diff --git a/features/fedramp_extensions.feature b/features/fedramp_extensions.feature index a59781806..afa32cbb5 100644 --- a/features/fedramp_extensions.feature +++ b/features/fedramp_extensions.feature @@ -108,6 +108,7 @@ Examples: | leveraged-authorization-has-authorization-type | | leveraged-authorization-has-impact-level | | leveraged-authorization-has-system-identifier | + | leveraged-authorization-has-valid-impact-level | | leveraged-authorization-nature-of-agreement | | marking | | missing-response-components | @@ -321,6 +322,8 @@ Examples: | leveraged-authorization-has-impact-level-PASS.yaml | | leveraged-authorization-has-system-identifier-FAIL.yaml | | leveraged-authorization-has-system-identifier-PASS.yaml | + | leveraged-authorization-has-valid-impact-level-FAIL.yaml | + | leveraged-authorization-has-valid-impact-level-PASS.yaml | | leveraged-authorization-nature-of-agreement-FAIL.yaml | | leveraged-authorization-nature-of-agreement-PASS.yaml | | marking-FAIL.yaml | diff --git a/src/validations/constraints/content/ssp-all-VALID.xml b/src/validations/constraints/content/ssp-all-VALID.xml index 521cc3b0a..f4a77d5cd 100644 --- a/src/validations/constraints/content/ssp-all-VALID.xml +++ b/src/validations/constraints/content/ssp-all-VALID.xml @@ -264,7 +264,7 @@ GovCloud - + f0bc13a4-3303-47dd-80d3-380e159c8362 2015-01-01 diff --git a/src/validations/constraints/content/ssp-leveraged-authorization-has-valid-impact-level-INVALID.xml b/src/validations/constraints/content/ssp-leveraged-authorization-has-valid-impact-level-INVALID.xml new file mode 100644 index 000000000..13bf1f266 --- /dev/null +++ b/src/validations/constraints/content/ssp-leveraged-authorization-has-valid-impact-level-INVALID.xml @@ -0,0 +1,10 @@ + + + fips-199-moderate + + + + + + + \ No newline at end of file diff --git a/src/validations/constraints/content/ssp-leveraged-authorization-has-valid-impact-level-VALID.xml b/src/validations/constraints/content/ssp-leveraged-authorization-has-valid-impact-level-VALID.xml new file mode 100644 index 000000000..f3c9ec506 --- /dev/null +++ b/src/validations/constraints/content/ssp-leveraged-authorization-has-valid-impact-level-VALID.xml @@ -0,0 +1,532 @@ + + + + Enhanced Example System Security Plan + 2024-08-01T14:30:00Z + 2024-08-01T14:30:00Z + 1.1 + 1.1.2 + SSP-2024-002 + + + + Authorizing Official + +

Senior official with authority to formally assume responsibility for operating a system at an acceptable level of risk.

+ + + + Prepared By + +

This party prepared the SSP.

+ + + + Prepared For + +

The organization for which this SSP was prepared. Typically the CSP.

+ + + + Document Creator + + + Content Approver + + + System Administrator + + + Asset Owner + + + System Owner + + + Authorizing Official Point of Contact + + + Information System Security Officer (or Equivalent) + + + Information System Management Point of Contact (POC) + +

The highest level manager who is responsible for system operation on behalf of the System Owner.

+ + + + Information System Technical Point of Contact + +

The individual or individuals leading the technical operation of the system.

+ + + + General Point of Contact (POC) + +

A general point of contact for the system, designated by the system owner.

+ + + + + CSP HQ +
+ Suite 0000 + 1234 Some Street + Haven + ME + 00000 + US +
+ + +
+ US +
+ + + +
+ US +
+ + + + Person Name 1 + + + name@example.com + 2020000001 + 27b78960-59ef-4619-82b0-ae20b9c709ac + 6b286b5d-8f07-4fa7-8847-1dd0d88f73fb + + + Cloud Service Provider (CSP) Name + CSP Acronym/Short Name + + 27b78960-59ef-4619-82b0-ae20b9c709ac + + + Example Organization + ExOrg + + + + Jane Doe + jane.doe@example.com +
+ + + + 3360e343-9860-4bda-9dfc-ff427c3dfab6 + + + 6b286b5d-8f07-4fa7-8847-1dd0d88f73fb + + + 11111111-0000-4000-9000-000000000001 + + + 22222222-0000-4000-9000-000000000002 + + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + 22222222-0000-4000-9000-000000000002 + + + +

This SSP is an example for demonstration purposes.

+ + + + + + + F00000001 + Enhanced Example System + System's Short Name or Acronym + +

This is an enhanced example system for demonstration purposes, incorporating more FedRAMP-specific elements.

+ + + +

Remarks are required if deployment model is "hybrid-cloud" or "other". Optional otherwise.

+ + + + +

Remarks are required if service model is "other". Optional otherwise.

+ + + + + + + + fips-199-moderate + + + Financial Information + +

Contains sensitive financial data related to organizational operations.

+ + + C.2.8.12 + + + fips-199-high + fips-199-high + + + + fips-199-moderate + fips-199-low + +

Required if the base and selected values do not match.

+ + + + fips-199-high + fips-199-low + +

Required if the base and selected values do not match.

+ + + + + + fips-199-moderate + fips-199-moderate + fips-199-moderate + + + + +

The authorization boundary includes all components within the main data center and the disaster recovery site.

+ + + +

A diagram-specific explanation.

+ + + Authorization Boundary Diagram + + + + +

A holistic, top-level explanation of the network architecture.

+ + + +

A diagram-specific explanation.

+ + + Network Diagram + + + + +

A holistic, top-level explanation of the system's data flows.

+ + + +

A diagram-specific explanation.

+ + + Data Flow Diagram + + + + + + + GovCloud + + + + f0bc13a4-3303-47dd-80d3-380e159c8362 + 2020-01-01 + + + System Administrator + + + + system-admin + + Admin +

admin user

 + administration + + + + + + Primary Application Server + +

Main application server hosting the core system functionality.

+ + main line + + + 11111111-0000-4000-9000-000000000001 + + +

This is the primary application server for the system.

+ + + + + External API Connection + +

Secure connection to an external API for data enrichment.

+ + + + + + 11111111-0000-4000-9000-000000000001 + + +

This connection is used for secure data exchange with external systems.

+ + + + + +

Primary database server

+ + + + + + + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + +

Secondary database server

+ + + + + + + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + + + +

Implementation of controls for the Enhanced Example System

+ + + + + + + + +

Access Control Policy and Procedures (AC-1) is fully implemented in our system.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + + + +

Information System Component Inventory (CM-8) is partially implemented.

+ + + + 11111111-0000-4000-9000-000000000001 + + + + + + + + Access Control Policy + +

Detailed access control policy document

+ + + + + + User's Guide + +

User's Guide

+ + + + + +

Table 12-1 Attachments: User's Guide Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Rules of Behavior

+ + + + + + 00000000 + +

Table 12-1 Attachments: Rules of Behavior (ROB)

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Contingency Plan (CP)

+ + + + + + 00000000 + +

Table 12-1 Attachments: Contingency Plan (CP) Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Configuration Management (CM) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Configuration Management (CM) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Document Title + +

Incident Response (IR) Plan

+ + + + + + 00000000 + +

Table 12-1 Attachments: Incident Response (IR) Plan Attachment

+

May use rlink with a relative path, or embedded as base64.

+ + + + Separation of Duties Matrix + +

Separation of Duties Matrix

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + + Authorization Boundary + +

Authorization Boundary Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + Network Architecture + +

Network Architecture Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + + Data Flow + +

Data flow Diagram

+ + + + + + 00000000 + +

May use rlink with a relative path, or embedded as base64.

+ + + + \ No newline at end of file diff --git a/src/validations/constraints/fedramp-external-constraints.xml b/src/validations/constraints/fedramp-external-constraints.xml index a452a3f5a..ba6ba7509 100644 --- a/src/validations/constraints/fedramp-external-constraints.xml +++ b/src/validations/constraints/fedramp-external-constraints.xml @@ -61,6 +61,12 @@ + Component Has Authentication Method @@ -93,7 +99,12 @@

A FedRAMP SSP MUST use a valid FedRAMP catalog to reference security controls. It MUST NOT reference controls from a non-FedRAMP catalog.

 - + + + Leveraged Authorization Has Valid Impact Level + + A FedRAMP SSP MUST define the appropriate FIPS-199 impact level (low, moderate, or high) for each leveraged authorization. + diff --git a/src/validations/constraints/unit-tests/leveraged-authorization-has-valid-impact-level-FAIL.yaml b/src/validations/constraints/unit-tests/leveraged-authorization-has-valid-impact-level-FAIL.yaml new file mode 100644 index 000000000..e627b71ee --- /dev/null +++ b/src/validations/constraints/unit-tests/leveraged-authorization-has-valid-impact-level-FAIL.yaml @@ -0,0 +1,9 @@ +test-case: + name: Negative Test for leveraged-authorization-has-valid-impact-level + description: >- + This test case validates the behavior of constraint + leveraged-authorization-matches-impact-level + content: ../content/ssp-leveraged-authorization-has-valid-impact-level-INVALID.xml + expectations: + - constraint-id: leveraged-authorization-has-valid-impact-level + result: fail diff --git a/src/validations/constraints/unit-tests/leveraged-authorization-has-valid-impact-level-PASS.yaml b/src/validations/constraints/unit-tests/leveraged-authorization-has-valid-impact-level-PASS.yaml new file mode 100644 index 000000000..4bedfcc9a --- /dev/null +++ b/src/validations/constraints/unit-tests/leveraged-authorization-has-valid-impact-level-PASS.yaml @@ -0,0 +1,12 @@ +test-case: + name: Positive Test for leveraged-authorization-has-valid-impact-level + description: >- + This test case validates the behavior of constraint leveraged-authorization-has-valid-impact-level. + Scenario 1: Security-sensitivity-level = 'fips-199-moderate' and leveraged-authorization impact-level = 'fips-199-moderate'. + Scenario 2: Security-sensitivity-level = 'fips-199-moderate' and leveraged-authorization impact-level = 'fips-199-high'. + content: + - ../content/ssp-all-VALID.xml + - ../content/ssp-leveraged-authorization-has-valid-impact-level-VALID.xml + expectations: + - constraint-id: leveraged-authorization-has-valid-impact-level + result: pass