Poorly-chosen SP 800-63-3 assurance level properties

[GaryGapinski]

• This is a ...

  • concern - I think something needs to be different.
  • question - I didn't understand something.
  • kudos - I found something helpful and want to encourage it in future FedRAMP publications.
  • request - I would like to see something additional provided.

• This relates to ...

  • the FedRAMP OSCAL Registry (Excel File)
  • the Guide to OSCAL-based FedRAMP Content (PDF)
  • the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Reports (SAR) (PDF)
  • the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • General/Overall
  • Other

NOTE: For feedback related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

• Where, exactly?
  • For the registry, please indicate the tab and cell, or other clear identifier
  • For the guide, please indicate the section number and printed page number (lower right corner)
  • For the OSCAL XML or JSON files, please indicate XML or JSON; and indicate the line number, field id, or other clear location identifier

Section 4.5 page 13 Digital Identity Determination

Properties (OSCAL <prop>)

• security-eauth-level
• identity-assurance-level
• authenticator-assurance-level
• federation-assurance-level

• What is your feedback?

The assurance level property values indicated (i.e., 1, 2, 3) are not the same parlance as that used in SP 800-63.

The initialisms used in SP 800-63 are

• IAL1, IAL2, IAL3
• AAL1, AAL2, AAL3
• FAL1, FAL2, FAL3

Those are the most likely to be recognized rather than the disembodied "1", "2", "3".

• What version of OSCAL are you using? (Check our info on supported OSCAL versions)

1.0.0

• What action would you like to see from the FedRAMP PMO?

Use SP 800-63 parlance for assurance level values.

[ohsh6o]

Discussed this with the NIST OSCAL devs. This will make our FedRAMP props disjoint from the standard NIST OSCAL props and the Metaschema-defined constraints. We agreed to get more feedback in a model meeting next week and follow up in usnistgov/OSCAL#985. Sorry for the delayed @GaryGapinski.

[ohsh6o]

Discussed in 10x NIST developer meeting and will surface in Friday's model meeting per consultation with the NIST devs.

[volpet2014]

Collaborated with NIST recently. Still pending change from NIST to address this.

[volpet2014]

Will stay as is.