From 3c72868569b89ad997a7f24c151f58593ea7f22e Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Fri, 12 Aug 2022 11:11:46 -0400 Subject: [PATCH] Week 30 feedback on SSP model. (#49) --- .../oscal_implementation-common_metaschema.xml | 7 +++++++ src/metaschema/oscal_ssp_metaschema.xml | 16 ++++++++++++---- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/src/metaschema/oscal_implementation-common_metaschema.xml b/src/metaschema/oscal_implementation-common_metaschema.xml index 199eb552ee..f9c7602ffa 100644 --- a/src/metaschema/oscal_implementation-common_metaschema.xml +++ b/src/metaschema/oscal_implementation-common_metaschema.xml @@ -665,6 +665,13 @@ System Identification + A human-oriented, globally unique identifier with cross-instance scope that can be used to reference this system identification property elsewhere in this or other OSCAL instances. When referencing an externally defined system identification, the system identification must be used in the context of the external / imported OSCAL instance (e.g., uri-reference). This string should be assigned per-subject, which means it should be consistently used to identify the same system across revisions of the document. id diff --git a/src/metaschema/oscal_ssp_metaschema.xml b/src/metaschema/oscal_ssp_metaschema.xml index e6bee63bfc..373e742352 100644 --- a/src/metaschema/oscal_ssp_metaschema.xml +++ b/src/metaschema/oscal_ssp_metaschema.xml @@ -62,7 +62,7 @@

If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified resource in the document's back-matter or another object that is within the scope of the containing OSCAL document. The identified resource will be used instead as the target resource.

If an internet resource is used, the href value will be an absolute or relative URI pointing to the location of the target resource. A relative URI will be resolved relative to the location of the document containing the link.

-

If the resource is an OSCAL profile, it is expected that a tool will resolve the profile according to the OSCAL [profile resolution specification](https://pages.nist.gov/OSCAL/concepts/processing/profile-resolution/) to produce a resolved profile for use when processing the containing system security plan. This allows a system security plan processor to use the baseline as a catalog of controls.

+

If the resource is an OSCAL profile, it is expected that a tool will resolve the profile according to the OSCAL profile resolution specification to produce a resolved profile for use when processing the containing system security plan. This allows a system security plan processor to use the baseline as a catalog of controls.

While it is possible to reference a previously resolved OSCAL profile as a catalog, this practice is discouraged since the unresolved form of the profile communicates more information about selections and changes to the underlying catalog. Furthermore, the underlying catalog can be maintained separately from the profile, which also has maintenance advantages for distinct maintainers, ensuring that the best available information is produced through profile resolution.

 @@ -88,6 +88,9 @@ System Name - Short A short name for the system, such as an acronym, that is suitable for display in a data table or summary list. + +

Since system-name-short is optional, if the system-name-short is not provided, the system-name can be used as a substitute.

+ System Description @@ -304,6 +307,10 @@ + A 'low' sensitivity level as defined in FIPS-199. @@ -334,18 +341,19 @@ Security Impact Level The overall level of expected impact resulting from unauthorized disclosure, modification, or loss of access to information. + - Security Objective: Confidentiality A target-level of confidentiality for the system, based on the sensitivity of information within the system. - Security Objective: Integrity A target-level of integrity for the system, based on the sensitivity of information within the system. - Security Objective: Availability A target-level of availability for the system, based on the sensitivity of information within the system.