SSP Completeness Checks [EPIC]

[brian-ruf]

This is a ...

fix - something needs to be different

This relates to ...

• the Guide to OSCAL-based FedRAMP System Security Plans (SSP)
• the FedRAMP SSP OSCAL Template (JSON or XML Format)
• the FedRAMP OSCAL Validations

User Story

This reflects Stage 1A, SSP Completeness portion of the FedRAMP Automation Team's Constraint Management Strategy [Assess: FedRAMP only] for grouping and prioritizing constraint work.

Using the Legacy Word SSP Template as a reference, the FedRAMP Automation Team will work on SSP-related completeness checks that can be implemented via metaschema constraints in the following sequence and groupings:

The following SSP template topic areas are deferred pending modeling and analysis work:

• 11 Separation of Duties: Defer this until the Separation of Duties matrix is properly modeled.
• Appendix Q Cryptographic Modules Table
• 10 Cryptographic Modules Implemented for Data At Rest (DAR)/Data In Transit (DIT)

The following SSP template topics will be generated, and will not have completeness checks:

• Appendix J Control Implementation Summary (CIS) and Customer Responsibilities Matrix (CRM) Workbook

OSCAL based SSPs and POA&Ms are treated as separate artifacts. As such, Appendix O POA&M from the FedRAMP SSP Word template is not within the scope of SSP completeness checks and will instead be treated as a separate workstream under the constraint strategy.

Goals

SSP Completeness checks are defined, tested and documented

Task List

• SSP Completeness Checks: Title Page and Section 3 System Information #804
• SSP Completeness Checks: 4 System Owner / 5 Assignment of Security Responsibility / Document Prep #805
• SSP Completeness Checks: 8 Illustrated Architecture and Narratives #811
• SSP Completeness Checks: 6 Leveraged FedRAMP-Authorized Services #807
• SSP Completeness Checks: 7 External Systems and Services Not Having FedRAMP Authorization #808
• SSP Completeness Checks: Appendix E Digital Identity Worksheet #812
• SSP Completeness Checks: Appendix K Federal Information Processing Standard (FIPS) 199 Categorization #814
• SSP Completeness Checks: Appendices B Acronyms & L Laws and Regulations #815
• SSP Completeness Checks: 9 Services, Ports, and Protocols #806
• SSP Completeness Checks: Appendices C, D, F, G, H, I, N, P #809
• SSP Completeness Checks: Security Controls #810
• Address Former Rev 4 User Table Template #902
• Provider Constraint for Leveraged Authorizations and External, Interconnected, and Unauthorized Systems #937
• SSP Completeness Checks: Appendix M Integrated Inventory Workbook (IIW) #813