FedRAMP_extensions.xml

<?xml version="1.0" encoding="UTF-8"?>
<extensions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="bac3886f-deb3-4d9d-a422-b563d906b27c">
   <metadata>
      <title>[EXPERIMENTAL] FedRAMP Extensions</title>
		<published>2024-09-24T02:24:00Z</published>
		<last-modified>2024-09-24T02:24:00Z</last-modified>
		<version>fedramp2.1.0-oscal1.0.4</version>
      <revisions>
         <revision>
            <published>2023-06-30T00:00:00Z</published>
            <version>DRAFT-01</version>
            <prop name="party-uuid" ns="https://fedramp.gov/ns/oscal" value="9505ecff-86c4-42ad-aeb9-e6b0f8eacb69"/>
            <remarks>
               <p>Initial draft for fedramp-2.0.0-oscal-1.1.1 release. Subject to change.</p>
            </remarks>
         </revision>
         <revision>
            <published>2023-07-06T00:00:00Z</published>
            <version>DRAFT-02</version>
            <remarks>
               <p>Updated remarks for deprecated extensions, and added new rev5 extensions.</p>
               <p>The bindings and constraints for the new rev5 extensions are pending and will be added in a future revision.</p>
            </remarks>
         </revision>
         <revision>
            <published>2023-07-12T00:00:00Z</published>
            <version>DRAFT-03</version>
            <remarks>
               <p>Minor edits.</p>
            </remarks>
         </revision>
      </revisions>

      <role id="prepared-by">
         <title>Prepared By</title>
         <description>
            <p>The organization that prepared this content.</p>
         </description>
      </role>

      <party uuid="77e0e2c8-2560-4fe9-ac78-c3ff4ffc9f6d" type="organization">
         <name>Federal Risk and Authorization Management Program: Program Management Office</name>
         <short-name>FedRAMP PMO</short-name>
         <link href="https://fedramp.gov"/>
         <email-address>info@fedramp.gov</email-address>
         <address type="work">
            <addr-line>1800 F St. NW</addr-line>
            <addr-line/>
            <city>Washington</city>
            <state>DC</state>
            <postal-code/>
            <country>US</country>
         </address>
         <remarks>
            <p>This party entry must be present in a FedRAMP SSP.</p>
            <p>The uuid may be different; however, the uuid must be associated with the "fedramp-pmo" role in the responsible-party assemblies.</p>
         </remarks>
      </party>

      <responsible-party role-id="prepared-by">
         <party-uuid>77e0e2c8-2560-4fe9-ac78-c3ff4ffc9f6d</party-uuid>
      </responsible-party>

      <remarks>
         <p>This EXPERIMENTAL file extends OSCAL to meet FedRAMP requirements.</p>
         <p>It provides the extensions, defined identifiers, and acceptable values in a machine-readable format necessary to meet FedRAMP Authorization Package requirements.</p>
      </remarks>
   </metadata>

   <!-- ===================================================================== -->
   <!--  OSCAL Key Value  -->
   <!-- ===================================================================== -->

   <index id="index-local-party-id" target="//o:party">
      <key-field target="@uuid"/>
      <remarks>
         <p>This document only.</p>
      </remarks>
   </index>
   <index id="index-assessment-layer-party-id" target="oscal-document-set()/(o:assessment-plan | o:assessment-results)//o:party">
      <key-field target="@uuid"/>
      <remarks>
         <p>Select documents.</p>
      </remarks>
   </index>
   <index id="global-local-party-id" target="oscal-document-set()//o:party">
      <key-field target="@uuid"/>
      <remarks>
         <p>Entire stack.</p>
      </remarks>
   </index>

   <!-- ===================================================================== -->
   <!--  OSCAL Extension Namespace Value  -->
   <!-- ===================================================================== -->

   <extension-namespace ns="https://fedramp.gov/ns/oscal"/>

   <!-- ===================================================================== -->
   <!--  EXTENSIONS  -->
   <!-- ===================================================================== -->

   <extension id="response-point">
      <extension-name>response-point</extension-name>
      <formal-name>Response Point</formal-name>
      <description>A property whose presence indicates its parent part is a required point of response for FedRAMP stakeholders.</description>

      <binding pattern="/o:profile/o:modify/o:alter/o:add/o:prop"/>
      <binding pattern="/o:profile/o:modify/o:alter/o:add//o:part/o:prop"/>
      <binding pattern="/o:catalog//o:control//o:part/o:prop"/>
      <binding pattern="/o:assessment-plan/o:local-definitions/o:objectives-and-methods//part/o:prop"/>
      <binding pattern="/o:assessment-results/o:local-definitions/o:objectives-and-methods//part/o:prop"/>

      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
      <remarks>
         <p>This appears in FedRAMP profiles and resolved profile catalogs.</p>
         <p>For control statements, it signals to the CSP which statements require a response in the SSP.</p>
         <p>For control objectives, it signals to the assessor which control objectives must appear in the assessment results, which aligns with the FedRAMP test case workbook.</p>
      </remarks>
   </extension>

   <extension id="revision-history-party-uuid">
      <extension-name>party-uuid</extension-name>
      <formal-name>Party Identifier</formal-name>
      <description>Identifies the party who authored this revision.</description>
      <binding pattern="/*/o:metadata/o:revisions/o:revision/o:prop"/>
      <constraint>
         <matches data-type="uuid"/>
         <has-cardinality min-occurs="0" max-occurs="unbounded"/>
         <index-has-key name="index-local-party-uuid" target="o:prop[@name='party-uuid']">
            <key-field target="."/>
            <remarks>
               <p>On the revision element in the revision history, the party-uuid extension must match the UUID of an existing party in the metadata.</p>
            </remarks>
         </index-has-key>
         <!-- TODO: -->
         <!-- Need index-has-key syntax for ensuring the identified UUID represents an existing UUID assigned to a party.  -->
      </constraint>
   </extension>

   <extension id="iso-iec-17020-identifier">
      <extension-name>iso-iec-17020-identifier</extension-name>
      <formal-name>ISO/IEC 17020 Identifier</formal-name>
      <description>The ISO/IEC-17020 identifier assigned to the assessor related to their status as an A2LA Accredited Third Party Assessment Organization.</description>
      <binding pattern="/o:assessment-plan/o:metadata/o:party/o:prop"/>
      <binding pattern="/o:assessment-results/o:metadata/o:party/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="CORE">
      <extension-name>CORE</extension-name>
      <formal-name>Core Control</formal-name>
      <description>Identifies a control that must be included in every FedRAMP assessment.</description>
      <binding pattern="/o:profile/o:modify/o:alter/o:add/o:prop"/>
      <binding pattern="/o:profile/o:modify/o:alter/o:add//o:control/o:prop"/>
      <binding pattern="/o:catalog//o:control/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
      <remarks>
         <p>Core controls must be assessed every year, and are often subject to additional scrutiny by assessors and adjudication reviewers.</p>
      </remarks>
   </extension>

   <extension id="security-cia-level">
      <extension-name>security-eauth-level</extension-name>
      <formal-name>eAuth Level (OVERALL)</formal-name>
      <description>The overall electronic authentication (eAuth) level applied to the system.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:prop"/>
      <binding pattern="system-characteristics/o:prop[@name='authenticator-assurance-level']"/>
      <binding pattern="system-characteristics/o:prop[@name='federation-assurance-level']"/>
      <binding pattern="system-characteristics/o:prop[@name='identity-assurance-level']"/>
      <constraint>
         <matches data-type="integer"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="1" label="Level 1 (Low)">The overall eAuth Level is defined as Level 1 (Low).</enum>
            <enum value="2" label="Level 2 (Moderate)">The overall eAuth Level is defined as Level 2 (Moderate).</enum>
            <enum value="3" label="Level 3 (High)">The overall eAuth Level is defined as Level 3 (High).</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="authorization-type">
      <extension-name>authorization-type</extension-name>
      <formal-name>Authorization Type</formal-name>
      <description>Identifies the FedRAMP authorization type.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="fedramp-jab" label="JAB P-ATO">A FedRAMP Joint Authorization Board (JAB) Provisional-Authorization to Operate (P-ATO).</enum>
            <enum value="fedramp-agency" label="Agency ATO">A FedRAMP Agency Authorization to Operate (ATO).</enum>
            <enum value="fedramp-li-saas" label="Tailored (LI-SaaS) ATO">A FedRAMP Tailored authorization to operate (ATO) for low impact Software as a Service (LI-SaaS) systems.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="users-internal">
      <extension-name>users-internal</extension-name>
      <formal-name>Internal Users</formal-name>
      <description>The current number of users internal to the organization.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:prop"/>
      <constraint>
         <matches data-type="integer"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="users-external">
      <extension-name>users-external</extension-name>
      <formal-name>External Users</formal-name>
      <description>The current number of users external to the organization.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:prop"/>
      <constraint>
         <matches data-type="integer"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="users-internal-future">
      <extension-name>users-internal-future</extension-name>
      <formal-name>Future Internal Users</formal-name>
      <description>The anticipated number of users internal to the organization in one year.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:prop"/>
      <constraint>
         <matches data-type="integer"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="users-external-future">
      <extension-name>users-external-future</extension-name>
      <formal-name>Future External Users</formal-name>
      <description>The anticipated number of users external to the organization in one year.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:prop"/>
      <constraint>
         <matches data-type="integer"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="privacy-designation">
      <extension-name>privacy-designation</extension-name>
      <formal-name>Privacy Designation</formal-name>
      <description>Indicates whether this system is privacy sensitive.</description>
      <binding pattern="system-information/o:prop[@name='privacy-sensitive']"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="yes" label="Yes">Privacy Sensitive</enum>
            <enum value="no" label="No">Not Privacy Sensitive</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="privacy-threshold-analysis-q1">
      <extension-name>privacy-threshold-analysis-q1</extension-name>
      <formal-name>Privacy Threshold Analysis Q1</formal-name>
      <description>Does the ISA collect, maintain, or share PII in any identifiable form?</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:system-information/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="yes" label="Yes">Yes, the ISA collects, maintains, or shares some form of PII.</enum>
            <enum value="no" label="No">No, the ISA does not collect, maintain, or share PII in any form.</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="privacy-threshold-analysis-q2">
      <extension-name>privacy-threshold-analysis-q2</extension-name>
      <formal-name>Privacy Threshold Analysis Q2</formal-name>
      <description>Does the ISA collect, maintain, or share PII from or about the public?</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:system-information/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="yes" label="Yes">Yes, the ISA collects, maintains, or shares PII from or about the public.</enum>
            <enum value="no" label="No">No, the ISA does not collect, maintain, or share PII from or about the public.</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="privacy-threshold-analysis-q3">
      <extension-name>privacy-threshold-analysis-q3</extension-name>
      <formal-name>Privacy Threshold Analysis Q3</formal-name>
      <description>Has a Privacy Impact Assessment (PIA) ever been performed for the ISA?</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:system-information/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="yes" label="Yes">Yes, a PIA has been performed.</enum>
            <enum value="no" label="No">No, a PIA has not been performed..</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="privacy-threshold-analysis-q4">
      <extension-name>privacy-threshold-analysis-q4</extension-name>
      <formal-name>Privacy Threshold Analysis Q4</formal-name>
      <description>Is there a Privacy Act System of Records Notice (SORN) for this ISA system?</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:system-information/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="yes" label="Yes">Yes, there is a SORN ID for this system.</enum>
            <enum value="no" label="No">No, there is not a SORN ID for this system.</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="sorn-id">
      <extension-name>sorn-id</extension-name>
      <formal-name>SORN ID</formal-name>
      <description>An assigned System of Records Notice (SORN) identifier for this system.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:system-information/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <expect test=".[@name='pta-4'][@ns='https://fedramp.gov/ns/oscal']/@value='yes' and .[@name='sorn-id'][@ns='https://fedramp.gov/ns/oscal']"/>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="user-sensitivity-level">
      <extension-name>sensitivity</extension-name>
      <formal-name>User Sensitivity Level</formal-name>
      <description>Defines the sensitivity level of the identified user type.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:user/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="unbounded"/>
         <allowed-values allow-other="no">
            <enum value="high-risk" label="High Risk">Misuse of the user's access could result in grave damage to the public's trust.</enum>
            <enum value="severe" label="Severe">Misuse of the user's access could result in a substantial degree of harm or serious damage to the public’s trust.</enum>
            <enum value="moderate" label="Moderate">Misuse of the user's access could result in a fair amount of harm or serious damage to the public’s trust.</enum>
            <enum value="limited" label="Limited">Misuse of the user's access could result in some harm or discernible damage to the public’s trust.</enum>
            <enum value="not-applicable" label="Not Applicable">The user does not have access to the system.</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Values are as required by FedRAMP for packages based on NIST 800-53, Revision 4.</p>
         <p>Authoritative source: <a href="#871713A8-5A27-4AC3-8B94-972588469C6B">OPM Position Designation (Page 18)</a>.</p>
      </remarks>
   </extension>

   <extension id="service-processor">
      <extension-name>service-processor</extension-name>
      <formal-name>Service Processor</formal-name>
      <description>Name of the interconnection service processor.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:component[@type='interconnection']/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="1" max-occurs="unbounded"/>
      </constraint>
   </extension>
   <extension id="information">
      <extension-name>information</extension-name>
      <formal-name>Transmitted Information</formal-name>
      <description>Describes the information transmitted over the interconnection.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:component[@type='interconnection']/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="1" max-occurs="unbounded"/>
      </constraint>
   </extension>

   <extension id="asset-type">
      <extension-name>asset-type</extension-name>
      <formal-name>Asset Type</formal-name>
      <description>Identifies the type of asset.</description>
      <binding pattern="component/o:prop[@name='asset-type']"/>
      <binding pattern="o:inventory-item/o:prop[@name='asset-type']"/>
      <constraint>
         <matches data-type="token"/>
         <allowed-values allow-other="yes">
            <enum value="os" short-label="OS">Operating System</enum>
            <enum value="database" short-label="DB">Database</enum>
            <enum value="web-server" short-label="Web">Service</enum>
            <enum value="dns-server" short-label="DNS">Policy</enum>
            <enum value="email-server" short-label="eMail">Process</enum>
            <enum value="directory-server" short-label="LDAP">Procedure</enum>
            <enum value="pbx" short-label="PBX">Private Branch Exchange</enum>
            <enum value="firewall" short-label="FW">Firewall</enum>
            <enum value="router" short-label="Rtr">Router</enum>
            <enum value="switch" short-label="Swtch">Switch</enum>
            <enum value="storage-array" short-label="Store">Storage Array</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="interconnection-direction">
      <extension-name>interconnection-direction</extension-name>
      <formal-name>Interconnection Direction</formal-name>
      <description>Identifies the direction of information flow for the interconnection.</description>
      <binding pattern="o:component[@component-type='interconnection']/o:prop[@name='direction'][@ns='https://fedramp.gov/ns/oscal']"/>
      <constraint>
         <matches data-type="token"/>
         <allowed-values allow-other="no">
            <enum value="incoming" short-label="In">Incoming</enum>
            <enum value="outgoing" short-label="Out">Outgoing</enum>
            <enum value="incoming-outgoing" short-label="In/Out">Bi-Directional</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
         <p>Use core OSCAL "direction" <code>prop</code> instead.</p>
      </remarks>
   </extension>

   <extension id="interconnection-security">
      <extension-name>interconnection-security</extension-name>
      <formal-name>Interconnection Security</formal-name>
      <description>Identifies the type of security applied to the interconnection.</description>
      <binding pattern="o:component[@component-type='interconnection']/o:prop[@name='connection-security'][@ns='https://fedramp.gov/ns/oscal']/@value"/>
      <constraint>
         <matches data-type="token"/>
         <allowed-values allow-other="no">
            <enum value="ipsec" short-label="IPsec">IPsec</enum>
            <enum value="vpn" short-label="VPN">Virtual Private Network</enum>
            <enum value="ssl" short-label="SSL">Secure Socket Layer</enum>
            <enum value="certificate" short-label="Cert">Certificate</enum>
            <enum value="secure-file-transfer" short-label="SFT">Secure File Transfer</enum>
            <enum value="other" short-label="Other">Other</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="inventory-item-state">
      <extension-name>inventory-item-state</extension-name>
      <formal-name>Different states of inventory items: public, private, et cetera.</formal-name>
      <description>Indicates if the asset is virtual.</description>
      <binding pattern="o:inventory-item/o:prop[@name='virtual']"/>
      <binding pattern="o:component/o:prop[@name='virtual']"/>
      <binding pattern="o:inventory-item/o:prop[@name='public']"/>
      <binding pattern="component/o:prop[@name='public']"/>
      <binding pattern="o:inventory-item/o:prop[@name='allows-authenticated-scan']/@value"/>
      <binding pattern="o:component/o:prop[@name='allows-authenticated-scan']/@value"/>
      <binding pattern="o:inventory-item/o:prop[@name='is-scanned']/@value"/>
      <binding pattern="o:component/o:prop[@name='is-scanned']/@value"/>
      <constraint>
         <matches data-type="token"/>
         <allowed-values allow-other="no">
            <enum value="yes" short-label="Y">Yes</enum>
            <enum value="no" short-label="N">No</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
         <p>Use core OSCAL "public" and "virtual" <code>prop</code> instead.</p>
      </remarks>
   </extension>

   <extension id="circuit">
      <extension-name>circuit</extension-name>
      <formal-name>Service Processor</formal-name>
      <description>A circuit used for the communication.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:component[@type='interconnection']/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="1" max-occurs="unbounded"/>
      </constraint>
   </extension>

   <extension id="interconnection-security">
      <extension-name>interconnection-security</extension-name>
      <formal-name>Interconnection Security</formal-name>
      <description>Identifies the mechanisms/protocol(s) used to secure the communication.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:component[@type='interconnection']/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="unbounded"/>
         <allowed-values allow-other="no">
            <enum value="ipsec" label="IPsec">IPsec</enum>
            <enum value="vpn" label="VPN">Virtual Private Network</enum>
            <enum value="ssl" label="SSL">Secure Socket Layer</enum>
            <enum value="certificate" label="Cert">Certificate</enum>
            <enum value="secure-file-transfer" label="SFT">Secure File Transfer</enum>
            <enum value="other" label="Other">Other</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Renamed from "connection-security" to "interconnection-security".</p>
      </remarks>
   </extension>

   <extension id="service-used-by">
      <extension-name>used-by</extension-name>
      <formal-name>Service Used By</formal-name>
      <description>Identifies what uses the service.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:component[@type='service']/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="1" max-occurs="unbounded"/>
      </constraint>
   </extension>

   <extension id="scan-type">
      <extension-name>scan-type</extension-name>
      <formal-name>Scan Type</formal-name>
      <description>Identifies the type(s) of scans to be performed on this inventory-item or component.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:component/o:prop"/>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:system-inventory/o:o:inventory-item/o:prop"/>
      <binding pattern="/o:assessment-plan/o:local-definitions/o:component/o:prop"/>
      <binding pattern="/o:assessment-plan/o:local-definitions/o:o:inventory-item/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:local-definitions/o:component/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:local-definitions/o:o:inventory-item/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="unbounded"/>
         <allowed-values allow-other="no">
            <enum value="infrastructure" label="Infrastructure">The component or inventory item is included in operating system (OS) and/or infrastructure scans.</enum>
            <enum value="database" label="Database">The component or inventory item is included in Database scans.</enum>
            <enum value="web" label="Web">The component or inventory item is included in Web interface/application scans.</enum>
            <enum value="other" label="Other">The component or inventory item is included in non-typical scans.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="planned-completion-date">
      <extension-name>planned-completion-date</extension-name>
      <formal-name>Planned Completion Date</formal-name>
      <description>Provides the date the control expects to be implemented. Must be present when Implementation Status is "Planned"</description>
      <binding pattern="/o:system-security-plan/o:control-implementation/o:implemented-requirement/o:prop"/>
      <constraint>
         <matches data-type="date"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="authorization-recommendation">
      <extension-name>authorization-recommendation</extension-name>
      <formal-name>Authorization Recommendation</formal-name>
      <description>Indicates whether the assessor recommends the system be authorized by the authorizing official.</description>
      <binding pattern="/o:assessment-results/o:results/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="yes" label="Yes">Yes, the assessor recommends the system for authorization.</enum>
            <enum value="no" label="No">No, the assessor does not recommend the system for authorization.</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
         <p>Use "recommend-authorization" <code>prop</code> instead.</p>
      </remarks>
   </extension>

   <extension id="title-short">
      <extension-name>title-short</extension-name>
      <formal-name>Short Title</formal-name>
      <description>The short name for the system represented in the resource.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:back-matter/o:resource/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <!-- TODO:  -->
         <!-- need constraint to ensure this only appears where the resource represents a system -->
         <!-- Need to double-check guidebooks. -->
         <!-- Probably needs to be a separate constraint below. -->
      </constraint>
   </extension>

   <extension id="system-id">
      <extension-name>system-id</extension-name>
      <formal-name>System Identifier</formal-name>
      <description>The FedRAMP-assigned identifier for this system.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:back-matter/o:resource/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <!-- TODO:  -->
         <!-- need constraint to ensure this only appears where the resource represents a system -->
         <!-- Need to double-check guidebooks. -->
         <!-- Probably needs to be a separate constraint below. -->
      </constraint>
   </extension>

   <extension id="import-profile">
      <extension-name>import-profile</extension-name>
      <formal-name>Profile</formal-name>
      <description>The baseline/profile for this system based on its FIPS-199 categorization.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:back-matter/o:resource/o:prop"/>
      <constraint>
         <matches data-type="uri"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <!-- TODO:  -->
         <!-- need constraint to ensure this only appears where the resource represents a system -->
         <!-- Need to double-check guidebooks. -->
         <!-- Probably needs to be a separate constraint below. -->
      </constraint>
   </extension>

   <extension id="authorization-date">
      <extension-name>authorization-date</extension-name>
      <formal-name>Authorization Date</formal-name>
      <description>The date the system was authorized. Omit or leave blank for an initial authorization.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:back-matter/o:resource/o:prop"/>
      <constraint>
         <matches data-type="date"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <!-- TODO:  -->
         <!-- need constraint to ensure this only appears where the resource represents a system -->
         <!-- Need to double-check guidebooks. -->
         <!-- Probably needs to be a separate constraint below. -->
      </constraint>
   </extension>

   <extension id="purpose">
      <extension-name>purpose</extension-name>
      <formal-name>Purpose</formal-name>
      <description>Explains the system's purpose.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:back-matter/o:resource/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <!-- TODO:  -->
         <!-- need constraint to ensure this only appears where the resource represents a system -->
         <!-- Need to double-check guidebooks. -->
         <!-- Probably needs to be a separate constraint below. -->
      </constraint>
   </extension>

   <extension id="description">
      <extension-name>description</extension-name>
      <formal-name>Description</formal-name>
      <description>A brief description of the system.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:back-matter/o:resource/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <!-- TODO:  -->
         <!-- need constraint to ensure this only appears where the resource represents a system -->
         <!-- Need to double-check guidebooks. -->
         <!-- Probably needs to be a separate constraint below. -->
      </constraint>
      <remarks>
         <p>Deprecated.</p>
      </remarks>
   </extension>

   <extension id="sampling">
      <extension-name>sampling</extension-name>
      <formal-name>Sampling</formal-name>
      <description>Indicates whether a sampling methodology was used instead of assessing the entire system.</description>
      <binding pattern="/o:assessment-plan/o:assessment-subject/o:prop"/>
      <binding pattern="/o:assessment-results/o:results/o:assessment-subject/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="yes" label="Yes">Yes, a sampling methodology was used.</enum>
            <enum value="no" label="No">No, a sampling methodology was not used.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="control-objective-implementation-status">
      <extension-name>control-objective-implementation-status</extension-name>
      <formal-name>Objective Implementation Status</formal-name>
      <description>Indicates the implementation status of the control objective.</description>
      <binding pattern="/o:assessment-results/o:results/o:finding/o:target/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="implemented" label="Implemented">The assessor finds sufficient evidence to agree the control objective is fully implemented.</enum>
            <enum value="partial" label="Partial">The assessor finds evidence to suggest a portion of the control objective is implemented and a portion is not.</enum>
            <enum value="planned" label="Planned">The assessor finds this control objective is not implemented, but there is evidence the system owner has a plan for implementing it.</enum>
            <enum value="alternative" label="Alternative Implementation">The assessor finds evidence of an alternative implementation, which the assessor judges to provide protection similar enough to satisfy this control.</enum>
            <enum value="not-applicable" label="Not Applicable (N/A)">The assessor finds this control objective does not apply to this system.</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Deprecated.</p>
         <p>Use "implementation-status" <code>prop</code> instead.</p>
      </remarks>
   </extension>

   <extension id="control-implementation-status">
      <extension-name>implementation-status</extension-name>
      <formal-name>Control Implementation Status</formal-name>
      <description>Indicates the implementation status of the control.</description>
      <binding pattern="o:implemented-requirement/o:prop[@name='implementation-status']/@value"/>
      <binding pattern="/o:assessment-results/o:results/o:finding/o:target/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values allow-other="no">
            <enum value="implemented" label="Implemented">The assessor finds sufficient evidence to agree the control objective is fully implemented.</enum>
            <enum value="partial" label="Partial">The assessor finds evidence to suggest a portion of the control objective is implemented and a portion is not.</enum>
            <enum value="planned" label="Planned">The assessor finds this control objective is not implemented, but there is evidence the system owner has a plan for implementing it.</enum>
            <enum value="alternative" label="Alternative Implementation">The assessor finds evidence of an alternative implementation, which the assessor judges to provide protection similar enough to satisfy this control.</enum>
            <enum value="not-applicable" label="Not Applicable (N/A)">The assessor finds this control objective does not apply to this system.</enum>
         </allowed-values>
      </constraint>
      <remarks>
         <p>Updated bindings and constraint.</p>
      </remarks>
      <!--
      <constraint>
         <has-cardinality min-occurs="1" max-occurs="unbounded"/>
         <remarks>
            <p>When an prop is defined as an extension, a separate constraint assembly is needed to specify data type and allowed values on the <code>@value</code> flag.</p>
         </remarks>
      </constraint>
      -->
   </extension>

   <extension id="leveraged-authorization">
      <extension-name>leveraged-authorization-uuid</extension-name>
      <formal-name>Leveraged Authorization</formal-name>
      <description>Indicates a leveraged authorization used for this control.</description>
      <binding pattern="/o:assessment-results/o:results/o:finding/o:target/o:prop"/>
      <constraint>
         <matches data-type="uuid"/>
         <has-cardinality min-occurs="0" max-occurs="unbounded"/>
      </constraint>
      <remarks>
         <p>This is for legacy SSP conversion to OSCAL. The preferred approach is to specify the leveraged system as a <code>component</code> and reference it in the control using <code>by-component</code>.</p>
      </remarks>
   </extension>

   <extension id="control-origination">
      <extension-name>control-origination</extension-name>
      <formal-name>Control Origination</formal-name>
      <description>The point(s) from which the control satisfaction originates.</description>
      <binding pattern="implemented-requirement/o:prop[@name='control-origination']/@value"/>
      <constraint>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <remarks>
            <p>When an prop is defined as an extension, a separate constraint assembly is needed to specify data type and allowed values on the <code>@value</code> flag.</p>
         </remarks>
         <allowed-values allow-other="no">
            <enum value="sp-corporate" short-label="SP Corporate">Service Provider (Corporate)</enum>
            <enum value="sp-system" short-label="SP System">Service Provider (System Specific)</enum>
            <enum value="customer-configured" short-label="Cust. Configured">Configured by Customer</enum>
            <enum value="customer-provided" short-label="Cust. Provided">Provided by Customer</enum>
            <enum value="inherited" short-label="Inherited">Inherited</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="no-oscal-ssp-title-short">
      <extension-name>title-short</extension-name>
      <formal-name>Short System Name</formal-name>
      <description>The abbreviated name for the system, such as an acronym.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource[./o:prop[@name='type'][.='no-oscal-ssp']]/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="no-oscal-ssp-system-id">
      <extension-name>system-id</extension-name>
      <formal-name>Short System Name</formal-name>
      <description>The FedRAMP-assigned system identifier.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource[./o:prop[@name='type'][.='no-oscal-ssp']]/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="no-oscal-ssp-import-profile">
      <extension-name>import-profile</extension-name>
      <formal-name>Relevant Baseline</formal-name>
      <description>Identifies the relevant OSCAL baseline.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource[./o:prop[@name='type'][.='no-oscal-ssp']]/o:prop"/>
      <constraint>
         <matches data-type="uri"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
      <remarks>
         <p>As with all URIs in OSCAL, this may contain a URI fragment, which identifies the local resource containing the relevant profile.</p>
      </remarks>
   </extension>

   <extension id="no-oscal-ssp-purpose">
      <extension-name>system-id</extension-name>
      <formal-name>Short System Name</formal-name>
      <description>The FedRAMP-assigned system identifier.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource[./o:prop[@name='type'][.='no-oscal-ssp']]/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="no-oscal-ssp-authorization-date">
      <extension-name>authorization-date</extension-name>
      <formal-name>Authorization Date</formal-name>
      <description>The date of the system's initial FedRAMP authorization.</description>
      <binding pattern="/o:assessment-plan/o:back-matter/o:resource[./o:prop[@name='type'][.='no-oscal-ssp']]/o:prop"/>
      <constraint>
         <matches data-type="dateTime-with-timezone"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="task-login-url">
      <extension-name>login-url</extension-name>
      <formal-name>Login URL</formal-name>
      <description>The login URL for a web application.</description>
      <binding pattern="/o:system-security-plan/o:system-implementation/o:o:inventory-item/o:prop"/>
      <binding pattern="/o:assessment-plan//o:task/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:local-definition/o:o:inventory-item/o:prop"/>
      <constraint>
         <matches data-type="NCName"/>
      </constraint>
      <remarks>
         <p>Extension renamed from "login-url" to "login-url".</p>
      </remarks>
   </extension>

   <extension id="task-login-id">
      <extension-name>login-id</extension-name>
      <formal-name>Login ID</formal-name>
      <description>The login ID used to assess the web application.</description>
      <binding pattern="/o:assessment-plan//o:task/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:local-definition/o:o:inventory-item/o:prop"/>
      <constraint>
         <matches data-type="NCName"/>
      </constraint>
      <remarks>
         <p>Extension renamed from "login-id" to "login-id".</p>
      </remarks>
   </extension>

   <extension id="task-test-type">
      <extension-name>test-type</extension-name>
      <formal-name>Test Type</formal-name>
      <description>Indicates the type of test represented by the task.</description>
      <binding pattern="/o:assessment-plan//o:task/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:local-definition/o:o:inventory-item/o:prop"/>
      <constraint>
         <matches data-type="NCName"/>
         <allowed-values>
            <enum value="web-application" label="Web Application">This task tests a web application.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="task-user-uuid">
      <extension-name>user-uuid</extension-name>
      <formal-name>User Identifier</formal-name>
      <description>Cites the SSP defined user role to use for testing.</description>
      <binding pattern="/o:assessment-plan//o:task/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:local-definition/o:o:inventory-item/o:prop"/>
      <constraint>
         <matches data-type="uuid"/>
      </constraint>
   </extension>

   <extension id="poam-id">
      <extension-name>poam-id</extension-name>
      <formal-name>POA&amp;M ID</formal-name>
      <description>A CSP-assigned POA&amp;M identifier.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:poam-item/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="poam-impacted-control">
      <extension-name>impacted-control-id</extension-name>
      <formal-name>Impacted Control</formal-name>
      <description>A control impacted by this POA&amp;M item.</description>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:prop"/>
      <constraint>
         <matches data-type="token"/>
      </constraint>
      <remarks>
         <p>Impacted control is required in the POA&amp;M and optional in the SAR.</p>
         <p>It is allowed in the SAR in anticipation of duplicating open risks from the SAR to the POA&amp;M.</p>
      </remarks>
   </extension>

   <extension id="sar-risk-priority">
      <extension-name>priority</extension-name>
      <formal-name>Risk Priority</formal-name>
      <description>Assessor's recommended risk priority. Lower numbers are higher priority. One (1) is highest priority.</description>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:prop"/>
      <constraint>
         <matches data-type="integer"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="sar-recommend-authorization">
      <extension-name>recommend-authorization</extension-name>
      <formal-name>Assessor's Authorization Recommendation</formal-name>
      <description>Indicates the assessor's recommendation for initial or continued authorization.</description>
      <binding pattern="/o:assessment-results/o:result/o:attestation/o:part[@name='authorization-statements']/o:prop"/>
      <constraint>
         <matches data-type="NCName"/>
         <has-cardinality min-occurs="1" max-occurs="1"/>
         <allowed-values>
            <enum value="yes" label="Yes">The assessor recommends initial or continued authorization.</enum>
            <enum value="no" label="No">The assessor does not recommend initial or continued authorization.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="likelihood">
      <extension-name>likelihood</extension-name>
      <formal-name>Likelihood</formal-name>
      <description>The likelihood of a risk.</description>
      <binding pattern="o:risk/o:risk-metric[@name='likelihood'][@system='https://fedramp.gov']"/>
      <allowed-values allow-other="no">
         <enum value="low" short-label="L">Low</enum>
         <enum value="moderate" short-label="M">Moderate</enum>
         <enum value="high" short-label="H">High</enum>
      </allowed-values>
   </extension>

   <extension id="vulnerability-identifier">
      <extension-name>vulnerability-id</extension-name>
      <formal-name>Vulnerability Identifier</formal-name>
      <description>A tool assigned vulnerability ID.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:characterization/o:origin/o:actor[@type='tool']/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:characterization/o:origin/o:actor[@type='tool']/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="plugin-identifier">
      <extension-name>plugin-id</extension-name>
      <formal-name>Plugin Identifier</formal-name>
      <description>A tool assigned Plugin ID.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:characterization/o:origin/o:actor[@type='tool']/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:characterization/o:origin/o:actor[@type='tool']/o:prop"/>
      <constraint>
         <matches data-type="string"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
      </constraint>
   </extension>

   <extension id="operational-requirement">
      <extension-name>operational-requirement</extension-name>
      <formal-name>Operational Requirement</formal-name>
      <description>The risk cannot be remediated without impact to the system and must be accepted.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:observation/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:observation/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values>
            <enum value="investigating" label="Investigating">A possible operational requirement is being investigated.</enum>
            <enum value="pending" label="Tracking">An operational requirement deviation request was submitted to the AO and is pending adjudication.</enum>
            <enum value="approved" label="Approved">The operational requirement has been approved by the AO.</enum>
            <enum value="withdrawn" label="Withdrawn">The operational requirement was withdrawn.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="false-positive">
      <extension-name>false-positive</extension-name>
      <formal-name>False Positive</formal-name>
      <description>The risk was found to be a false positive report.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:observation/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:observation/o:prop"/>
      <constraint>
         <matches data-type="NCName"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values>
            <enum value="investigating" label="Investigating">A possible risk adjustment is being investigated.</enum>
            <enum value="pending" label="Tracking">A false positive deviation request was submitted to the AO and is pending adjudication.</enum>
            <enum value="approved" label="Approved">The false positive has been approved by the AO.</enum>
            <enum value="withdrawn" label="Withdrawn">The false positive was withdrawn.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="risk-adjustment">
      <extension-name>risk-adjustment</extension-name>
      <formal-name>Risk Adjustment</formal-name>
      <description>Mitigating factors were identified or implemented, reducing the likelihood or impact of the risk.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:observation/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:observation/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values>
            <enum value="investigating" label="Investigating">A possible risk adjustment is being investigated.</enum>
            <enum value="pending" label="Tracking">A risk adjustment deviation request was submitted to the AO and is pending adjudication.</enum>
            <enum value="approved" label="Approved">The risk adjustment has been approved by the AO.</enum>
            <enum value="withdrawn" label="Withdrawn">The risk adjustment was withdrawn.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <extension id="vendor-dependency">
      <extension-name>vendor-dependency</extension-name>
      <formal-name>Vendor Dependency</formal-name>
      <description>A vendor resolution is pending, but not yet available.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:prop"/>
      <binding pattern="/o:plan-of-action-and-milestones/o:observation/o:prop"/>
      <binding pattern="/o:assessment-results/o:result/o:observation/o:prop"/>
      <constraint>
         <matches data-type="token"/>
         <has-cardinality min-occurs="0" max-occurs="1"/>
         <allowed-values>
            <enum value="investigating" label="Investigating">The risk is a suspected vendor dependency, and is being investigated for verification.</enum>
            <enum value="tracking" label="Tracking">The vendor has confirmed the issue and is working on a resolution.</enum>
            <enum value="resolved" label="Resolved">The vendor released the fix and it has been applied.</enum>
            <enum value="withdrawn" label="Withdrawn">The vendor dependency was withdrawn.</enum>
         </allowed-values>
      </constraint>
   </extension>

   <!-- ===================================================================== -->
   <!--  EXTENSIONS added for rev5 templates -->
   <!-- ===================================================================== -->

   <extension id="assessment-type">
      <extension-name>assessment-type</extension-name>
      <formal-name>Assessment Type</formal-name>
      <description>The type of assessment (e.g., initial authorization, annual assessment, assessment for a significant change, or another type of assessment).</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="authentication-method">
      <extension-name>authentication-method</extension-name>
      <formal-name>Authentication Method</formal-name>
      <description>The authentication method(s) for users of a leveraged service or external interconnection. Refer to for authentication methods NIST 800-63B (https://pages.nist.gov/800-63-3/sp800-63b.html) for authentication methods</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="authorized-users">
      <extension-name>authorized-users</extension-name>
      <formal-name>Authorized Users</formal-name>
      <description>The users or roles that can access the leveraged service or external interconnection. </description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="cryptographic-module-usage">
      <extension-name>cryptographic-module-usage</extension-name>
      <formal-name>Cryptographic Module Usage</formal-name>
      <description>The cryptographic module is used for data at rest (DAT) or data in transit (DIT).</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="csp-validated">
      <extension-name>csp-validated</extension-name>
      <formal-name>CSP Validated</formal-name>
      <description>The CSP ensured the independent assessor team roles are appropriately filled.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="discrepancies">
      <extension-name>discrepancies</extension-name>
      <formal-name>Discrepancies</formal-name>
      <description>Any discrepancies between inventory that was in scope for the planned assessment and the assets in the assessment results.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="discrepencies-reason">
      <extension-name>discrepancies-reason</extension-name>
      <formal-name>Discrepancies Reason</formal-name>
      <description>The justification or reason for any discrepancies between inventory that was in scope for the planned assessment and the assets in the assessment results.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="fully-operational-date">
      <extension-name>fully-operational-date</extension-name>
      <formal-name>Fully Operational Date</formal-name>
      <description>The date when security control implementations for the appropriate control baseline was completed.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
         <p>“Fully operational” means there are no “gaps” in the security control baseline implementations for the system. The CSP attests that the security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements.</p>
      </remarks>
   </extension>

   <extension id="ia-manual-review">
      <extension-name>ia-manual-review</extension-name>
      <formal-name>IA Manual Review</formal-name>
      <description>Confirmation that the independent assessor performed a manual review of (scan) configuration files to analyze for existing vulnerabilities. </description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="ia-validated">
      <extension-name>ia-validated</extension-name>
      <formal-name>IA Validated</formal-name>
      <description>The independent assessor ensured the assessment team roles are appropriately filled.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="impact-level">
      <extension-name>impact-level</extension-name>
      <formal-name>Impact Level</formal-name>
      <description>The impact level of a leveraged authorization.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="interconnection-compliance">
      <extension-name>interconnection-compliance</extension-name>
      <formal-name>Interconnection Compliance</formal-name>
      <description>Any (security) compliance certifications the third party external service has (e.g., PCI SOC 2, CSA STAR Level 2, etc.).</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="interconnection-data-categorization">
      <extension-name>interconnection-data-categorization</extension-name>
      <formal-name>Interconnection Data Categorization</formal-name>
      <description>The security impact level of the data (Low, Moderate, High), processed by or stored in the external service, in accordance with FIPS 199 &amp; NIST 800-60 Vol. 2.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="interconnection-data-type">
      <extension-name>interconnection-data-type</extension-name>
      <formal-name>Interconnection Data Type</formal-name>
      <description>The type of data / information processed by or stored in the external service, in accordance with NIST 800-60 Vol. 2.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="interconnection-hosting-environment">
      <extension-name>interconnection-hosting-environment</extension-name>
      <formal-name>Interconnection Hosting Environment</formal-name>
      <description>A description of the hosting environment (e.g., corporate network, IaaS, or self-hosted) for the external service.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="interconnection-risk">
      <extension-name>interconnection-risk</extension-name>
      <formal-name>Interconnection Risk</formal-name>
      <description>A description of the potential risks introduced by the external system/service and impact to the CSO or federal data if the confidentiality, integrity, and availability (CIA) of the system/service is compromised.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="interconnection-type">
      <extension-name>interconnection-type</extension-name>
      <formal-name>Interconnection Type</formal-name>
      <description>Numeric indicator of the type of interconnection, where 1 = Non-FedRAMP Authorized Cloud Services, 2 = Corporate Shared Services, and 3 = Update Services for In-Boundary Software/Services. </description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="ipv4-address">
      <extension-name>ipv4-address</extension-name>
      <formal-name>IPv4 Address</formal-name>
      <description>The IP address of a component, inventory item, or other asset.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
         <p>Core OSCAL has an "ipv4-address" <code>prop</code> which can be used for certain component types and for inventory items.  This extension can be used instead, and is also applicable for other assemblies such as <code>assessment-platform</code>.</p>
      </remarks>
   </extension>

   <extension id="ipv4-subnet">
      <extension-name>ipv4-subnet</extension-name>
      <formal-name>IPv4 Subnet</formal-name>
      <description>The subnet for a component of inventory item.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="kev-catalog">
      <extension-name>kev-catalog</extension-name>
      <formal-name>KEV Catalog</formal-name>
      <description>Indicates if this vulnerability is on the CISA Known Exploited Vulnerabilities (KEV) Catalog.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
         <p>In accordance with Binding Operational Directive (BOD) 22-01, CSPs must track their vulnerabilities against the KEV catalog.</p>
      </remarks>
   </extension>

   <extension id="kev-due-date">
      <extension-name>kev-due-date</extension-name>
      <formal-name>Due Date</formal-name>
      <description>The KEV catalog specified due date by which the vulnerability must be remediated.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
         <p>In accordance with Binding Operational Directive (BOD) 22-01, CSPs must track their vulnerabilities against the KEV catalog.</p>
      </remarks>
   </extension>

   <extension id="label">
      <extension-name>label</extension-name>
      <formal-name>Test ID</formal-name>
      <description>The test ID for the manual test method.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="leveraged-system-identifier">
      <extension-name>leveraged-system-identifier</extension-name>
      <formal-name>leveraged-system-identifier</formal-name>
      <description>The identifier corresponding to the FedRAMP package ID.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="name">
      <extension-name>name</extension-name>
      <formal-name>Tool Name</formal-name>
      <description>The product or tool name for a component or inventory item.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="nature-of-agreement">
      <extension-name>nature-of-agreement</extension-name>
      <formal-name>Nature of Agreement</formal-name>
      <description>Any type of agreement between a CSP and the leveraged CSP vendors who support products (e.g., End User Licensing Agreement (EULA), Service-Level Agreement (SLA), App License Agreement, Contract, etc.).</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="resolution-resource">
      <extension-name>resolution-resource</extension-name>
      <formal-name>Resolution Resource</formal-name>
      <description>The back-matter resource reference used to determine which FedRAMP validation rule sets apply.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="scan-percentage">
      <extension-name>scan-percentage</extension-name>
      <formal-name>Scan Percentage</formal-name>
      <description>The scan coverage</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="significant-changes-scope">
      <extension-name>significant-changes-scope</extension-name>
      <formal-name>Significant Changes Scope</formal-name>
      <description>The general quantity of significant change(s) in scope.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="sort-id">
      <extension-name>sort-id</extension-name>
      <formal-name>Sort ID</formal-name>
      <description>Identifier for sort ordering content.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Core OSCAL has a "sort-id" <code>prop</code>, however this "sort-id" extension can be applied to any assembly that provided information which may need to be rendered in a specific order.  The <code>step</code> assembly is an example of this.</p>
      </remarks>
   </extension>

   <extension id="still-supported">
      <extension-name>still-supported</extension-name>
      <formal-name>Still Supported</formal-name>
      <description>Specify if the product / component is still supported by the vendor / manufacturer.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>

   <extension id="type">
      <extension-name>type</extension-name>
      <formal-name>Type</formal-name>
      <description>The "type" of back-matter resource.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
         <p>Locally defined resource types.</p>
      </remarks>
   </extension>

   <extension id="vendor-name">
      <extension-name>vendor-name</extension-name>
      <formal-name>Vendor Name</formal-name>
      <description>The vendor or manufacturer of a component or inventory item.</description>
      <!-- Todo: add bindings -->
      <!-- Todo: add constraints -->
      <remarks>
         <p>Added for rev 5 templates.</p>
      </remarks>
   </extension>


   <!-- ===================================================================================== -->

   <constraint name="observation-types">
      <formal-name>Observation Types</formal-name>
      <description>In addition to the NIST observation types, FedRAMP requires observation types to support risk deviations and vendor dependencies.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:observation/o:type"/>
      <binding pattern="/o:assessment-results/o:result/o:observation/o:type"/>
      <allowed-values allow-other="yes">
         <enum value="vendor-dependency" label="Vendor Dependency">The observation provides evidence of reliance on a vendor for a pending resolution that is not yet available.</enum>
         <enum value="false-positive" label="False Positive">The observation provides evidence the associated risk is a false positive finding.</enum>
         <enum value="operational-requirement" label="Operational Requirement">The observation provides evidence to substantiate the assertion that remediating the risk will have an adverse impact on the system.</enum>
         <enum value="risk-adjustment" label="Risk Adjustment">The observation provides evidence to justify an adjustment to the likelihood or impact values.</enum>
         <enum value="closure" label="Closure">The observation provides evidence of risk closure.</enum>
      </allowed-values>
   </constraint>

   <constraint name="sar-risk-impacted-control">
      <formal-name>Impacted Control</formal-name>
      <description>The impacted control field is optional in the SAR, but helpful in anticipation of copying open risks to the POA&amp;M.</description>
      <binding pattern="/o:assessment-results/o:result/o:risk/o:prop"/>
      <has-cardinality min-occurs="0" max-occurs="unbounded"/>
   </constraint>

   <constraint name="poam-risk-impacted-control">
      <formal-name>Impacted Control</formal-name>
      <description>At least one impacted control field is required in the POA&amp;M.</description>
      <binding pattern="/o:plan-of-action-and-milestones/o:risk/o:prop"/>
      <has-cardinality min-occurs="0" max-occurs="unbounded"/>
   </constraint>

   <constraint name="control-origination-constraints">
      <formal-name>Control Origination</formal-name>
      <description>The point(s) from which the control satisfaction originates.</description>
      <binding pattern="/o:system-security-plan/o:control-implmentation/o:implemented-requirement/o:prop[@name='control-origination'][@ns='https://fedramp.gov/ns/oscal']/@value"/>
      <matches data-type="token"/>
      <allowed-values allow-other="no">
         <enum value="sp-corporate" label="SP Corporate">Service Provider (Corporate)</enum>
         <enum value="sp-system" label="SP System">Service Provider (System Specific)</enum>
         <enum value="customer-configured" label="Cust. Configured">Configured by Customer</enum>
         <enum value="customer-provided" label="Cust. Provided">Provided by Customer</enum>
         <enum value="inherited" label="Inherited">Inherited</enum>
      </allowed-values>
   </constraint>

   <constraint name="control-implementation-status-constraints">
      <formal-name>Control Implementation Status Constraints</formal-name>
      <description>Defines the data type and allowed values for the Control Implementation Status</description>
      <binding pattern="/o:system-security-plan/o:control-implmentation/o:implemented-requirement/o:prop[@name='implementation-status'][@ns='https://fedramp.gov/ns/oscal']/@value"/>
      <matches data-type="token"/>
      <allowed-values allow-other="no">
         <enum value="implemented" label="Implemented">The assessor finds sufficient evidence to agree the control objective is fully implemented.</enum>
         <enum value="partial" label="Partial">The assessor finds evidence to suggest a portion of the control objective is implemented and a portion is not.</enum>
         <enum value="planned" label="Planned">The assessor finds this control objective is not implemented, but there is evidence the system owner has a plan for implementing it.</enum>
         <enum value="alternative" label="Alternative Implementation">The assessor finds evidence of an alternative implementation, which the assessor judges to provide protection similar enough to satisfy this control.</enum>
         <enum value="not-applicable" label="Not Applicable (N/A)">The assessor finds this control objective does not apply to this system.</enum>
      </allowed-values>
      <remarks>
         <p>When an extension is an prop, the data type and allowed values must be defined in a separate constraint.</p>
      </remarks>
   </constraint>

   <constraint>
      <formal-name>Control Implementation Status Constraints</formal-name>
      <description>Remarks are required for certain Control Implementation Status values.</description>
      <binding pattern="/o:system-security-plan/o:control-implmentation/o:implemented-requirement"/>
      <matches data-type="NCName"/>
      <expect test="(o:prop[@name='planned-completion'][@ns='https://fedramp.gov/ns/oscal'])"/>
   </constraint>

   <constraint>
      <formal-name>FedRAMP Facet System Constraints</formal-name>
      <!-- TODO: NEED TO FILL OUT -->
   </constraint>


   <!-- ===================================================================== -->
   <!--  CONSTRAINTS: Check for required content  -->
   <!-- ===================================================================== -->

   <constraint name="planned-completion-date">
      <formal-name>Planned Implementation Date Exists</formal-name>
      <description>If the control implementation status is "Planned" a "Planned Implementation Date" must be provided.</description>
      <prop name="reference">3.1</prop>
      <binding pattern="/o:system-security-plan/o:control-implementation/o:implemented-requirement[o:prop[@name='implementation-status'][@value='planned']]"/>
      <expect test="(o:prop[@name='implementation-status'][@ns='https://fedramp.gov/ns/oscal'][@value='partial']/remarks)"/>
      <expect test="(o:prop[@name='implementation-status'][@ns='https://fedramp.gov/ns/oscal'][@value='planned']/remarks)"/>
      <expect test="(o:prop[@name='implementation-status'][@ns='https://fedramp.gov/ns/oscal'][@value='alternative']/remarks)"/>
      <expect test="(o:prop[@name='implementation-status'][@ns='https://fedramp.gov/ns/oscal'][@value='not-applicable']/remarks)"/>
      <remarks>
         <p>In the SSP, if <code>implemented-requirement</code> includes <code>prop[@name='implementation-status']</code> with <code>value='planned'</code>, a <code>planned-completion-date</code> extension must be provided.</p>
      </remarks>
   </constraint>

   <constraint>
      <formal-name>Port Class Exists</formal-name>
      <description>If a port number is provided as part of an interconnection, Local or Remote must be specified.</description>
      <binding pattern="o:system-security-plan/o:system-implementation/o:component[@component-type='interconnection']/o:prop[@name='port']"/>
      <expect test="exists(@class)"/>
      <remarks>
         <p>The port field is a FedRAMP extension - a property assigned to a component with a component type of 'interconnection'.</p>
         <p>When this extension is present, it must include a <code>@class</code> flag with a value of either 'local' or 'remote'.</p>
      </remarks>
   </constraint>

   <constraint>
      <formal-name>Port Class Valid Values</formal-name>
      <description>If a port number is provided as part of an interconnection, Local or Remote must be specified.</description>
      <binding pattern="o:system-security-plan/o:system-implementation/o:component[@component-type='interconnection']/o:prop[@name='port']/@class"/>
      <allowed-values allow-other="no">
         <enum value="local" label="Local">The identified port number is used by the interconnected system to communicate with this system.</enum>
         <enum value="remote" label="Remote">The identified port number is used by this system to communicate with the interconnected system.</enum>
      </allowed-values>
      <remarks>
         <p>The port field is a FedRAMP extension - a property assigned to a component with a component type of 'interconnection'.</p>
         <p>When this extension is present, it must include a <code>@class</code> flag with a value of either 'local' or 'remote'.</p>
      </remarks>
   </constraint>

   <constraint>
      <formal-name>Additional Component Types</formal-name>
      <description>Identifies additional component types for Assessment Assets in the SAP and SAR.</description>
      <binding pattern="o:assessment-plan/o:assessment-assets/o:component/@type"/>
      <binding pattern="o:assessment-results/o:assessment-result/o:local-definitions/o:assessment-assets/o:component/@type"/>
      <allowed-values allow-other="no">
         <enum value="assessment-origination" label="Assessment Origination">The component identifies one or more IP addresses from which assessment activities may be performed.</enum>
      </allowed-values>
      <remarks>
         <p>For FedRAMP, the SAP must identify the IP addresses from which scanning and penetration test activities are performed, and the SAR must identify the actual IP addresses used.</p>
         <p>This requires an additional component type in the SAP's <code>assessment-assets</code>, and in the SAR's <code>result</code>, <code>local-definitions</code>, <code>assessment-assets</code>.</p>
      </remarks>
   </constraint>


   <!-- ===================================================================== -->
   <!--  CONSTRAINTS: Expand NIST allowed values.  -->
   <!-- ===================================================================== -->

   <constraint name="fedramp-general-role-identifiers">
      <formal-name>General Role Identifiers</formal-name>
      <description>FedRAMP additional roles identifiers.</description>
      <binding pattern="/*/o:metadata/o:role/@id"/>
      <allowed-values allow-other="yes">
         <enum value="fedramp-pmo" label="FedRAMP PMO">The FedRAMP Program Management Office (PMO)</enum>
         <enum value="fedramp-jab" label="FedRAMP JAB">The FedRAMP Joint Authorization Board (JAB)</enum>
         <enum value="cloud-service-provider" label="CSP">Cloud Service Provider</enum>
         <enum value="csp-operations-center" label="CSP Operations Center">Cloud Service Provider Operations Center</enum>
      </allowed-values>
      <remarks>
         <p>These are in addition to the NIST-defined allowed values for role identifiers, and apply to all OSCAL-based FedRAMP content.</p>
      </remarks>
   </constraint>

   <constraint name="fedramp-assessment-role-identifiers">
      <formal-name>Assessment Role Identifiers</formal-name>
      <description>FedRAMP additional roles identifiers.</description>
      <binding pattern="/*/o:metadata/o:role/@id"/>
      <allowed-values allow-other="yes">
         <enum value="assessor" label="Assessor">Assessor</enum>
         <enum value="assessment-team" label="Assessment Team">Assessment Team</enum>
         <enum value="assessment-lead" label="Assessment Lead">Assessment Lead</enum>
         <enum value="assessment-executive" label="Assessment Executive">Assessment Executive</enum>
         <enum value="csp-assessment-poc" label="CSP Assessment PoC">Cloud Service Provider Assessment Point(s) of Contact</enum>
         <enum value="csp-end-of-testing-poc" label="CSP End of Testing PoC">Cloud Service Provider End of Testing Point(s) of Contact</enum>
         <enum value="csp-results-poc" label="CSP Results PoC">Cloud Service Provider Point(s) of Contact</enum>
         <enum value="penetration-test-team" label="Penetration Test Team">Penetration Test Team</enum>
         <enum value="penetration-test-lead" label="Penetration Test Lead">Penetration Test Lead</enum>
      </allowed-values>
      <remarks>
         <p>These are in addition to the NIST-defined allowed values for role identifiers, and apply to OSCAL-based FedRAMP SAP and SAR content.</p>
      </remarks>
   </constraint>

   <constraint name="hash-algorithm">
      <extension-name>hash-algorithm</extension-name>
      <formal-name>Hash Algorithm</formal-name>
      <description>Identifies the algorithm used to create the hash value of the attachment.</description>
      <binding pattern="o:resource/o:hash/@algorithm"/>
      <allowed-values allow-other="yes">
         <enum value="SHA-224" short-label="SHA-224">SHA-224</enum>
         <enum value="SHA-256" short-label="SHA-256">SHA-256</enum>
         <enum value="SHA-384" short-label="SHA-384">SHA-384</enum>
         <enum value="SHA-512" short-label="SHA-512">SHA-512</enum>
         <enum value="RIPEMD-160" short-label="RIPEMD-160">RIPEMD-160</enum>
      </allowed-values>
   </constraint>

   <constraint name="attachment-type">
      <formal-name>Attachment/Resource Types</formal-name>
      <description>FedRAMP additional attachment/resource types.</description>
      <binding pattern="/*/o:back-matter/o:resource/o:prop[@name='type']"/>
      <allowed-values allow-other="yes">
         <enum value="law" short-label="Law">Law or Statute</enum>
         <enum value="regulation" short-label="Regulation">Regulation or Directive</enum>
         <enum value="standard" short-label="Standard">Industry Standard</enum>
         <enum value="guidance" short-label="Guidance">Guidance</enum>
         <enum value="policy" short-label="Policy">Policy</enum>
         <enum value="procedure" short-label="Procedure">Procedure</enum>
         <enum value="guide" short-label="Guidance">Guidance Document</enum>
         <enum value="rules-of-behavior" short-label="ROB">Rules of Behavior</enum>
         <enum value="plan" short-label="Plan">Plan</enum>
         <enum value="system-security-plan" short-label="SSP">System Security Plan</enum>
         <enum value="artifact" short-label="artifact">Artifact</enum>
         <enum value="evidence" short-label="evidence">Evidence</enum>
         <enum value="screen-shot" short-label="screen">Screen Shot</enum>
         <enum value="image" short-label="image">Image</enum>
         <enum value="tool-report" short-label="Report">Tool Report</enum>
         <enum value="raw-tool-output" short-label="Raw">Raw Tool Output</enum>
         <enum value="interview-notes" short-label="Notes">Interview Notes</enum>
         <enum value="questionnaire" short-label="Questions">Questions</enum>
         <enum value="report" short-label="Report">Report</enum>
         <enum value="fedramp-citations" short-label="FR Citations">FedRAMP Citations</enum>
         <enum value="fedramp-acronyms" short-label="FR Acronyms">FedRAMP Acronyms</enum>
         <enum value="fedramp-logo" short-label="FR Logo">FedRAMP Logo</enum>
         <enum value="separation-of-duties-matrix" short-label="SoD Matrix">Separation of Duties Matrix</enum>
         <enum value="logo" short-label="Logo">Logo</enum>
         <!-- See, e.g., https://www.dol.gov/general/ppii#:~:text=Personal%20Identifiable%20Information%20(PII)%20is,either%20direct%20or%20indirect%20means. -->
         <!-- All the privacy "types" need rationalization -->
         <enum value="personal-identifiable-information" short-label="PII">Personal Identifiable Information (PII)</enum>
         <enum value="agreement" short-label="Agreement">Agreement</enum>
         <enum value="isa-agreement" short-label="Agreement">Interconnection Security Agreement</enum>
         <enum value="incident-response-plan" short-label="IRP">Incident Response Plan</enum>
         <enum value="information-security-policies-and-procedures" short-label="ISPP">Incident Security Policies and Procedures</enum>
         <enum value="users-guide" short-label="User Guide">User Guide</enum>
         <enum value="privacy-impact-analysis" short-label="PIA">Privacy Impact Assessment</enum>
         <enum value="information-system-contingency-plan" short-label="ISCP">Information System Contingency Plan</enum>
         <enum value="configuration-management-plan" short-label="CMP">configuration-management-plan</enum>
      </allowed-values>
      <remarks>
         <p>These are in addition to the NIST-defined allowed values for resource types.</p>
      </remarks>
   </constraint>

   <constraint name="media-type">
      <formal-name>Attachment/Resource Media Types</formal-name>
      <description>IANA media-types supported by FedRAMP as attachment/resource types.</description>
      <binding pattern="o:rlink/@media-type"/>
      <binding pattern="o:base64/@media-type"/>
      <allowed-values>
         <enum value="application/gzip">application/gzip</enum>
         <enum value="application/msword">application/msword</enum>
         <enum value="application/octet-stream">application/octet-stream<!-- (NOTE: Used for a variety of binary formats, often ZIP archives.) --></enum>
         <enum value="application/pdf">application/pdf</enum>
         <enum value="application/vnd.ms-excel">application/vnd.ms-excel</enum>
         <enum value="application/vnd.ms-works">application/vnd.ms-works</enum>
         <enum value="application/vnd.oasis.opendocument.graphics">application/vnd.oasis.opendocument.graphics</enum>
         <enum value="application/vnd.oasis.opendocument.presentation">application/vnd.oasis.opendocument.presentation</enum>
         <enum value="application/vnd.oasis.opendocument.spreadsheet">application/vnd.oasis.opendocument.spreadsheet</enum>
         <enum value="application/vnd.oasis.opendocument.text">application/vnd.oasis.opendocument.text</enum>
         <enum value="application/vnd.openxmlformats-officedocument.presentationml.presentation">application/vnd.openxmlformats-officedocument.presentationml.presentation</enum>
         <enum value="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet">application/vnd.openxmlformats-officedocument.spreadsheetml.sheet</enum>
         <enum value="application/vnd.openxmlformats-officedocument.wordprocessingml.document">application/vnd.openxmlformats-officedocument.wordprocessingml.document</enum>
         <enum value="application/x-bzip">application/x-bzip</enum>
         <enum value="application/x-bzip2">application/x-bzip2</enum>
         <enum value="application/x-tar">application/x-tar</enum>
         <enum value="application/zip">application/zip</enum>
         <enum value="image/bmp">image/bmp</enum>
         <enum value="image/jpeg">image/jpeg<!-- (NOTE: Not standard, but very frequently used)--></enum>
         <enum value="image/png">image/png</enum>
         <enum value="image/tiff">image/tiff</enum>
         <enum value="image/webp">image/webp</enum>
         <enum value="image/svg+xml">image/svg+xml</enum>
         <enum value="text/csv">text/csv</enum>
         <enum value="text/html">text/html</enum>
         <enum value="text/plain">text/plain</enum>
      </allowed-values>
      <remarks>
         <p>These are in addition to the NIST-defined allowed values for resource types.</p>
      </remarks>
   </constraint>

   <constraint name="system-identifier-type">
      <formal-name>System Identifier Type</formal-name>
      <description>Enables an identifier to be formally recognized as being assigned by FedRAMP.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:system-id/@identifier-type"/>
      <allowed-values allow-other="yes">
         <enum value="https://fedramp.gov" label="FedRAMP ID">FedRAMP-Assigned Identifier</enum>
         <enum value="https://ietf.org/rfc/rfc4122" short-label="UUIDv4">RFC-4122 UUIDv4 Value</enum>
      </allowed-values>
   </constraint>

   <constraint name="information-type-system">
      <formal-name>Information Type System</formal-name>
      <description>Identifies the system from which the information type was defined.</description>
      <binding pattern="/o:system-security-plan/o:system-characteristics/o:system-information/o:information-type/o:information-type-id/@system"/>
      <allowed-values allow-other="no">
         <enum value="https://doi.org/10.6028/NIST.SP.800-60v2r1" label="SP 800-60 V2R1">NIST SP 800-60, Volume 2, Revision 1</enum>
      </allowed-values>
      <remarks>
         <p>FedRAMP only allows information types defined in NIST SP 800-60v2r1.</p>
      </remarks>
   </constraint>

   <constraint name="security-level">
      <formal-name>Security Impact Level</formal-name>
      <description>The security objective level as defined by NIST SP 800-60.</description>
      <binding pattern="security-sensitivity-level"/>
      <binding pattern="security-impact-level"/>
      <binding pattern="(security-objective-confidentiality|security-objective-integrity|security-objective-availability)"/>
      <binding pattern="system-information/information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)"/>
      <allowed-values allow-other="no">
         <enum value="fips-199-low" label="L">Low</enum>
         <enum value="fips-199-moderate" label="M">Moderate</enum>
         <enum value="fips-199-high" label="H">High</enum>
      </allowed-values>
   </constraint>

   <constraint name="operational-status">
      <formal-name>Operational Status (system)</formal-name>
      <description>The operational status of the system</description>
      <binding pattern="o:status/@state"/>
      <allowed-values allow-other="no">
         <enum value="operational" short-label="Operational">Operational</enum>
         <enum value="under-development" short-label="Development">Under Development</enum>
         <enum value="under-major-modification" short-label="Major Mod.">Major Modification</enum>
         <enum value="disposition" short-label="Alternative">Alternative Implementation</enum>
         <enum value="other" short-label="Other">Other</enum>
      </allowed-values>
      <remarks>
         <p>FedRAMP limits the allowed values from a larger NIST-defined list to only those defined here.</p>
      </remarks>
   </constraint>

   <back-matter>
      <resource uuid="871713A8-5A27-4AC3-8B94-972588469C6B">
         <title>OPM Position Designation</title>
         <prop name="type"/>
         <prop name="published">2017-09-01T00:00:00Z</prop>
         <rlink media-type="application/pdf" href="https://www.opm.gov/suitability/suitability-executive-agent/position-designation-tool/position-designation-system-with-glossary-2017.pdf"/>
      </resource>
   </back-matter>

</extensions>