration is invalid. [Section C Check 1.a] No sensitivity level was found As a result, no more validation processing - can occur. + id="no-security-sensitivity-level-diagnostic">[Section C Check 1.a] No sensitivity level was found As a result, no more + validation processing can occur. [Section C Check 1.a] @@ -1371,8 +1376,7 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 . This SSP includes back-matter resource missing a - UUID. + id="resource-uuid-required-diagnostic">This SSP includes back-matter resource missing a UUID. This SSP references back-matter resource: @@ -1512,16 +1516,20 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 id="has-privacy-sensitive-designation-diagnostic">The privacy-sensitive designation is missing. The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #1 is missing. + id="has-pta-question-1-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #1 + is missing. The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #2 is missing. + id="has-pta-question-2-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #2 + is missing. The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #3 is missing. + id="has-pta-question-3-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #3 + is missing. The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #4 is missing. + id="has-pta-question-4-diagnostic">The Privacy Threshold Analysis (PTA)/Privacy Impact Analysis (PIA) qualifying question #4 + is missing. One or more of the four PTA questions is missing. From 0b33aaaf4a6feb0456982514b9f75acfd7c85822 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Mon, 28 Jun 2021 12:51:13 -0400 Subject: [PATCH 23/26] Adopt editorial changes --- resources/validations/src/rules.xsl | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/resources/validations/src/rules.xsl b/resources/validations/src/rules.xsl index ac0e93f00..b4e333768 100644 --- a/resources/validations/src/rules.xsl +++ b/resources/validations/src/rules.xsl @@ -180,13 +180,13 @@

    Rules

    -

    NB: When FedRAMP rules and validation logic is discussed, there is a minor mismatch between a general concept of a rule + +

    The following table lists Schematron assert and report elements with the Schematron ID, assertion + (affirmative statement), diagnostic (negative statement used when the assertion was false), and related attributes. Each of these + is subordinate to a context defined in a parent Schematron rule element.

    The Schematron documentation describes a rule> as

    From 54f3ffb7bdc5ccc47090ca3e5634f9f05a2c91c1 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Tue, 29 Jun 2021 01:26:46 -0400 Subject: [PATCH 24/26] Augment CMVP (FIPS 140) assertions --- resources/validations/src/ssp.sch | 34 +++++- resources/validations/test/ssp.xspec | 160 +++++++++++++++++++++++++++ 2 files changed, 192 insertions(+), 2 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 4e929f727..32d4e61ad 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -778,6 +778,24 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 role="error" test="oscal:prop[@name = 'validation-reference']">A validation component or inventory-item must have a validation-reference property.     + A validation component or inventory-item must have a validation-details + link. +     + + A validation-reference property must provide a CMVP certificate number. + + + A + validation-details link must refer to a NIST CMVP certificate detail page.     @@ -1544,12 +1562,24 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 id="has-pia-diagnostic">This FedRAMP OSCAL SSP lacks a Privacy Impact Analysis. A FedRAMP OSCAL SSP does not declare one or more FIPS 140 validated + id="has-CMVP-validation-diagnostic">This FedRAMP OSCAL SSP does not declare one or more FIPS 140 validated modules. A validation component or inventory-item lacks a validation-reference + id="has-CMVP-validation-reference-diagnostic">This validation component or inventory-item lacks a validation-reference property. + This validation component or inventory-item lacks a validation-details + link. + This validation-reference property does not resemble a CMVP + certificate number. + This validation-details link href attribute does not resemble a CMVP + certificate URL. This FedRAMP OSCAL SSP lacks a FIPS 199 categorization. diff --git a/resources/validations/test/ssp.xspec b/resources/validations/test/ssp.xspec index 03b09f8cd..70ec1d954 100644 --- a/resources/validations/test/ssp.xspec +++ b/resources/validations/test/ssp.xspec @@ -2968,6 +2968,166 @@ label="that is an error" /> + + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     +     + + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     +     + + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     +     + + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     +     From ce4f79253b69657df28a76fab5ea17c370fe0999 Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Tue, 29 Jun 2021 01:55:41 -0400 Subject: [PATCH 25/26] Augment CMVP (FIPS 140) assertions - fix one regex - ensure sibling validation-reference and validation-details cite the same CMVP certificate --- resources/validations/src/ssp.sch | 22 +++++++- resources/validations/test/ssp.xspec | 80 ++++++++++++++++++++++++++++ 2 files changed, 100 insertions(+), 2 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 32d4e61ad..89e881e8e 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -788,14 +788,24 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 A validation-reference property must provide a CMVP certificate number. + test="matches(@value, '^\d{3,4}$')">A validation-reference property must provide a CMVP certificate number. + A validation-reference + property must be in accord with its sibling validation-details href. A + test="matches(@href, '^https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/\d{3,4}$')">A validation-details link must refer to a NIST CMVP certificate detail page. + A + validation-details link must be in accord with its sibling validation-reference.     @@ -1576,10 +1586,18 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 doc:context="oscal:prop[@name = 'validation-reference']" id="has-credible-CMVP-validation-reference-diagnostic">This validation-reference property does not resemble a CMVP certificate number. + This validation-reference property does not match its sibling + validation-details href. This validation-details link href attribute does not resemble a CMVP certificate URL. + This validation-details link href attribute does not match its sibling + validation-reference value. This FedRAMP OSCAL SSP lacks a FIPS 199 categorization. diff --git a/resources/validations/test/ssp.xspec b/resources/validations/test/ssp.xspec index 70ec1d954..f969415b7 100644 --- a/resources/validations/test/ssp.xspec +++ b/resources/validations/test/ssp.xspec @@ -3088,6 +3088,46 @@ label="that is an error" /> + + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     +     @@ -3128,6 +3168,46 @@ label="that is an error" /> + + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     + + + + FIPS 140-2 Validation + +

    FIPS 140-2 Validation

    +     + + + +     +     + +     +     From 96661dbfd2e870bbd1f27b63f48aa2f8a03555ba Mon Sep 17 00:00:00 2001 From: Gary Gapinski Date: Wed, 30 Jun 2021 16:18:11 -0400 Subject: [PATCH 26/26] Use FIPS 199 categorations from fedramp_values.xml - fix typos --- resources/validations/src/ssp.sch | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/resources/validations/src/ssp.sch b/resources/validations/src/ssp.sch index 89e881e8e..271249216 100644 --- a/resources/validations/src/ssp.sch +++ b/resources/validations/src/ssp.sch @@ -454,7 +454,7 @@ doc:organizational-id="section-b.?????" id="resource-base64-available-media-type" role="error" - test="./@media-type">This base64 has a filename attribute. + test="./@media-type">This base64 has a media-type attribute.     @@ -944,12 +944,12 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 selected element. - + A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact base or + test=". = $fips-199-levels">A FedRAMP OSCAL SSP information-type confidentiality-, integrity-, or availability-impact base or select element must have an approved value. @@ -1411,10 +1411,10 @@ A FedRAMP SSP must incorporate a procedure document for each of the 17 NIST SP 8 . This base64 lacksd a filename attribute. + id="resource-base64-available-filenamne-diagnostic">This base64 lacks a filename attribute. This base64 lacksd a media-type attribute. + id="resource-base64-available-media-type-diagnostic">This base64 lacks a media-type attribute. This resource lacks a uuid attribute.