[EPIC] Assessment Concepts Across Lifecycles

[aj-stein-nist]

User Story:

As an assessor, tool developer, or security professional leveraging OSCAL, in order to apply the concept of assessment throughout the lifecycle of an information system, I want clear guidance on how to incorporate assessment activities and tasks into that lifecycle, not just in the formation of assessment plans and assessment results.

Goals:

• Provide a clear working definition for "assessment" as it pertains to the work of this epic, and OSCAL development in general
  • specifically, if applicable, differentiate it from the NIST SP guides, IR papers, and/or CSRC glossary definition
• Draft a working roadmap on the review of where assessment comes up in different parts of the OSCAL lifecycle (RMF specific or as it pertains to common frameworks and methodologies authored by NIST or external parties)
• Modify, augment, and remove necessary elements to information models in all layers, not just OSCAL Assessment Layer
• Present necessary changes to core development team and greater OSCAL community and finalize necessary changes

Dependencies:

• Support for "Rules" in OSCAL Models #1058
• Rule Checks in OSCAL Models #1059

Acceptance Criteria

• All OSCAL website and readme documentation affected by the changes in this issue have been updated. Changes to the OSCAL website can be made in the docs/content directory of your branch.
• A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.
• The CI-CD build process runs without any reported errors on the PR. This can be confirmed by reviewing that all checks have passed in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

[aj-stein-nist]

@david-waltermire-nist per conversation today, I added this epic to group #1058 and #1059. I am sure more stories to follow and they can be added to the epic later as they emerge from other tasks. Let me know if I didn't represent the epic or frame the details correctly in goals.

[aj-stein-nist]

This work should go back to user research and discovery, so this will be moved back to DEFINE Research Needed. After that, if it is returned to development as-is, we should consider refinement being needed as this epic, as previously used it, is too large re upcoming #1688 reorganization and needs to be broken down into manageable pieces.