-
Notifications
You must be signed in to change notification settings - Fork 183
/
oscal_assessment-common_metaschema.xml
1788 lines (1743 loc) · 129 KB
/
oscal_assessment-common_metaschema.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="UTF-8"?>
<METASCHEMA xmlns="http://csrc.nist.gov/ns/oscal/metaschema/1.0" abstract="yes">
<schema-name>OSCAL Assessment Layer Format -- Common Modules</schema-name>
<schema-version>1.1.2</schema-version>
<short-name>oscal-assessment-common</short-name>
<namespace>http://csrc.nist.gov/ns/oscal/1.0</namespace>
<json-base-uri>http://csrc.nist.gov/ns/oscal</json-base-uri>
<remarks>
<p>This contains all modules common to the assessment plan, assessment results, and POAM models. </p>
<p>The root of the OSCAL Assessment Plan format is <code>assessment-plan</code>.</p>
<p>The root of the OSCAL Assessment Results format is <code>assessment-results</code>.</p>
<p>The root of the OSCAL Plan of Action and Milestones (POA&M) format is <code>plan-of-action-and-milestones</code>.</p>
</remarks>
<!-- IMPORT STATEMENTS -->
<import href="oscal_control-common_metaschema.xml"/>
<import href="oscal_implementation-common_metaschema.xml"/>
<!-- SSP Import -->
<define-assembly name="import-ssp">
<formal-name>Import System Security Plan</formal-name>
<description>Used by the assessment plan and POA&M to import information about the system.</description>
<define-flag name="href" as-type="uri-reference" required="yes">
<formal-name>System Security Plan Reference</formal-name>
<description>A resolvable URL reference to the system security plan for the system being assessed.</description>
<remarks>
<p>This value may be one of:</p>
<ol>
<li>an <a href="https://pages.nist.gov/OSCAL/concepts/uri-use/#absolute-uri">absolute URI</a> that points to a network resolvable resource,</li>
<li>a <a href="https://pages.nist.gov/OSCAL/concepts/uri-use/#relative-reference">relative reference</a> pointing to a network resolvable resource whose base URI is the URI of the containing document, or</li>
<li>a bare URI fragment (i.e., `#uuid`) pointing to a <code>back-matter</code> resource in this or an imported document (see <a href="https://pages.nist.gov/OSCAL/concepts/uri-use/#linking-to-another-oscal-object">linking to another OSCAL object</a>).</li>
</ol>
</remarks>
</define-flag>
<model>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<define-assembly name="local-objective">
<formal-name>Assessment-Specific Control Objective</formal-name>
<description>A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions.</description>
<flag ref="control-id" required="yes">
<remarks>
<p>The specified <code>control-id</code> must be a valid value within the baseline identified by the target system's SSP via the <code>import-profile</code> statement.</p>
</remarks>
</flag>
<model>
<define-field name="description" min-occurs="0" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Objective Description</formal-name>
<description>A human-readable description of this control objective.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<assembly ref="part" min-occurs="1" max-occurs="unbounded">
<group-as name="parts" in-json="ARRAY" />
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<constraint>
<allowed-values target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
<enum value="objective" deprecated="1.0.1">**(deprecated)** Use 'assessment-objective' instead.</enum>
<enum value="assessment" deprecated="1.0.1">**(deprecated)** Use 'assessment-method' instead.</enum>
<enum value="assessment-objective">The part defines an assessment objective.</enum>
<enum value="assessment-method">The part defines an assessment method.</enum>
</allowed-values>
<has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]" max-occurs="1" />
<has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/prop[has-oscal-namespace(('http://csrc.nist.gov/ns/oscal','http://csrc.nist.gov/ns/rmf')) and @name='method']" min-occurs="1" max-occurs="1" />
<has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objects','assessment-objects')]" min-occurs="1" max-occurs="1" />
<has-cardinality target="part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method-id']" min-occurs="1" />
</constraint>
</define-assembly>
<define-assembly name="assessment-method">
<formal-name>Assessment Method</formal-name>
<description>A local definition of a control objective. Uses catalog syntax for control objective and assessment activities.</description>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Assessment Method Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this assessment method elsewhere in <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>assessment method</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<model>
<define-field name="description" min-occurs="0" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Assessment Method Description</formal-name>
<description>A human-readable description of this assessment method.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<assembly ref="assessment-part" min-occurs="1" max-occurs="1"/>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<define-assembly name="activity">
<formal-name>Activity</formal-name>
<description>Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment.</description>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Assessment Activity Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this assessment activity elsewhere in <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>activity</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<model>
<define-field name="title" min-occurs="0" max-occurs="1" as-type="markup-line">
<formal-name>Included Activity Title</formal-name>
<description>The title for this included activity.</description>
</define-field>
<define-field name="description" min-occurs="1" max-occurs="1" as-type="markup-multiline" in-xml="WITH_WRAPPER">
<formal-name>Included Activity Description</formal-name>
<description>A human-readable description of this included activity.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<define-assembly name="step" min-occurs="0" max-occurs="unbounded">
<formal-name>Step</formal-name>
<description>Identifies an individual step in a series of steps related to an activity, such as an assessment test or examination procedure.</description>
<group-as name="steps" in-json="ARRAY"/>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Step Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this step elsewhere in <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>step</code> (in a series of steps) can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<model>
<define-field name="title" min-occurs="0" max-occurs="1" as-type="markup-line">
<formal-name>Step Title</formal-name>
<description>The title for this step.</description>
</define-field>
<define-field name="description" min-occurs="1" max-occurs="1" as-type="markup-multiline" in-xml="WITH_WRAPPER">
<formal-name>Step Description</formal-name>
<description>A human-readable description of this step.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<assembly ref="reviewed-controls">
<remarks>
<p>This can be optionally used to define the set of controls and control objectives that are assessed by this step.</p>
</remarks>
</assembly>
<assembly ref="responsible-role" max-occurs="unbounded">
<group-as name="responsible-roles" in-json="ARRAY"/>
<remarks>
<p>Identifies the roles, and optionally the parties, associated with this step that is part of an assessment activity.</p>
</remarks>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<constraint>
<is-unique id="unique-step-responsible-role" target="responsible-role">
<key-field target="@role-id"/>
<remarks>
<p>Since multiple <code>party-uuid</code> entries can be provided, each role-id must be referenced only once.</p>
</remarks>
</is-unique>
</constraint>
</define-assembly>
<assembly ref="reviewed-controls">
<use-name>related-controls</use-name>
<remarks>
<p>This can be optionally used to define the set of controls and control objectives that are assessed or remediated by this activity.</p>
</remarks>
</assembly>
<assembly ref="responsible-role" max-occurs="unbounded">
<group-as name="responsible-roles" in-json="ARRAY"/>
<remarks>
<p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
</remarks>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<constraint>
<!-- TODO: Dave to double-check constraints here -->
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name">
<enum value="method">The assessment method to use. This typically appears on parts with the name "assessment".</enum>
</allowed-values>
<has-cardinality target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']" min-occurs="1"/>
<allowed-values target="prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']/@value">
<enum value="INTERVIEW">The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.</enum>
<enum value="EXAMINE">The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).</enum>
<enum value="TEST">The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.</enum>
</allowed-values>
<is-unique id="unique-activity-responsible-role" target="responsible-role">
<key-field target="@role-id"/>
<remarks>
<p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
</remarks>
</is-unique>
</constraint>
</define-assembly>
<define-assembly name="task">
<formal-name>Task</formal-name>
<description>Represents a scheduled event or milestone, which may be associated with a series of assessment actions.</description>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Task Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this task elsewhere in <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>task</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<define-flag name="type" required="yes" as-type="token">
<formal-name>Task Type</formal-name>
<description>The type of task.</description>
<constraint>
<allowed-values allow-other="yes">
<enum value="milestone">The task represents a planned milestone.</enum>
<enum value="action">The task represents a specific assessment action to be performed.</enum>
</allowed-values>
</constraint>
</define-flag>
<model>
<define-field name="title" min-occurs="1" as-type="markup-line">
<formal-name>Task Title</formal-name>
<description>The title for this task.</description>
</define-field>
<define-field name="description" max-occurs="1" as-type="markup-multiline" in-xml="WITH_WRAPPER">
<formal-name>Task Description</formal-name>
<description>A human-readable description of this task.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<define-assembly name="timing">
<formal-name>Event Timing</formal-name>
<description>The timing under which the task is intended to occur.</description>
<model>
<choice>
<define-assembly name="on-date" min-occurs="1">
<formal-name>On Date Condition</formal-name>
<description>The task is intended to occur on the specified date.</description>
<define-flag name="date" as-type="dateTime-with-timezone" required="yes">
<formal-name>On Date Condition</formal-name>
<description>The task must occur on the specified date.</description>
</define-flag>
</define-assembly>
<define-assembly name="within-date-range" min-occurs="1">
<formal-name>On Date Range Condition</formal-name>
<description>The task is intended to occur within the specified date range.</description>
<define-flag name="start" as-type="dateTime-with-timezone" required="yes">
<formal-name>Start Date Condition</formal-name>
<description>The task must occur on or after the specified date.</description>
</define-flag>
<define-flag name="end" as-type="dateTime-with-timezone" required="yes">
<formal-name>End Date Condition</formal-name>
<description>The task must occur on or before the specified date.</description>
</define-flag>
</define-assembly>
<define-assembly name="at-frequency" min-occurs="1">
<formal-name>Frequency Condition</formal-name>
<description>The task is intended to occur at the specified frequency.</description>
<define-flag name="period" as-type="positiveInteger" required="yes">
<formal-name>Period</formal-name>
<description>The task must occur after the specified period has elapsed.</description>
</define-flag>
<define-flag name="unit" as-type="string" required="yes">
<formal-name>Time Unit</formal-name>
<description>The unit of time for the period.</description>
<constraint>
<allowed-values>
<enum value="seconds">The period is specified in seconds.</enum>
<enum value="minutes">The period is specified in minutes.</enum>
<enum value="hours">The period is specified in hours.</enum>
<enum value="days">The period is specified in days.</enum>
<enum value="months">The period is specified in calendar months.</enum>
<enum value="years">The period is specified in calendar years.</enum>
</allowed-values>
</constraint>
</define-flag>
</define-assembly>
</choice>
</model>
</define-assembly>
<define-assembly name="dependency" max-occurs="unbounded">
<formal-name>Task Dependency</formal-name>
<description>Used to indicate that a task is dependent on another task.</description>
<group-as name="dependencies" in-json="ARRAY"/>
<define-flag name="task-uuid" required="yes" as-type="uuid">
<formal-name>Task Universally Unique Identifier Reference</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to a unique task.</description>
</define-flag>
<model>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<assembly ref="task" min-occurs="0" max-occurs="unbounded">
<group-as name="tasks" in-json="ARRAY"/>
</assembly>
<define-assembly name="associated-activity" min-occurs="0" max-occurs="unbounded">
<formal-name>Associated Activity</formal-name>
<description>Identifies an individual activity to be performed as part of a task.</description>
<group-as name="associated-activities" in-json="ARRAY"/>
<define-flag name="activity-uuid" required="yes" as-type="uuid">
<formal-name>Activity Universally Unique Identifier Reference</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to an activity defined in the list of activities.</description>
</define-flag>
<model>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<assembly ref="responsible-role" max-occurs="unbounded">
<group-as name="responsible-roles" in-json="ARRAY"/>
<remarks>
<p>Identifies the person or organization responsible for performing a specific role defined by the activity.</p>
</remarks>
</assembly>
<!-- <choice>
--> <assembly ref="assessment-subject" min-occurs="1" max-occurs="unbounded">
<use-name>subject</use-name>
<group-as name="subjects" in-json="ARRAY"/>
</assembly>
<!-- <assembly ref="assessment-subject-placeholder">
<use-name>subject-placeholder</use-name>
</assembly>
</choice>
--> <field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<constraint>
<is-unique id="unique-associated-activity-responsible-role" target="responsible-role">
<key-field target="@role-id"/>
<remarks>
<p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
</remarks>
</is-unique>
</constraint>
</define-assembly>
<assembly ref="assessment-subject" max-occurs="unbounded">
<use-name>subject</use-name>
<group-as name="subjects" in-json="ARRAY"/>
<remarks>
<p>The assessment subjects that the activity was performed against.</p>
</remarks>
</assembly>
<assembly ref="responsible-role" max-occurs="unbounded">
<group-as name="responsible-roles" in-json="ARRAY"/>
<remarks>
<p>Identifies the person or organization responsible for performing a specific role related to the task.</p>
<!-- todo: role id and party id scope is defined at the document level. Refer to root object within which the data is declared for...mention resolved through imports. Note: wh-->
</remarks>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<!-- ********** OBJECTIVES Assembly ********** -->
<define-assembly name="reviewed-controls">
<formal-name>Reviewed Controls and Control Objectives</formal-name>
<description>Identifies the controls being assessed and their control objectives.</description>
<model>
<define-field name="description" min-occurs="0" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Control Objective Description</formal-name>
<description>A human-readable description of control objectives.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<define-assembly name="control-selection" min-occurs="1" max-occurs="unbounded">
<formal-name>Assessed Controls</formal-name>
<description>Identifies the controls being assessed. In the assessment plan, these are the planned controls. In the assessment results, these are the actual controls, and reflects any changes from the plan.</description>
<group-as name="control-selections" in-json="ARRAY"/>
<model>
<define-field name="description" min-occurs="0" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Assessed Controls Description</formal-name>
<description>A human-readable description of in-scope controls specified for assessment.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<choice>
<assembly ref="include-all" min-occurs="1"/>
<assembly ref="select-control-by-id" min-occurs="1" max-occurs="unbounded">
<use-name>include-control</use-name>
<group-as name="include-controls" in-json="ARRAY"/>
<remarks>
<p>Used to select a control for inclusion by the control's identifier. Specific control statements can be selected by their statement identifier.</p>
</remarks>
</assembly>
</choice>
<assembly ref="select-control-by-id" max-occurs="unbounded">
<use-name>exclude-control</use-name>
<group-as name="exclude-controls" in-json="ARRAY"/>
<remarks>
<p>Used to select a control for exclusion by the control's identifier. Specific control statements can be excluded by their statement identifier.</p>
</remarks>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<remarks>
<p>The <code>include-all</code>, specifies all control identified in the <strong>baseline</strong> are included in the scope if this assessment, as specified by the <code>include-profile</code> statement within the linked SSP.</p>
<p>Any control specified within <code>exclude-controls</code> must first be within a range of explicitly included controls, via <code>include-controls</code> or <code>include-all</code>.</p>
</remarks>
</define-assembly>
<define-assembly name="control-objective-selection" min-occurs="0" max-occurs="unbounded">
<formal-name>Referenced Control Objectives</formal-name>
<description>Identifies the control objectives of the assessment. In the assessment plan, these are the planned objectives. In the assessment results, these are the assessed objectives, and reflects any changes from the plan.</description>
<group-as name="control-objective-selections" in-json="ARRAY"/>
<model>
<define-field name="description" min-occurs="0" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Control Objectives Description</formal-name>
<description>A human-readable description of this collection of control objectives.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<choice>
<assembly ref="include-all" min-occurs="1"/>
<assembly ref="select-objective-by-id" min-occurs="1" max-occurs="unbounded">
<use-name>include-objective</use-name>
<group-as name="include-objectives" in-json="ARRAY"/>
<remarks>
<p>Used to select a control objective for inclusion by the control objective's identifier.</p>
</remarks>
</assembly>
</choice>
<assembly ref="select-objective-by-id" max-occurs="unbounded">
<use-name>exclude-objective</use-name>
<group-as name="exclude-objectives" in-json="ARRAY"/>
<remarks>
<p>Used to select a control objective for exclusion by the control objective's identifier.</p>
</remarks>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<remarks>
<p>The <code>include-all</code> field, specifies all control objectives for any in-scope control. In-scope controls are defined in the <code>control-selection</code>.</p>
<p>Any control objective specified within <code>exclude-controls</code> must first be within a range of explicitly included control objectives, via <code>include-objectives</code> or <code>include-all</code>.</p>
</remarks>
</define-assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<remarks>
<p>In the context of an assessment plan, this construct is used to identify the controls and control objectives that are to be assessed. In the context of an assessment result, this construct is used to identify the actual controls and objectives that were assessed, reflecting any changes from the plan.</p>
<p>When resolving the selection of controls and control objectives, the following processing will occur:</p>
<p>1. Controls will be resolved by creating a set of controls based on the control-selections by first handling the includes, and then removing any excluded controls.</p>
<p>2. The set of control objectives will be resolved from the set of controls that was generated in the previous step. The set of control objectives is based on the control-objective-selection by first handling the includes, and then removing any excluded control objectives.</p>
</remarks>
</define-assembly>
<define-assembly name="select-control-by-id" scope="local">
<formal-name>Select Control</formal-name>
<description>Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.</description>
<flag ref="control-id" required="yes"/>
<model>
<define-field name="statement-id" as-type="token" min-occurs="0" max-occurs="unbounded" >
<formal-name>Include Specific Statements</formal-name>
<description>Used to constrain the selection to only specificity identified statements.</description>
<group-as name="statement-ids" in-json="ARRAY"/>
</define-field>
</model>
</define-assembly>
<define-assembly name="select-objective-by-id">
<formal-name>Select Objective</formal-name>
<description>Used to select a control objective for inclusion/exclusion based on the control objective's identifier.</description>
<flag ref="objective-id" required="yes"/>
</define-assembly>
<!-- ********** ASSESSMENT SUBJECT Assembly ********** -->
<define-assembly name="assessment-subject-placeholder">
<formal-name>Assessment Subject Placeholder</formal-name>
<description>Used when the assessment subjects will be determined as part of one or more other assessment activities. These assessment subjects will be recorded in the assessment results in the assessment log.</description>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Assessment Subject Placeholder Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier for a set of assessment subjects that will be identified by a task or an activity that is part of a task. The locally defined <em>UUID</em> of the <code>assessment subject placeholder</code> can be used to reference the data item locally or globally (e.g., in an <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">imported OSCAL instance</a>). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<model>
<define-field name="description" as-type="markup-multiline" in-xml="WITH_WRAPPER">
<formal-name>Assessment Subject Placeholder Description</formal-name>
<description>A human-readable description of intent of this assessment subject placeholder.</description>
</define-field>
<define-assembly name="source" min-occurs="1" max-occurs="unbounded">
<formal-name>Assessment Subject Source</formal-name>
<description>Assessment subjects will be identified while conducting the referenced activity-instance.</description>
<group-as name="sources" in-json="ARRAY"/>
<define-flag name="task-uuid" required="yes" as-type="uuid">
<formal-name>Task Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference (in this or other OSCAL instances) an assessment activity to be performed as part of the event. The locally defined <em>UUID</em> of the <code>task</code> can be used to reference the data item locally or globally (e.g., in an <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">imported OSCAL instance</a>). This UUID should be assigned <em>per-subject</em>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
</define-assembly>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<define-assembly name="assessment-subject">
<formal-name>Subject of Assessment</formal-name>
<description>Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.</description>
<define-flag name="type" as-type="token" required="yes">
<formal-name>Subject Type</formal-name>
<description>Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.</description>
<constraint>
<allowed-values allow-other="yes">
<enum value="component">The referenced assessment subject is a component defined in the SSP, or in the <code>local-definitions</code> of an Assessment Plan or Assessment Results.</enum>
<enum value="inventory-item">The referenced assessment subject is a inventory item defined in the SSP, or in the <code>local-definitions</code> of an Assessment Plan or Assessment Results.</enum>
<enum value="location">The referenced assessment subject is a <code>location</code> defined in the <code>metadata</code> of the SSP, Assessment Plan, or Assessment Results.</enum>
<enum value="party">The referenced assessment subject is a person or team to interview, who is defined as a <code>party</code> in the <code>metadata</code> of the SSP, Assessment Plan, or Assessment Results.</enum>
<enum value="user">The referenced assessment subject is a <code>user</code> defined in the SSP, or in the <code>local-definitions</code> of an Assessment Plan or Assessment Results.</enum>
</allowed-values>
</constraint>
</define-flag>
<model>
<define-field name="description" min-occurs="0" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Include Subjects Description</formal-name>
<description>A human-readable description of the collection of subjects being included in this assessment.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<choice>
<assembly ref="include-all" min-occurs="1"/>
<assembly ref="select-subject-by-id" min-occurs="1" max-occurs="unbounded">
<use-name>include-subject</use-name>
<group-as name="include-subjects" in-json="ARRAY"/>
</assembly>
</choice>
<assembly ref="select-subject-by-id" min-occurs="0" max-occurs="unbounded">
<use-name>exclude-subject</use-name>
<group-as name="exclude-subjects" in-json="ARRAY"/>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<remarks>
<p>Processing of an include/exclude pair starts with processing the include, then removing matching entries in the exclude.</p>
</remarks>
</define-assembly>
<define-assembly name="select-subject-by-id">
<formal-name>Select Assessment Subject</formal-name>
<description>Identifies a set of assessment subjects to include/exclude by UUID.</description>
<flag ref="subject-uuid" required="yes"/>
<flag ref="subject-type" required="yes">
<use-name>type</use-name>
</flag>
<model>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<define-flag name="subject-uuid" as-type="uuid" scope="local">
<formal-name>Subject Universally Unique Identifier Reference</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.</description>
</define-flag>
<define-flag name="subject-type" as-type="token" scope="local">
<formal-name>Subject Universally Unique Identifier Reference Type</formal-name>
<description>Used to indicate the type of object pointed to by the <code>uuid-ref</code> within a subject.</description>
<constraint>
<allowed-values allow-other="yes">
<enum value="component">Component</enum>
<enum value="inventory-item">Inventory Item</enum>
<enum value="location">Location</enum>
<enum value="party">Interview Party</enum>
<enum value="user">User</enum>
<enum value="resource">Resource or Artifact</enum>
</allowed-values>
</constraint>
</define-flag>
<define-assembly name="subject-reference" scope="local">
<formal-name>Identifies the Subject</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#human-oriented">human-oriented</a> identifier reference to a resource. Use type to indicate whether the identified resource is a component, inventory item, location, user, or something else.</description>
<flag ref="subject-uuid" required="yes"/>
<flag ref="subject-type" required="yes">
<use-name>type</use-name>
</flag>
<model>
<define-field name="title" min-occurs="0" max-occurs="1" as-type="markup-line">
<!-- QUESTION: Is this needed, since the title from the target can be used? -->
<formal-name>Subject Reference Title</formal-name>
<description>The title or name for the referenced subject.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<remarks>
<p>The subject reference UUID could point to an item defined in the SSP, AP, or AR.</p>
<p>Tools should check look for the ID in every file imported directly or indirectly.</p>
</remarks>
</define-assembly>
<!-- ********** ASSET Assembly ********** -->
<define-assembly name="assessment-assets">
<formal-name>Assessment Assets</formal-name>
<description>Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions.</description>
<model>
<assembly ref="system-component" min-occurs="0" max-occurs="unbounded">
<use-name>component</use-name>
<group-as name="components" in-json="ARRAY"/>
<remarks>
<p>Used to add any components for tools used during the assessment. These are represented here to avoid mixing with system components.</p>
<p>The technology tools used by the assessor to perform the assessment, such as vulnerability scanners. In the assessment plan these are the intended tools. In the assessment results, these are the actual tools used, including any differences from the assessment plan.</p>
</remarks>
</assembly>
<define-assembly name="assessment-platform" min-occurs="1" max-occurs="unbounded">
<formal-name>Assessment Platform</formal-name>
<description>Used to represent the toolset used to perform aspects of the assessment.</description>
<group-as name="assessment-platforms" in-json="ARRAY"/>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Assessment Platform Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this assessment platform elsewhere in this or other OSCAL instances. The locally defined <em>UUID</em> of the <code>assessment platform</code> can be used to reference the data item locally or globally (e.g., in an <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">imported OSCAL instance</a>). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<model>
<define-field name="title" max-occurs="1" as-type="markup-line">
<formal-name>Assessment Platform Title</formal-name>
<description>The title or name for the assessment platform.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<define-assembly name="uses-component" min-occurs="0" max-occurs="unbounded">
<formal-name>Uses Component</formal-name>
<description>The set of components that are used by the assessment platform.</description>
<group-as name="uses-components" in-json="ARRAY"/>
<define-flag required="yes" name="component-uuid" as-type="uuid">
<formal-name>Component Universally Unique Identifier Reference</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to a component that is implemented as part of an inventory item.</description>
</define-flag>
<model>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<assembly ref="responsible-party" max-occurs="unbounded">
<group-as name="responsible-parties" in-json="ARRAY"/>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER"/>
</model>
<constraint>
<is-unique id="unique-ssp-uses-component-responsible-party" target="responsible-party">
<key-field target="@role-id"/>
<remarks>
<p>Since <code>responsible-party</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
</remarks>
</is-unique>
</constraint>
</define-assembly>
<field ref="remarks" in-xml="WITH_WRAPPER"/>
</model>
</define-assembly>
</model>
<constraint>
<is-unique id="unique-ssp-assessment-assets-component" target="component">
<key-field target="@uuid"/>
<remarks>
<p>Since multiple assessment <code>component</code> entries can be provided, each component must have a unique <code>uuid</code>.</p>
</remarks>
</is-unique>
</constraint>
</define-assembly>
<!-- ********** Assemblies used within RESULTS and POA&M Items ********** -->
<define-assembly name="finding-target">
<formal-name>Objective Status</formal-name>
<description>Captures an assessor's conclusions regarding the degree to which an objective is satisfied.</description>
<define-flag name="type" as-type="string" required="yes">
<formal-name>Finding Target Type</formal-name>
<description>Identifies the type of the target.</description>
<constraint>
<allowed-values>
<enum value="statement-id">A reference to a control statement identifier within a control.</enum>
<enum value="objective-id">A reference to a control objective identifier within a control.</enum>
</allowed-values>
</constraint>
<remarks>
<p>The target will always be a reference to: 1) a control statement, or 2) a control objective. In the former case, there is always a single top-level statement within a control. Thus, if the entire control is targeted, this statement identifier can be used.</p>
</remarks>
</define-flag>
<define-flag name="target-id" as-type="token" required="yes">
<formal-name>Finding Target Identifier Reference</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference for a specific target qualified by the <code>type</code>.</description>
</define-flag>
<model>
<define-field name="title" min-occurs="0" max-occurs="1" as-type="markup-line">
<formal-name>Objective Status Title</formal-name>
<description>The title for this objective status.</description>
</define-field>
<define-field name="description" min-occurs="0" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Objective Status Description</formal-name>
<description>A human-readable description of the assessor's conclusions regarding the degree to which an objective is satisfied.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<define-assembly name="status" min-occurs="1">
<formal-name>Objective Status</formal-name>
<description>A determination of if the objective is satisfied or not within a given system.</description>
<define-flag name="state" as-type="token" required="yes">
<formal-name>Objective Status State</formal-name>
<description>An indication as to whether the objective is satisfied or not.</description>
<constraint>
<allowed-values>
<enum value="satisfied">The objective has been completely satisfied.</enum>
<enum value="not-satisfied">The objective has not been completely satisfied, but may be partially satisfied.</enum>
</allowed-values>
</constraint>
</define-flag>
<define-flag name="reason" as-type="token">
<formal-name>Objective Status Reason</formal-name>
<description>The reason the objective was given it's status.</description>
<constraint>
<allowed-values allow-other="yes">
<enum value="pass">The target system or system component satisfied all the conditions.</enum>
<enum value="fail">The target system or system component did not satisfy all the conditions.</enum>
<enum value="other">Some other event took place that is not a pass or a fail.</enum>
</allowed-values>
</constraint>
<remarks>
<p>Reason may contain any value, and should be used to communicate additional information regarding the status.</p>
</remarks>
</define-flag>
<model>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<assembly ref="implementation-status">
<remarks>
<p>The <code>implementation-status</code> is used to qualify the <code>status</code> value to indicate the degree to which the control was found to be implemented.</p>
</remarks>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<define-assembly name="finding">
<formal-name>Finding</formal-name>
<description>Describes an individual finding.</description>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Finding Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this finding in <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#ar-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>finding</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<model>
<define-field name="title" min-occurs="1" as-type="markup-line">
<formal-name>Finding Title</formal-name>
<description>The title for this finding.</description>
</define-field>
<!-- CHANGE: Added WITH_WRAPPER to description -->
<define-field name="description" min-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Finding Description</formal-name>
<description>A human-readable description of this finding.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<assembly ref="origin" max-occurs="unbounded">
<group-as name="origins" in-json="ARRAY"/>
<remarks>
<p>Used to identify the individual and/or tool generated this finding.</p>
</remarks>
</assembly>
<assembly ref="finding-target" min-occurs="1">
<use-name>target</use-name>
</assembly>
<define-field name="implementation-statement-uuid" as-type="uuid" min-occurs="0" max-occurs="1">
<formal-name>Implementation Statement UUID</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to the implementation statement in the SSP to which this finding is related.</description>
</define-field>
<!-- CHANGED: replaced embedded observation with references -->
<define-assembly name="related-observation" max-occurs="unbounded">
<formal-name>Related Observation</formal-name>
<description>Relates the finding to a set of referenced observations that were used to determine the finding.</description>
<group-as name="related-observations" in-json="ARRAY"/>
<define-flag name="observation-uuid" as-type="uuid" required="yes">
<formal-name>Observation Universally Unique Identifier Reference</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to an observation defined in the list of observations.</description>
</define-flag>
</define-assembly>
<!-- CHANGED: replaced "risk" with new "assciated-risk" -->
<define-assembly name="associated-risk" max-occurs="unbounded">
<formal-name>Associated Risk</formal-name>
<description>Relates the finding to a set of referenced risks that were used to determine the finding.</description>
<group-as name="related-risks" in-json="ARRAY"/>
<define-flag name="risk-uuid" as-type="uuid" required="yes">
<formal-name>Risk Universally Unique Identifier Reference</formal-name>
<!-- Identifier Reference -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to a risk defined in the list of risks.</description>
</define-flag>
</define-assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<define-assembly name="observation">
<formal-name>Observation</formal-name>
<description>Describes an individual observation.</description>
<define-flag name="uuid" required="yes" as-type="uuid">
<formal-name>Observation Universally Unique Identifier</formal-name>
<!-- Identifier Declaration -->
<description>A <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <em>cross-instance</em> scope that can be used to reference this observation elsewhere in <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#scope">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>observation</code> can be used to reference the data item locally or globally (e.g., in an imorted OSCAL instance). This UUID should be assigned <a href="https://pages.nist.gov/OSCAL/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
</define-flag>
<model>
<define-field name="title" min-occurs="0" max-occurs="1" as-type="markup-line">
<formal-name>Observation Title</formal-name>
<description>The title for this observation.</description>
</define-field>
<define-field name="description" min-occurs="1" max-occurs="1" in-xml="WITH_WRAPPER"
as-type="markup-multiline">
<formal-name>Observation Description</formal-name>
<description>A human-readable description of this assessment observation.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<define-field name="method" min-occurs="1" max-occurs="unbounded">
<formal-name>Observation Method</formal-name>
<description>Identifies how the observation was made.</description>
<group-as name="methods" in-json="ARRAY"/>
<constraint>
<allowed-values target="." allow-other="yes">
<enum value="EXAMINE">An inspection was performed.</enum>
<enum value="INTERVIEW">An interview was performed.</enum>
<enum value="TEST">A manual or automated test was performed.</enum>
<enum value="UNKNOWN">This is only for use when converting historic content to OSCAL, where the conversion process cannot initially identify the appropriate method(s).</enum>
</allowed-values>
</constraint>
</define-field>
<define-field name="type" as-type="token" max-occurs="unbounded">
<formal-name>Observation Type</formal-name>
<description>Identifies the nature of the observation. More than one may be used to further qualify and enable filtering.</description>
<group-as name="types" in-json="ARRAY"/>
<constraint>
<allowed-values target="." allow-other="yes">
<enum value="ssp-statement-issue">A difference between the SSP implementation statement, and actual implementation.</enum>
<enum value="control-objective">An observation about the status of a the associated control objective.</enum>
<enum value="mitigation">A mitigating factor was identified.</enum>
<enum value="finding">An assessment finding. Used for observations made by tools, penetration testing, and other means.</enum>
<enum value="historic">An observation from a past assessment, which was converted to OSCAL at a later date.</enum>
</allowed-values>
</constraint>
</define-field>
<assembly ref="origin" max-occurs="unbounded">
<group-as name="origins" in-json="ARRAY"/>
<remarks>
<p>Used to identify the individual and/or tool that gathered the evidence resulting in the observation identification.</p>
</remarks>
</assembly>
<assembly ref="subject-reference" min-occurs="0" max-occurs="unbounded">
<use-name>subject</use-name>
<group-as name="subjects" in-json="ARRAY"/>
<remarks>
<p>Identifies who was interviewed, or what was tested or inspected.</p>
</remarks>
</assembly>
<define-assembly name="relevant-evidence" max-occurs="unbounded">
<formal-name>Relevant Evidence</formal-name>
<description>Links this observation to relevant evidence.</description>
<group-as name="relevant-evidence" in-json="ARRAY"/>
<define-flag name="href" as-type="uri-reference">
<formal-name>Relevant Evidence Reference</formal-name>
<description>A resolvable URL reference to relevant evidence.</description>
<remarks>
<p>This value may be one of:</p>
<ol>
<li>an <a href="https://pages.nist.gov/OSCAL/concepts/uri-use/#absolute-uri">absolute URI</a> that points to a network resolvable resource,</li>
<li>a <a href="https://pages.nist.gov/OSCAL/concepts/uri-use/#relative-reference">relative reference</a> pointing to a network resolvable resource whose base URI is the URI of the containing document, or</li>
<li>a bare URI fragment (i.e., `#uuid`) pointing to a <code>back-matter</code> resource in this or an imported document (see <a href="https://pages.nist.gov/OSCAL/concepts/uri-use/#linking-to-another-oscal-object">linking to another OSCAL object</a>).</li>
</ol>
</remarks>
</define-flag>
<model>
<define-field name="description" min-occurs="1" max-occurs="1" in-xml="WITH_WRAPPER" as-type="markup-multiline">
<formal-name>Relevant Evidence Description</formal-name>
<description>A human-readable description of this evidence.</description>
</define-field>
<assembly ref="property" max-occurs="unbounded">
<group-as name="props" in-json="ARRAY"/>
</assembly>
<assembly ref="link" max-occurs="unbounded">
<group-as name="links" in-json="ARRAY"/>
</assembly>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
</define-assembly>
<define-field name="collected" as-type="dateTime-with-timezone" min-occurs="1" max-occurs="1">
<formal-name>Collected Field</formal-name>
<description>Date/time stamp identifying when the finding information was collected.</description>
</define-field>
<define-field name="expires" as-type="dateTime-with-timezone" min-occurs="0" max-occurs="1">
<formal-name>Expires Field</formal-name>
<description>Date/time identifying when the finding information is out-of-date and no longer valid. Typically used with continuous assessment scenarios.</description>
</define-field>
<field ref="remarks" in-xml="WITH_WRAPPER" min-occurs="0" max-occurs="1"/>
</model>
<!-- <constraint>
<!-\- TODO: review these and figure out where these go -\->
<allowed-values target="origin/@type" allow-other="no">
<!-\\- CHANGED: "tool" to "******" -\\->
<enum value="tool">An assessment tool, defined in the assets section of the assessment plan or results.</enum>
<enum value="test-method">A test method defined in the assessment-activities section of the assessment plan or results.</enum>
<enum value="task">A task defined in the schedule of the assessment plan or results.</enum>
<enum value="included-activity">An assessment activity defined in the assessment-activities section of the assessment plan or results.</enum>
<enum value="other">The UUID points elsewhere in the this file or an imported file.</enum>
</allowed-values>
</constraint>
--> </define-assembly>
<define-assembly name="origin">
<formal-name>Origin</formal-name>
<description>Identifies the source of the finding, such as a tool, interviewed person, or activity.</description>
<model>
<assembly ref="origin-actor" min-occurs="1" max-occurs="unbounded">
<use-name>actor</use-name>
<group-as name="actors" in-json="ARRAY"/>
</assembly>
<assembly ref="related-task" max-occurs="unbounded">
<group-as name="related-tasks" in-json="ARRAY"/>
</assembly>
</model>
</define-assembly>
<define-assembly name="origin-actor">
<formal-name>Originating Actor</formal-name>
<description>The actor that produces an observation, a finding, or a risk. One or more actor type can be used to specify a person that is using a tool.</description>
<define-flag name="type" as-type="token" required="yes">
<formal-name>Actor Type</formal-name>
<description>The kind of actor.</description>
<constraint>
<allowed-values>
<enum value="tool">A reference to a tool component defined with the assessment assets.</enum>
<enum value="assessment-platform">A reference to an assessment-platform defined with the assessment assets.</enum>
<enum value="party">A reference to a party defined within the document metadata.</enum>
</allowed-values>
</constraint>