diff --git a/docs/content/concepts/processing/profile-resolution.html b/docs/content/concepts/processing/profile-resolution.html index f75aef527a..324530c213 100644 --- a/docs/content/concepts/processing/profile-resolution.html +++ b/docs/content/concepts/processing/profile-resolution.html @@ -1,18 +1,18 @@ --- -title: OSCAL Profile Resolution -description: Transforming a profile into the tailored catalog it represents +title: OSCAL Profile Resolution Specification Draft +description: Working draft of the profile resolution specification. toc: enabled: true headingselectors: "h1, h2, h3, h4, h5" --- -

Notice of Draft Status

Please note that this specification is currently a work in progress and is subject to change. If you have any feedback or comments, please create an issue at the NIST OSCAL Github Repository: github.com/usnistgov/OSCAL.

Abstract

This specification provides the minimal requirements for processing an OSCAL Profile to create a new OSCAL Catalog Document. This process of applying a profile to a catalog to create a new catalog is called +

Notice of Draft Status

Please note that this specification is currently a work in progress and is subject to change. If you have any feedback or comments, please create an issue at the NIST OSCAL Github Repository: github.com/usnistgov/OSCAL.

Abstract

This specification provides the minimal requirements for processing an OSCAL Profile to create a new OSCAL Catalog Document. This process of applying a profile to a catalog to create a new catalog is called Profile Resolution. Not all OSCAL Profiles will be resolved, nor are expected to be; however, the resolution requirements in this document are crucial to understanding the intended functionality of any given OSCAL Profile. This specification is intended for software developers who intend to develop an OSCAL Profile Resolver, or for OSCAL Profile authors who want a more in-depth understanding of profile resolution. -

Introduction

Purpose

This document defines the normative requirements for an OSCAL Profile Resolver. Profile resolution is core to addressing a fundamental OSCAL requirement: - the representation of baselines separately from the control catalogs on which they depend). The requirements for resolution must therefore be well-defined and deterministic, - enabling tool developers and parties exchanging OSCAL Profiles can work from a common understanding.

No requirements are placed on implementation-level details, instead, requirements are laid out as what the output of resolution must look like given a certain input. +

Introduction

Purpose

+ Information systems are implemented against a baseline of security controls. An OSCAL Profile defines the selection and potential alterations to a control catalog that are needed to establish a baseline. However, the OSCAL implementation layer depends on having an OSCAL Catalog that represents the baseline of controls to be implemented. Profile Resolution allows for computing an effective catalog based on an OSCAL Profile. For a given OSCAL Profile, the Profile Resolution process needs to result in the same OSCAL Catalog when executed by different tools on different endpoints. The requirements for resolution must therefore be well-defined and deterministic, enabling tool developers and parties exchanging OSCAL Profiles to work from a common understanding. This document defines the normative requirements for an OSCAL Profile Resolver. +

No requirements are placed on implementation-level details, instead, requirements are laid out as what the output of resolution must look like given a certain input. By adhering to these requirements OSCAL producers, OSCAL consumers, and any other members of the OSCAL ecosystem can create and resolve profiles deterministically, - with repeatable results, regardless of the tool used.

Reading This Document

Terminology

Many core OSCAL concepts are defined on the OSCAL Terminology Page. The most important are repeated in this document, but readers should verify their understanding of all core OSCAL terms before reading this document.

Additionally, many terms in the wider domain have overloaded definitions. Unless defined otherwise by OSCAL or explicitly in this document, terms are to be understood as defined in the NIST CSRC Glossary.

Requirement Keywords

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174]when, and only when, they appear in all capitals, as shown here. -

Use of YAML

OSCAL supports a variety of serialization formats, each of which having it's own benefits and drawbacks. In this document, YAML (YAML Ain't Markup Language) is used to represent the various objects of the +

Use of YAML

OSCAL supports a variety of serialization formats, each of which having it's own benefits and drawbacks. In this document, YAML (YAML Ain't Markup Language) is used to represent the various objects of the sourceand target. All examples and in-line references will be represented using YAML 1.2.

YAML maps cleanly to JSON, thus allowing easy use of existing JSON/XML transformers where needed. With that in mind, the OSCAL Complete JSON Referenceis a valuable resource for understanding the YAML-based information structures used in this document. All JSON properties and objects defined in the reference equate to a YAML mapping, list, or dictionary. -

Reading YAML Examples

YAML is a particularly human-readable format. For those unfamiliar with the format, the basics:

In the case that a control selection matches none of the included controls, it MUST be ignored. In the case that a control selection matches none of the included controls, a warning SHOULD be provided. If a control that was included by the Import Phase is never selected, no error occurs. That control simply does not appear in the output catalog.

Wrapping up the Merge Phase

After the merge phase, the intermediate should now closely resemble the content and structure of the final output catalog. Controls and groups have been included, remapped, de-duplicated, then placed into their final location within the output's structure. Note: there is still an opportunity for included controls or groups to become referenced; and therefore, not eligible for pruning + [See: Pruning and Ordering]in the next phase. +

Regardless of any merge directives, there also likely remains "loose params" that have been propagated forward; these too must be persisted.

Modify Phase

There are two ways profiles may further modify the results of profile resolution: setting parameters and altering controls. These activities are defined as two child objects inside the third step of profile resolution, the Modify Phase.

The following section contains requirements for processing the modify child of a source profile. -

Setting Parameters

Modification of parameter settings is indicated using the +

Setting Parameters

Modification of parameter settings is indicated using the set-parameter object under modify. For this section, a given set-parameter object will be referred to as the source. -

Profile Resolution Tools MUST adhere to the following requirements for processing "set-parameter":

Altering controls

A control can be altered by an alterobject inside "modify". The control-idchild object under the alterindicates the control to which the alteration is applied. -

Adding contents to controls

Contents may be added to controls using an add directive inside an alter directive. There are two forms of alteration: with implicit and explicit bindings.

Implicit binding

An +

Adding contents to controls

Contents may be added to controls using an add directive inside an alter directive. There are two forms of alteration: with implicit and explicit bindings.

Implicit binding

An add directive with no by-id child MUST be considered an implicit binding, and will apply to the control as a whole.

The contents of an implicitly bound add directive MUST be added to the control contents in the target, either after its @@ -720,7 +717,7 @@

Notice of Draft Statusendingso the new propappears after the existing prop. -

Explicit binding

An explicit binding on an addition permits inserting new contents anywhere in a control, not only at the top level. An +

Explicit binding

An explicit binding on an addition permits inserting new contents anywhere in a control, not only at the top level. An add directive with a by-id child MUST be considered an explicit binding, and applies to only a single object inside the control. When an add directive is explicitly bound, the value of the by-id child MUST correspond to the value of an @@ -809,22 +806,23 @@

Notice of Draft Statusadddirectives, to insert the new propseparately before any partobjects in the target. -

Modifying controls inside controls +

Modifying controls inside controls

OSCAL supports controls inside controls in the form of control objects inside control objects. Because the semantics of the - add and remove directives target any (object) contents of controls, they can be used to target these child controls for modification as well as other contents. Profile resolution tools MUST be able to correctly handle add directives targetting nested controls. This includes directives that target a child control as well as directives that target a parent control and modify the child.

Removing contents from controls

Contents inside controls can be removed from them in catalog targets. In combination with adding new contents, this feature can be used to edit controls as well as amend them.

A + add and remove directives target any (object) contents of controls, they can be used to target these child controls for modification as well as other contents. Profile resolution tools MUST be able to correctly handle add directives targetting nested controls. This includes directives that target a child control as well as directives that target a parent control and modify the child.

Removing contents from controls

Contents inside controls can be removed from them in catalog targets. In combination with adding new contents, this feature can be used to edit controls as well as amend them.

A removedirective inside an alter directive identifies an object or set of objects inside a control to be removed. It does this using any of five child objects.

An object inside the control MUST be removed from the output if and only if it meets all of the criteria given by the child objects of the remove directive. When more than one child appears under the remove directive, an object would need to match all of them, otherwise it is not removed.

Final Operations

Backmatter Resolution

+ The remove directive criterion by-name MUST match an object if and only if its value is identical to the value of that object's name child. +

  • The remove directive criterion by-ns MUST match an object if and only if its value is identical to the value of that object's ns child. This directive + is intended to be used in combination with by-name but may also be used to match all objects assigned to a given namespace (ns). Note that by-ns="http://csrc.nist.gov/ns/oscal" will address objects assigned to that namespace by default (where no explicit ns is given).

  • The remove directive criterion by-class MUST match an object if and only if its value is identical to the value of that object's class child.

  • The remove directive criterion by-item-name MUST match an object if and only if its value is identical to the value of that object's serialized name. For example, + remove.by-item-name: "prop" has the effect of removing all + prop objects from inside the control. +

    In serialization formats that represent objects as (unlabeled) members of arrays, an object's name MUST be referenced in its (implicit) singular form, not the name of its containing array. For example, in the JSON format, remove.item-name: "link" would remove all members of the links array, along with the array itself (as being empty it would no longer be valid).

    • Final Operations

    Backmatter Resolution

    back-matter in the result is produced by combining all objects within back-matter in all source catalogs, with the back-matter in the input profile. @@ -832,37 +830,37 @@

    Notice of Draft Statusresource has the same uuid as a resource that has already been added, the previous resource MUST be removed, and the more recent one added, unless superseded by other requirements.

  • A resource with a child prop of name:keep and value:always MUST NOT be replaced by the addition of another resource, unless the new resource also has a child prop of name:keep and value:always.

    • Tools MAY check for pruning conditions - [See: Pruning and Ordering] as resources are added as long as the final result is the same as if the pruning had taken place at the end of all resource addition. -

    Placing the keep always prop on a resource in a catalog has the effect of ensuring it will always appear in the output produced by any profile importing that catalog, even if nothing links to the resource. This version of the resource will also be the one copied, unless a later-imported catalog or importing profile offers its own version marked to keep always.

    Metadata Resolution

    The following requirements MUST be followed with regards to the Metadata section of the output catalog:

    Beyond these requirements, tools are free to use any and all of the objects inside metadata to provide additional information downstream.

    Because of options in producing metadata and especially the requirement for a timestamp, developers and users should note that two different resolutions of the same profile will not, ordinarily, be identical inside + [See: Pruning and Ordering] as resources are added as long as the final result is the same as if the pruning had taken place at the end of all resource addition. +

    Placing the keep always prop on a resource in a catalog has the effect of ensuring it will always appear in the output produced by any profile importing that catalog, even if nothing links to the resource. This version of the resource will also be the one copied, unless a later-imported catalog or importing profile offers its own version marked to keep always.

    Metadata Resolution

    The following requirements MUST be followed with regards to the Metadata section of the output catalog:

    Beyond these requirements, tools are free to use any and all of the objects inside metadata to provide additional information downstream.

    Because of options in producing metadata and especially the requirement for a timestamp, developers and users should note that two different resolutions of the same profile will not, ordinarily, be identical inside metadata. -

    Pruning and Ordering

    The processor SHOULD prune the resulting output catalog by removing unused objects.

    -
    -

    allowed value for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name

    -

    The value must be one of the following:

    - -
    -

    allowed values for responsible-role/@role-id

    The value may be locally defined, or one of the following:

    @@ -8928,7 +8918,7 @@ The following is a reference for the JSON object definitions derived from this m

    See definition

    -
    +

    include-controls

    assembly

    @@ -8937,24 +8927,76 @@ The following is a reference for the JSON object definitions derived from this m

    Select Control

    -

    use name include-controls

    -

    group as include-controls

    +

    description Select a control or controls from an imported control set.

    Remarks
    -

    If with-child-controls is yes on the call to a control, no sibling callelements need to be used to call any controls appearing within it. Since generally, - this is how control enhancements are represented (as controls within controls), this - provides a way to include controls with all their dependent controls (enhancements) - without having to call them individually.

    -
    -
    -

    Identifies a subset of controls to import from the referenced catalog or profile by - control identifier or match pattern.

    +

    If with-child-controls is yes on the call to a control, any controls appearing within it (child controls) will + be selected, with no additional call directives required. This flag provides a way to include controls with all their + dependent controls (enhancements) without having to call them individually.

    +

    If with-parent-controls is "yes" on the call to a control, it will not be selected + and removed from (shown without) a parent control, but instead will be copied with + its parent in the source. This flag provides a way to include controls with all their + ancestor controls (enhancements) without having to call them individually.

    -

    See definition

    +
    + Properties (4) +
    +
    +
    +

    with-child-controls

    +

    token

    +

    [0 or 1]

    +
    Switch to XML
    +

    Include Contained Controls with Control

    +
    +
    +

    See definition

    +
    +
    +
    +
    +

    with-parent-controls

    +

    token

    +

    [0 or 1]

    +
    Switch to XML
    +

    Include Parent Controls with Control

    +
    +
    +

    See definition

    +
    +
    +
    +
    +

    with-id

    +

    token

    +

    [0 to ∞]

    +
    Switch to XML
    +

    Match Controls by Identifier

    +
    +
    +

    group as with-ids

    +

    See definition

    +
    +
    +
    +
    +

    matching

    +

    assembly

    +

    [0 to ∞]

    +
    Switch to XML
    +

    Match Controls by Pattern

    +
    +
    +

    group as matching

    +

    See definition

    +
    +
    +
    +
    @@ -11327,6 +11369,34 @@ The following is a reference for the JSON object definitions derived from this m
    +
    +
    +

    matching

    +

    assembly

    +
    Switch to XML
    +

    Match Controls by Pattern

    +
    +
    +

    description Selecting a set of controls by matching their IDs with a wildcard pattern.

    +
    + Property (1) +
    +
    +
    +

    pattern

    +

    string

    +

    [0 or 1]

    +
    Switch to XML
    +

    Pattern

    +
    +
    +

    See definition

    +
    +
    +
    +
    +
    +

    media-type

    @@ -19329,7 +19399,7 @@ The following is a reference for the JSON object definitions derived from this m

    See definition

    -
    +

    with-id

    token

    @@ -19338,11 +19408,11 @@ The following is a reference for the JSON object definitions derived from this m

    Match Controls by Identifier

    -

    description Selecting a control by its ID given as a literal.

    group as with-ids

    +

    See definition

    -
    +

    matching

    assembly

    @@ -19351,25 +19421,8 @@ The following is a reference for the JSON object definitions derived from this m

    Match Controls by Pattern

    -

    description Selecting a set of controls by matching their IDs with a wildcard pattern.

    group as matching

    -
    - Property (1) -
    -
    -
    -

    pattern

    -

    string

    -

    [0 or 1]

    -
    Switch to XML
    -

    Pattern

    -
    -
    -

    See definition

    -
    -
    -
    -
    +

    See definition

    @@ -23453,4 +23506,41 @@ The following is a reference for the JSON object definitions derived from this m
    +
    +
    +

    with-id

    +

    token

    +
    Switch to XML
    +

    Match Controls by Identifier

    +
    +
    +

    description Selecting a control by its ID given as a literal.

    +
    +
    +
    +
    +

    with-parent-controls

    +

    token

    +
    Switch to XML
    +

    Include Parent Controls with Control

    +
    +
    +

    description When a control is included, whether its parent (ancestor) controls are also included.

    +
    + Constraint (1) + +
    +

    allowed values

    +

    The value must be one of the following:

    +
      + +
    • yes: Include parent controls with an included control.
      • + +
    • no: When importing a control, only include parent controls that are also explicitly + called.
      • +
    +
    +
    +
    +
    {{< /rawhtml >}} diff --git a/docs/content/reference/develop/complete/json-index.md b/docs/content/reference/develop/complete/json-index.md index a2b640b438..d059bb4261 100644 --- a/docs/content/reference/develop/complete/json-index.md +++ b/docs/content/reference/develop/complete/json-index.md @@ -10,7 +10,7 @@ toc: headingselectors: "h1.toc1" --- -The following is an index of each JSON property used in the [JSON format](https://github.com/usnistgov/OSCAL/blob/develop/json/schema/oscal_complete_schema.json), which represents the combination of all OSCAL models. Each entry in the index lists all uses of the given property in the format, which is linked to the corresponding entry in the [JSON Format Reference](../json-reference/). Each entry also lists the formal name for the definition which is linked to the corresponding JSON definition in the [JSON Format Metaschema Reference](../json-definitions/). +The following is an index of each JSON property used in the [JSON format](https://github.com/usnistgov/OSCAL/blob/1703-date-regex-not-updated-to-fixed-v104-version-in-json-schema-or-in-main-branch/json/schema/oscal_complete_schema.json), which represents the combination of all OSCAL models. Each entry in the index lists all uses of the given property in the format, which is linked to the corresponding entry in the [JSON Format Reference](../json-reference/). Each entry also lists the formal name for the definition which is linked to the corresponding JSON definition in the [JSON Format Metaschema Reference](../json-definitions/). {{< rawhtml >}} @@ -3272,7 +3272,7 @@ The following is an index of each JSON property used in the [JSON format](https:

    matching

    -
    -

    allowed value for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name

    -

    The value must be one of the following:

    - -

    allowed values for responsible-role/@role-id

    The value may be locally defined, or one of the following:

    diff --git a/json/convert/oscal_assessment-plan_xml-to-json-converter.xsl b/json/convert/oscal_assessment-plan_xml-to-json-converter.xsl index 4f0569809f..d6414877b8 100644 --- a/json/convert/oscal_assessment-plan_xml-to-json-converter.xsl +++ b/json/convert/oscal_assessment-plan_xml-to-json-converter.xsl @@ -5268,14 +5268,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_assessment-results_xml-to-json-converter.xsl b/json/convert/oscal_assessment-results_xml-to-json-converter.xsl index 94478f65bc..7f9bc3a1e8 100644 --- a/json/convert/oscal_assessment-results_xml-to-json-converter.xsl +++ b/json/convert/oscal_assessment-results_xml-to-json-converter.xsl @@ -9395,14 +9395,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_catalog_xml-to-json-converter.xsl b/json/convert/oscal_catalog_xml-to-json-converter.xsl index d97f6df8eb..993b94f5be 100644 --- a/json/convert/oscal_catalog_xml-to-json-converter.xsl +++ b/json/convert/oscal_catalog_xml-to-json-converter.xsl @@ -3425,14 +3425,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_complete_xml-to-json-converter.xsl b/json/convert/oscal_complete_xml-to-json-converter.xsl index 74ba5fe24d..8730b0bccd 100644 --- a/json/convert/oscal_complete_xml-to-json-converter.xsl +++ b/json/convert/oscal_complete_xml-to-json-converter.xsl @@ -30470,14 +30470,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_component_xml-to-json-converter.xsl b/json/convert/oscal_component_xml-to-json-converter.xsl index 5d083aceb1..b00b9c4a2c 100644 --- a/json/convert/oscal_component_xml-to-json-converter.xsl +++ b/json/convert/oscal_component_xml-to-json-converter.xsl @@ -3095,14 +3095,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_mapping_xml-to-json-converter.xsl b/json/convert/oscal_mapping_xml-to-json-converter.xsl index c4984b5c10..75fad7d7d6 100644 --- a/json/convert/oscal_mapping_xml-to-json-converter.xsl +++ b/json/convert/oscal_mapping_xml-to-json-converter.xsl @@ -2274,14 +2274,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_poam_xml-to-json-converter.xsl b/json/convert/oscal_poam_xml-to-json-converter.xsl index a87dfe8521..855d0ed99d 100644 --- a/json/convert/oscal_poam_xml-to-json-converter.xsl +++ b/json/convert/oscal_poam_xml-to-json-converter.xsl @@ -6946,14 +6946,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_profile_xml-to-json-converter.xsl b/json/convert/oscal_profile_xml-to-json-converter.xsl index 2b6ed68a22..0840ae2e84 100644 --- a/json/convert/oscal_profile_xml-to-json-converter.xsl +++ b/json/convert/oscal_profile_xml-to-json-converter.xsl @@ -3373,14 +3373,12 @@ - - - - - - - - + + + + + + diff --git a/json/convert/oscal_ssp_xml-to-json-converter.xsl b/json/convert/oscal_ssp_xml-to-json-converter.xsl index 10273d9812..c058227178 100644 --- a/json/convert/oscal_ssp_xml-to-json-converter.xsl +++ b/json/convert/oscal_ssp_xml-to-json-converter.xsl @@ -5564,14 +5564,12 @@ - - - - - - - - + + + + + + diff --git a/json/schema/oscal_assessment-plan_schema.json b/json/schema/oscal_assessment-plan_schema.json index 95218836b2..d121cc8ec8 100644 --- a/json/schema/oscal_assessment-plan_schema.json +++ b/json/schema/oscal_assessment-plan_schema.json @@ -283,9 +283,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -462,7 +467,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -521,7 +526,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -651,9 +661,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -697,9 +719,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -712,7 +741,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -749,9 +784,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, @@ -934,7 +974,13 @@ "type" : { "title" : "Task Type", "description" : "The type of task.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "milestone", + "action" ] } ] }, "title" : { "title" : "Task Title", "description" : "The title for this task.", @@ -1278,7 +1324,16 @@ { "type" : { "title" : "Subject Type", "description" : "Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user" ] } ] }, "description" : { "title" : "Include Subjects Description", "description" : "A human-readable description of the collection of subjects being included in this assessment.", @@ -1323,7 +1378,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "props" : { "type" : "array", "minItems" : 1, @@ -1353,7 +1418,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "title" : { "title" : "Subject Reference Title", "description" : "The title or name for the referenced subject.", @@ -1507,7 +1582,14 @@ "reason" : { "title" : "Objective Status Reason", "description" : "The reason the objective was given it's status.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "pass", + "fail", + "other" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -1633,14 +1715,31 @@ "items" : { "title" : "Observation Method", "description" : "Identifies how the observation was made.", - "$ref" : "#/definitions/StringDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "EXAMINE", + "INTERVIEW", + "TEST", + "UNKNOWN" ] } ] } }, "types" : { "type" : "array", "minItems" : 1, "items" : { "title" : "Observation Type", "description" : "Identifies the nature of the observation. More than one may be used to further qualify and enable filtering.", - "$ref" : "#/definitions/TokenDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "ssp-statement-issue", + "control-objective", + "mitigation", + "finding", + "historic" ] } ] } }, "origins" : { "type" : "array", "minItems" : 1, @@ -1818,13 +1917,19 @@ { "system" : { "title" : "Threat Type Identification System", "description" : "Specifies the source of the threat information.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal" ] } ] }, "href" : { "title" : "Threat Information Resource Reference", "description" : "An optional location for the threat data, from which this ID originates.", "$ref" : "#/definitions/URIReferenceDatatype" }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/URIDatatype" } }, "required" : [ "id", "system" ], @@ -2060,7 +2165,17 @@ { "title" : "Risk Status", "description" : "Describes the status of the associated risk.", "$id" : "#field_oscal-assessment-common_risk-status", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "open", + "investigating", + "remediating", + "deviation-requested", + "deviation-approved", + "closed" ] } ] }, "oscal-ap-oscal-assessment-common:characterization" : { "title" : "Characterization", "description" : "A collection of descriptive data about the containing object from a specific origin.", @@ -2094,7 +2209,19 @@ "system" : { "title" : "Naming System", "description" : "Specifies the naming system under which this risk metric is organized, which allows for the same names to be used in different systems controlled by different parties. This avoids the potential of a name clash.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal/unknown", + "http://cve.mitre.org", + "http://www.first.org/cvss/v2.0", + "http://www.first.org/cvss/v3.0", + "http://www.first.org/cvss/v3.1" ] } ] }, "value" : { "title" : "Facet Value", "description" : "Indicates the value of the facet.", @@ -2133,7 +2260,14 @@ "lifecycle" : { "title" : "Remediation Intent", "description" : "Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "recommendation", + "planned", + "completed" ] } ] }, "title" : { "title" : "Response Title", "description" : "The title for this response activity.", @@ -2224,7 +2358,14 @@ "name" : { "title" : "Part Name", "description" : "A textual label that uniquely identifies the part's semantic type.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "asset", + "method", + "objective" ] } ] }, "ns" : { "title" : "Part Namespace", "description" : "A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.", @@ -2454,7 +2595,25 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "this-system", + "system", + "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation", + "network" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the system component.", @@ -2578,7 +2737,16 @@ { "state" : { "title" : "Implementation State", "description" : "Identifies the implementation status of the control or control objective.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "implemented", + "partial", + "planned", + "alternative", + "not-applicable" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -2758,9 +2926,17 @@ { "identifier-type" : { "title" : "Identification System Type", "description" : "Identifies the identification system from which the provided identifier was assigned.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "https://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "https://ietf.org/rfc/rfc4122", + "http://ietf.org/rfc/rfc4122" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id" ], "additionalProperties" : false }, diff --git a/json/schema/oscal_assessment-results_schema.json b/json/schema/oscal_assessment-results_schema.json index 4e42d5e9cb..25c3409831 100644 --- a/json/schema/oscal_assessment-results_schema.json +++ b/json/schema/oscal_assessment-results_schema.json @@ -436,9 +436,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -615,7 +620,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -674,7 +679,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -804,9 +814,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -850,9 +872,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -865,7 +894,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -902,9 +937,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, @@ -1087,7 +1127,13 @@ "type" : { "title" : "Task Type", "description" : "The type of task.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "milestone", + "action" ] } ] }, "title" : { "title" : "Task Title", "description" : "The title for this task.", @@ -1431,7 +1477,16 @@ { "type" : { "title" : "Subject Type", "description" : "Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user" ] } ] }, "description" : { "title" : "Include Subjects Description", "description" : "A human-readable description of the collection of subjects being included in this assessment.", @@ -1476,7 +1531,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "props" : { "type" : "array", "minItems" : 1, @@ -1506,7 +1571,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "title" : { "title" : "Subject Reference Title", "description" : "The title or name for the referenced subject.", @@ -1660,7 +1735,14 @@ "reason" : { "title" : "Objective Status Reason", "description" : "The reason the objective was given it's status.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "pass", + "fail", + "other" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -1786,14 +1868,31 @@ "items" : { "title" : "Observation Method", "description" : "Identifies how the observation was made.", - "$ref" : "#/definitions/StringDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "EXAMINE", + "INTERVIEW", + "TEST", + "UNKNOWN" ] } ] } }, "types" : { "type" : "array", "minItems" : 1, "items" : { "title" : "Observation Type", "description" : "Identifies the nature of the observation. More than one may be used to further qualify and enable filtering.", - "$ref" : "#/definitions/TokenDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "ssp-statement-issue", + "control-objective", + "mitigation", + "finding", + "historic" ] } ] } }, "origins" : { "type" : "array", "minItems" : 1, @@ -1971,13 +2070,19 @@ { "system" : { "title" : "Threat Type Identification System", "description" : "Specifies the source of the threat information.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal" ] } ] }, "href" : { "title" : "Threat Information Resource Reference", "description" : "An optional location for the threat data, from which this ID originates.", "$ref" : "#/definitions/URIReferenceDatatype" }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/URIDatatype" } }, "required" : [ "id", "system" ], @@ -2213,7 +2318,17 @@ { "title" : "Risk Status", "description" : "Describes the status of the associated risk.", "$id" : "#field_oscal-assessment-common_risk-status", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "open", + "investigating", + "remediating", + "deviation-requested", + "deviation-approved", + "closed" ] } ] }, "oscal-ar-oscal-assessment-common:characterization" : { "title" : "Characterization", "description" : "A collection of descriptive data about the containing object from a specific origin.", @@ -2247,7 +2362,19 @@ "system" : { "title" : "Naming System", "description" : "Specifies the naming system under which this risk metric is organized, which allows for the same names to be used in different systems controlled by different parties. This avoids the potential of a name clash.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal/unknown", + "http://cve.mitre.org", + "http://www.first.org/cvss/v2.0", + "http://www.first.org/cvss/v3.0", + "http://www.first.org/cvss/v3.1" ] } ] }, "value" : { "title" : "Facet Value", "description" : "Indicates the value of the facet.", @@ -2286,7 +2413,14 @@ "lifecycle" : { "title" : "Remediation Intent", "description" : "Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "recommendation", + "planned", + "completed" ] } ] }, "title" : { "title" : "Response Title", "description" : "The title for this response activity.", @@ -2377,7 +2511,14 @@ "name" : { "title" : "Part Name", "description" : "A textual label that uniquely identifies the part's semantic type.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "asset", + "method", + "objective" ] } ] }, "ns" : { "title" : "Part Namespace", "description" : "A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.", @@ -2607,7 +2748,25 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "this-system", + "system", + "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation", + "network" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the system component.", @@ -2731,7 +2890,16 @@ { "state" : { "title" : "Implementation State", "description" : "Identifies the implementation status of the control or control objective.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "implemented", + "partial", + "planned", + "alternative", + "not-applicable" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -2911,9 +3079,17 @@ { "identifier-type" : { "title" : "Identification System Type", "description" : "Identifies the identification system from which the provided identifier was assigned.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "https://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "https://ietf.org/rfc/rfc4122", + "http://ietf.org/rfc/rfc4122" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id" ], "additionalProperties" : false }, diff --git a/json/schema/oscal_catalog_schema.json b/json/schema/oscal_catalog_schema.json index b3c4b6d914..8b20a9aa59 100644 --- a/json/schema/oscal_catalog_schema.json +++ b/json/schema/oscal_catalog_schema.json @@ -537,9 +537,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -716,7 +721,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -775,7 +780,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -905,9 +915,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -951,9 +973,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -966,7 +995,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -1003,9 +1038,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, @@ -1039,16 +1079,10 @@ "description" : "A namespace qualifying the relationship's value. This allows different organizations to associate distinct semantics for relationships with the same name.", "$ref" : "#/definitions/URIDatatype" }, "type" : - { "type" : "string" } }, + { "$ref" : "#/definitions/TokenDatatype" } }, "required" : [ "type" ], - "additionalProperties" : false, - "enum" : - [ "equivalent-to", - "equal-to", - "subset-of", - "superset-of", - "intersects-with" ] }, + "additionalProperties" : false }, "sources" : { "type" : "array", "minItems" : 1, diff --git a/json/schema/oscal_complete_schema.json b/json/schema/oscal_complete_schema.json index 84bccaa249..e8b27e8bec 100644 --- a/json/schema/oscal_complete_schema.json +++ b/json/schema/oscal_complete_schema.json @@ -537,9 +537,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -716,7 +721,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -775,7 +780,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -905,9 +915,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -951,9 +973,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -966,7 +995,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -1003,9 +1038,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, @@ -1039,16 +1079,10 @@ "description" : "A namespace qualifying the relationship's value. This allows different organizations to associate distinct semantics for relationships with the same name.", "$ref" : "#/definitions/URIDatatype" }, "type" : - { "type" : "string" } }, + { "$ref" : "#/definitions/TokenDatatype" } }, "required" : [ "type" ], - "additionalProperties" : false, - "enum" : - [ "equivalent-to", - "equal-to", - "subset-of", - "superset-of", - "intersects-with" ] }, + "additionalProperties" : false }, "sources" : { "type" : "array", "minItems" : 1, @@ -1716,7 +1750,22 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the component.", @@ -1972,7 +2021,25 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "this-system", + "system", + "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation", + "network" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the system component.", @@ -2096,7 +2163,16 @@ { "state" : { "title" : "Implementation State", "description" : "Identifies the implementation status of the control or control objective.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "implemented", + "partial", + "planned", + "alternative", + "not-applicable" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -2276,9 +2352,17 @@ { "identifier-type" : { "title" : "Identification System Type", "description" : "Identifies the identification system from which the provided identifier was assigned.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "https://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "https://ietf.org/rfc/rfc4122", + "http://ietf.org/rfc/rfc4122" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id" ], "additionalProperties" : false }, @@ -2442,7 +2526,12 @@ { "system" : { "title" : "Information Type Identification System", "description" : "Specifies the information type identification system used.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://doi.org/10.6028/NIST.SP.800-60v2r1" ] } ] }, "information-type-ids" : { "type" : "array", "minItems" : 1, @@ -3368,7 +3457,13 @@ "type" : { "title" : "Task Type", "description" : "The type of task.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "milestone", + "action" ] } ] }, "title" : { "title" : "Task Title", "description" : "The title for this task.", @@ -3712,7 +3807,16 @@ { "type" : { "title" : "Subject Type", "description" : "Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user" ] } ] }, "description" : { "title" : "Include Subjects Description", "description" : "A human-readable description of the collection of subjects being included in this assessment.", @@ -3757,7 +3861,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "props" : { "type" : "array", "minItems" : 1, @@ -3787,7 +3901,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "title" : { "title" : "Subject Reference Title", "description" : "The title or name for the referenced subject.", @@ -3941,7 +4065,14 @@ "reason" : { "title" : "Objective Status Reason", "description" : "The reason the objective was given it's status.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "pass", + "fail", + "other" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -4067,14 +4198,31 @@ "items" : { "title" : "Observation Method", "description" : "Identifies how the observation was made.", - "$ref" : "#/definitions/StringDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "EXAMINE", + "INTERVIEW", + "TEST", + "UNKNOWN" ] } ] } }, "types" : { "type" : "array", "minItems" : 1, "items" : { "title" : "Observation Type", "description" : "Identifies the nature of the observation. More than one may be used to further qualify and enable filtering.", - "$ref" : "#/definitions/TokenDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "ssp-statement-issue", + "control-objective", + "mitigation", + "finding", + "historic" ] } ] } }, "origins" : { "type" : "array", "minItems" : 1, @@ -4252,13 +4400,19 @@ { "system" : { "title" : "Threat Type Identification System", "description" : "Specifies the source of the threat information.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal" ] } ] }, "href" : { "title" : "Threat Information Resource Reference", "description" : "An optional location for the threat data, from which this ID originates.", "$ref" : "#/definitions/URIReferenceDatatype" }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/URIDatatype" } }, "required" : [ "id", "system" ], @@ -4494,7 +4648,17 @@ { "title" : "Risk Status", "description" : "Describes the status of the associated risk.", "$id" : "#field_oscal-assessment-common_risk-status", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "open", + "investigating", + "remediating", + "deviation-requested", + "deviation-approved", + "closed" ] } ] }, "oscal-complete-oscal-assessment-common:characterization" : { "title" : "Characterization", "description" : "A collection of descriptive data about the containing object from a specific origin.", @@ -4528,7 +4692,19 @@ "system" : { "title" : "Naming System", "description" : "Specifies the naming system under which this risk metric is organized, which allows for the same names to be used in different systems controlled by different parties. This avoids the potential of a name clash.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal/unknown", + "http://cve.mitre.org", + "http://www.first.org/cvss/v2.0", + "http://www.first.org/cvss/v3.0", + "http://www.first.org/cvss/v3.1" ] } ] }, "value" : { "title" : "Facet Value", "description" : "Indicates the value of the facet.", @@ -4567,7 +4743,14 @@ "lifecycle" : { "title" : "Remediation Intent", "description" : "Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "recommendation", + "planned", + "completed" ] } ] }, "title" : { "title" : "Response Title", "description" : "The title for this response activity.", @@ -4658,7 +4841,14 @@ "name" : { "title" : "Part Name", "description" : "A textual label that uniquely identifies the part's semantic type.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "asset", + "method", + "objective" ] } ] }, "ns" : { "title" : "Part Namespace", "description" : "A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.", diff --git a/json/schema/oscal_component_schema.json b/json/schema/oscal_component_schema.json index 750ba9a7c9..6569b4ae0d 100644 --- a/json/schema/oscal_component_schema.json +++ b/json/schema/oscal_component_schema.json @@ -63,7 +63,22 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the component.", @@ -319,7 +334,25 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "this-system", + "system", + "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation", + "network" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the system component.", @@ -443,7 +476,16 @@ { "state" : { "title" : "Implementation State", "description" : "Identifies the implementation status of the control or control objective.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "implemented", + "partial", + "planned", + "alternative", + "not-applicable" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -623,9 +665,17 @@ { "identifier-type" : { "title" : "Identification System Type", "description" : "Identifies the identification system from which the provided identifier was assigned.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "https://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "https://ietf.org/rfc/rfc4122", + "http://ietf.org/rfc/rfc4122" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id" ], "additionalProperties" : false }, @@ -828,9 +878,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -1007,7 +1062,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -1066,7 +1121,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -1196,9 +1256,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -1242,9 +1314,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -1257,7 +1336,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -1294,9 +1379,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, diff --git a/json/schema/oscal_mapping_schema.json b/json/schema/oscal_mapping_schema.json index 4590384c80..e1e60941e1 100644 --- a/json/schema/oscal_mapping_schema.json +++ b/json/schema/oscal_mapping_schema.json @@ -256,9 +256,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -435,7 +440,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -494,7 +499,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -624,9 +634,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -670,9 +692,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -685,7 +714,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -722,9 +757,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, @@ -758,16 +798,10 @@ "description" : "A namespace qualifying the relationship's value. This allows different organizations to associate distinct semantics for relationships with the same name.", "$ref" : "#/definitions/URIDatatype" }, "type" : - { "type" : "string" } }, + { "$ref" : "#/definitions/TokenDatatype" } }, "required" : [ "type" ], - "additionalProperties" : false, - "enum" : - [ "equivalent-to", - "equal-to", - "subset-of", - "superset-of", - "intersects-with" ] }, + "additionalProperties" : false }, "sources" : { "type" : "array", "minItems" : 1, diff --git a/json/schema/oscal_poam_schema.json b/json/schema/oscal_poam_schema.json index 1f3c9d6060..9006180589 100644 --- a/json/schema/oscal_poam_schema.json +++ b/json/schema/oscal_poam_schema.json @@ -364,9 +364,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -543,7 +548,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -602,7 +607,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -732,9 +742,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -778,9 +800,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -793,7 +822,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -830,9 +865,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, @@ -849,7 +889,25 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "this-system", + "system", + "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation", + "network" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the system component.", @@ -973,7 +1031,16 @@ { "state" : { "title" : "Implementation State", "description" : "Identifies the implementation status of the control or control objective.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "implemented", + "partial", + "planned", + "alternative", + "not-applicable" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -1153,9 +1220,17 @@ { "identifier-type" : { "title" : "Identification System Type", "description" : "Identifies the identification system from which the provided identifier was assigned.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "https://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "https://ietf.org/rfc/rfc4122", + "http://ietf.org/rfc/rfc4122" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id" ], "additionalProperties" : false }, @@ -1520,7 +1595,13 @@ "type" : { "title" : "Task Type", "description" : "The type of task.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "milestone", + "action" ] } ] }, "title" : { "title" : "Task Title", "description" : "The title for this task.", @@ -1864,7 +1945,16 @@ { "type" : { "title" : "Subject Type", "description" : "Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user" ] } ] }, "description" : { "title" : "Include Subjects Description", "description" : "A human-readable description of the collection of subjects being included in this assessment.", @@ -1909,7 +1999,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "props" : { "type" : "array", "minItems" : 1, @@ -1939,7 +2039,17 @@ "type" : { "title" : "Subject Universally Unique Identifier Reference Type", "description" : "Used to indicate the type of object pointed to by the uuid-ref within a subject.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "component", + "inventory-item", + "location", + "party", + "user", + "resource" ] } ] }, "title" : { "title" : "Subject Reference Title", "description" : "The title or name for the referenced subject.", @@ -2093,7 +2203,14 @@ "reason" : { "title" : "Objective Status Reason", "description" : "The reason the objective was given it's status.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "pass", + "fail", + "other" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -2219,14 +2336,31 @@ "items" : { "title" : "Observation Method", "description" : "Identifies how the observation was made.", - "$ref" : "#/definitions/StringDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "EXAMINE", + "INTERVIEW", + "TEST", + "UNKNOWN" ] } ] } }, "types" : { "type" : "array", "minItems" : 1, "items" : { "title" : "Observation Type", "description" : "Identifies the nature of the observation. More than one may be used to further qualify and enable filtering.", - "$ref" : "#/definitions/TokenDatatype" } }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "ssp-statement-issue", + "control-objective", + "mitigation", + "finding", + "historic" ] } ] } }, "origins" : { "type" : "array", "minItems" : 1, @@ -2404,13 +2538,19 @@ { "system" : { "title" : "Threat Type Identification System", "description" : "Specifies the source of the threat information.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal" ] } ] }, "href" : { "title" : "Threat Information Resource Reference", "description" : "An optional location for the threat data, from which this ID originates.", "$ref" : "#/definitions/URIReferenceDatatype" }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/URIDatatype" } }, "required" : [ "id", "system" ], @@ -2646,7 +2786,17 @@ { "title" : "Risk Status", "description" : "Describes the status of the associated risk.", "$id" : "#field_oscal-assessment-common_risk-status", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "open", + "investigating", + "remediating", + "deviation-requested", + "deviation-approved", + "closed" ] } ] }, "oscal-poam-oscal-assessment-common:characterization" : { "title" : "Characterization", "description" : "A collection of descriptive data about the containing object from a specific origin.", @@ -2680,7 +2830,19 @@ "system" : { "title" : "Naming System", "description" : "Specifies the naming system under which this risk metric is organized, which allows for the same names to be used in different systems controlled by different parties. This avoids the potential of a name clash.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal", + "http://csrc.nist.gov/ns/oscal/unknown", + "http://cve.mitre.org", + "http://www.first.org/cvss/v2.0", + "http://www.first.org/cvss/v3.0", + "http://www.first.org/cvss/v3.1" ] } ] }, "value" : { "title" : "Facet Value", "description" : "Indicates the value of the facet.", @@ -2719,7 +2881,14 @@ "lifecycle" : { "title" : "Remediation Intent", "description" : "Identifies whether this is a recommendation, such as from an assessor or tool, or an actual plan accepted by the system owner.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "recommendation", + "planned", + "completed" ] } ] }, "title" : { "title" : "Response Title", "description" : "The title for this response activity.", @@ -2810,7 +2979,14 @@ "name" : { "title" : "Part Name", "description" : "A textual label that uniquely identifies the part's semantic type.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "asset", + "method", + "objective" ] } ] }, "ns" : { "title" : "Part Namespace", "description" : "A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.", diff --git a/json/schema/oscal_profile_schema.json b/json/schema/oscal_profile_schema.json index 1f43783341..55ab6e0d20 100644 --- a/json/schema/oscal_profile_schema.json +++ b/json/schema/oscal_profile_schema.json @@ -669,9 +669,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -848,7 +853,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -907,7 +912,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -1037,9 +1047,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -1083,9 +1105,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -1098,7 +1127,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -1135,9 +1170,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, diff --git a/json/schema/oscal_ssp_schema.json b/json/schema/oscal_ssp_schema.json index af59b9a632..184099c784 100644 --- a/json/schema/oscal_ssp_schema.json +++ b/json/schema/oscal_ssp_schema.json @@ -164,7 +164,12 @@ { "system" : { "title" : "Information Type Identification System", "description" : "Specifies the information type identification system used.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://doi.org/10.6028/NIST.SP.800-60v2r1" ] } ] }, "information-type-ids" : { "type" : "array", "minItems" : 1, @@ -1030,9 +1035,14 @@ { "scheme" : { "title" : "External Identifier Schema", "description" : "Indicates the type of external identifier.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://orcid.org/" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id", "scheme" ], @@ -1209,7 +1219,7 @@ "description" : "A label that indicates the nature of a resource, as a data serialization or format.", "$ref" : "#/definitions/StringDatatype" }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/Base64Datatype" } }, "required" : [ "value" ], "additionalProperties" : false }, @@ -1268,7 +1278,12 @@ "rel" : { "title" : "Link Relation Type", "description" : "Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "reference" ] } ] }, "media-type" : { "title" : "Media Type", "description" : "A label that indicates the nature of a resource, as a data serialization or format.", @@ -1398,9 +1413,21 @@ { "algorithm" : { "title" : "Hash algorithm", "description" : "The digest method by which a hash is derived.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "SHA-224", + "SHA-256", + "SHA-384", + "SHA-512", + "SHA3-224", + "SHA3-256", + "SHA3-384", + "SHA3-512" ] } ] }, "value" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "value", "algorithm" ], @@ -1444,9 +1471,16 @@ { "type" : { "title" : "type flag", "description" : "Indicates the type of phone number.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "home", + "office", + "mobile" ] } ] }, "number" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "number" ], "additionalProperties" : false }, @@ -1459,7 +1493,13 @@ { "type" : { "title" : "Address Type", "description" : "Indicates the type of address.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "home", + "work" ] } ] }, "addr-lines" : { "type" : "array", "minItems" : 1, @@ -1496,9 +1536,14 @@ { "scheme" : { "title" : "Document Identification Scheme", "description" : "Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "http://www.doi.org/" ] } ] }, "identifier" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "identifier" ], "additionalProperties" : false }, @@ -1515,7 +1560,25 @@ "type" : { "title" : "Component Type", "description" : "A category describing the purpose of the component.", - "$ref" : "#/definitions/StringDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/StringDatatype" }, + + { "enum" : + [ "this-system", + "system", + "interconnection", + "software", + "hardware", + "service", + "policy", + "physical", + "process-procedure", + "plan", + "guidance", + "standard", + "validation", + "network" ] } ] }, "title" : { "title" : "Component Title", "description" : "A human readable name for the system component.", @@ -1639,7 +1702,16 @@ { "state" : { "title" : "Implementation State", "description" : "Identifies the implementation status of the control or control objective.", - "$ref" : "#/definitions/TokenDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/TokenDatatype" }, + + { "enum" : + [ "implemented", + "partial", + "planned", + "alternative", + "not-applicable" ] } ] }, "remarks" : { "$ref" : "#field_oscal-metadata_remarks" } }, "required" : @@ -1819,9 +1891,17 @@ { "identifier-type" : { "title" : "Identification System Type", "description" : "Identifies the identification system from which the provided identifier was assigned.", - "$ref" : "#/definitions/URIDatatype" }, + "allOf" : + [ + { "$ref" : "#/definitions/URIDatatype" }, + + { "enum" : + [ "https://fedramp.gov", + "http://fedramp.gov/ns/oscal", + "https://ietf.org/rfc/rfc4122", + "http://ietf.org/rfc/rfc4122" ] } ] }, "id" : - { "type" : "string" } }, + { "$ref" : "#/definitions/StringDatatype" } }, "required" : [ "id" ], "additionalProperties" : false },