oscal_ssp_metaschema.xml

<?xml version="1.0" encoding="UTF-8"?>
<!-- ** NOTES **
- Need to check latest FR SSP template for "Privacy Impact Designation".
  Was it dropped in latest template, or is it missing from schema?
-->
<!-- OSCAL Implementation Layer: System Security Plan (SSP) METASCHEMA -->
<!-- validate with XSD and Schematron (linked) -->
<!DOCTYPE METASCHEMA [
  <!ENTITY allowed-values-responsible-roles-system SYSTEM "./shared-constraints/allowed-values-responsible-roles-system.ent">
  <!ENTITY allowed-values-responsible-roles-operations SYSTEM "./shared-constraints/allowed-values-responsible-roles-operations.ent">
  <!ENTITY allowed-values-responsible-roles-component-production SYSTEM "./shared-constraints/allowed-values-responsible-roles-component-production.ent">
]>
<METASCHEMA xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns="http://csrc.nist.gov/ns/oscal/metaschema/1.0" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/metaschema/1.0 ../../build/metaschema/toolchains/xslt-M4/validate/metaschema.xsd">
  <schema-name>OSCAL System Security Plan (SSP) Model</schema-name>
  <schema-version>1.0.1</schema-version>
  <short-name>oscal-ssp</short-name>
  <namespace>http://csrc.nist.gov/ns/oscal/1.0</namespace>
  <json-base-uri>http://csrc.nist.gov/ns/oscal</json-base-uri>
  <remarks>
    <p>The OSCAL Control SSP format can be used to describe the information typically specified in a system security plan, such as those defined in NIST SP 800-18.</p>
    <p>The root of the OSCAL System Security Plan (SSP) format is <code>system-security-plan</code>.</p>
  </remarks>

  <import href="oscal_metadata_metaschema.xml"/>
  <import href="oscal_implementation-common_metaschema.xml"/>

  <!-- ############################################## -->
  <!-- # The SSP Assembly and supporting constructs # -->
  <!-- ############################################## -->
  <define-assembly name="system-security-plan">
    <formal-name>System Security Plan (SSP)</formal-name>
    <description>A system security plan, such as those described in NIST SP 800-18</description>
    <root-name>system-security-plan</root-name>
    <define-flag name="uuid" as-type="uuid" required="yes">
      <formal-name>System Security Plan Universally Unique Identifier</formal-name>
      <!-- Identifier Declaration -->
      <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this system security plan (SSP) elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>SSP</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance).This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
    </define-flag>
    <model>
      <assembly ref="metadata" min-occurs="1"/>
      <assembly ref="import-profile" min-occurs="1"/>
      <assembly ref="system-characteristics" min-occurs="1"/>
      <assembly ref="system-implementation" min-occurs="1"/>
      <assembly ref="control-implementation" min-occurs="1"/>
      <assembly ref="back-matter"/>
    </model>
  </define-assembly>

  <!-- ######################################################### -->
  <!-- # The Import Profile Assembly and supporting constructs # -->
  <!-- ######################################################### -->
  <define-assembly name="import-profile">
    <formal-name>Import Profile</formal-name>
    <description>Used to import the OSCAL profile representing the system's control baseline.</description>
    <define-flag name="href" as-type="uri-reference" required="yes">
      <formal-name>Profile Reference</formal-name>
      <description>A resolvable URL reference to the profile to use as the system's control baseline.</description>
      <remarks>
        <p>The value of the <code>href</code> can be an internet resource, or a local reference using a fragment e.g. #fragment that points to a <code>back-matter</code>
          <code>resource</code> in the same document.</p>
        <!-- TODO: Add a link to "within the scope of the containing OSCAL document" to point to documentation of identification scopes" -->
        <p>If a local reference using a fragment is used, this will be indicated by a fragment "#" followed by an identifier which references an identified <code>resource</code> in the document's <code>back-matter</code> or another object that is within the scope of the containing OSCAL document.</p>
        <p>If an internet resource is used, the <code>href</code> value will be an absolute or relative URI pointing to the location of the referenced resource. A relative URI will be resolved relative to the location of the document containing the link.</p>
      </remarks>
    </define-flag>
    <model>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
  </define-assembly>

  <!-- ################################################################# -->
  <!-- # The System Characteristics Assembly and supporting constructs # -->
  <!-- ################################################################# -->
  <define-assembly name="system-characteristics">
    <formal-name>System Characteristics</formal-name>
    <description>Contains the characteristics of the system, such as its name, purpose, and security impact level.</description>
    <model>
      <field ref="system-id" min-occurs="1" max-occurs="unbounded">
        <group-as name="system-ids" in-json="ARRAY"/>
      </field>
      <define-field name="system-name" as-type="string" min-occurs="1">
        <formal-name>System Name - Full</formal-name>
        <description>The full name of the system.</description>
      </define-field>
      <define-field name="system-name-short" as-type="string">
        <formal-name>System Name - Short</formal-name>
        <description>A short name for the system, such as an acronym, that is suitable for display in a data table or summary list.</description>
      </define-field>
      <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
        <formal-name>System Description</formal-name>
        <description>A summary of the system.</description>
      </define-field>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
      </assembly>
      <field ref="date-authorized"/>
      <define-field name="security-sensitivity-level" min-occurs="1">
        <formal-name>Security Sensitivity Level</formal-name>
        <description>The overall information system sensitivity categorization, such as defined by <a href="https://doi.org/10.6028/NIST.FIPS.199">FIPS-199</a>.
        </description>
        <remarks>
          <p>Often, organizations require the security sensitivity level to correspond with the highest confidentiality, integrity, or availability level identified by <code>security-impact-level</code>.
          </p>
        </remarks>
      </define-field>
      <assembly ref="system-information" min-occurs="1"/>
      <assembly ref="security-impact-level" min-occurs="1"/>
      <assembly ref="status" min-occurs="1"/>
      <assembly ref="authorization-boundary" min-occurs="1"/>
      <assembly ref="network-architecture"/>
      <assembly ref="data-flow"/>
      <assembly ref="responsible-party" max-occurs="unbounded">
        <group-as name="responsible-parties" in-json="ARRAY"/>
      </assembly>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <allowed-values target="prop/@name" allow-other="yes">
        <enum value="identity-assurance-level">A value of 1, 2, or 3 as defined by <a href="https://doi.org/10.6028/NIST.SP.800-63-3">SP 800-63-3</a>.
        </enum>
        <enum value="authenticator-assurance-level">A value of 1, 2, or 3 as defined by <a href="https://doi.org/10.6028/NIST.SP.800-63-3">SP 800-63-3</a>.
        </enum>
        <enum value="federation-assurance-level">A value of 1, 2, or 3 as defined by <a href="https://doi.org/10.6028/NIST.SP.800-63-3">SP 800-63-3</a>.
        </enum>
      </allowed-values>
      <allowed-values target="prop[@name=('identity-assurance-level','authenticator-assurance-level','federation-assurance-level')]/@value">
        <enum value="1">As defined by <a href="https://doi.org/10.6028/NIST.SP.800-63-3">SP 800-63-3</a>.
        </enum>
        <enum value="2">As defined by <a href="https://doi.org/10.6028/NIST.SP.800-63-3">SP 800-63-3</a>.
        </enum>
        <enum value="3">As defined by <a href="https://doi.org/10.6028/NIST.SP.800-63-3">SP 800-63-3</a>.
        </enum>
      </allowed-values>
      <allowed-values target="prop/@name" allow-other="yes">
        <enum value="cloud-deployment-model">The associated value is one of: public-cloud, private-cloud, community-cloud, government-only-cloud, hybrid-cloud, or other.</enum>
        <enum value="cloud-service-model">The associated value is one of: saas, paas, iaas, or other.</enum>
      </allowed-values>
      <allowed-values target="prop[@name='cloud-deployment-model']/@value">
        <enum value="public-cloud">The public cloud deployment model as defined by <a href="https://doi.org/10.6028/NIST.SP.800-145">The NIST Definition of Cloud Computing</a>.
        </enum>
        <enum value="private-cloud">The private cloud deployment model as defined by <a href="https://doi.org/10.6028/NIST.SP.800-145">The NIST Definition of Cloud Computing</a>.
        </enum>
        <enum value="community-cloud">The community cloud deployment model as defined by <a href="https://doi.org/10.6028/NIST.SP.800-145">The NIST Definition of Cloud Computing</a>.
        </enum>
        <!-- TODO: consider generalizing this in a way that applies to other usage contexts. -->
        <enum value="government-only-cloud">A specific type of community-cloud for use only by government services.</enum>
        <enum value="other">Any other type of cloud deployment model that is exclusive to the other choices.</enum>
        <remarks>
          <p>The hybrid cloud deployment model, as defined by <a href="https://doi.org/10.6028/NIST.SP.800-145">The NIST Definition of Cloud Computing</a>, can be supported by selecting two or more of the existing deployment models.</p>
        </remarks>
      </allowed-values>
      <allowed-values target="prop[@name='cloud-service-model']/@value">
        <enum value="saas">Software as a service (SaaS) cloud service model as defined by <a href="https://doi.org/10.6028/NIST.SP.800-145">The NIST Definition of Cloud Computing</a>.
        </enum>
        <enum value="paas">Platform as a service (PaaS) cloud service model as defined by <a href="https://doi.org/10.6028/NIST.SP.800-145">The NIST Definition of Cloud Computing</a>.
        </enum>
        <enum value="iaas">Infrastructure as a service (IaaS) cloud service model as defined by <a href="https://doi.org/10.6028/NIST.SP.800-145">The NIST Definition of Cloud Computing</a>.
        </enum>
        <enum value="other">Any other type of cloud service model that is exclusive to the other choices.</enum>
      </allowed-values>
      <is-unique id="unique-ssp-system-characteristics-responsible-party" target="responsible-party">
        <key-field target="@role-id"/>
        <remarks>
          <p>Since <code>responsible-party</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
        </remarks>
      </is-unique>
      <allowed-values target="responsible-party/@role-id" allow-other="yes">
            &allowed-values-responsible-roles-system;
      </allowed-values>
    </constraint>
  </define-assembly>
  <define-assembly name="system-information">
    <formal-name>System Information</formal-name>
    <description>Contains details about all information types that are stored, processed, or transmitted by the system, such as privacy information, and those defined in <a href="https://doi.org/10.6028/NIST.SP.800-60v2r1">NIST SP 800-60</a>.
    </description>
    <model>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
      </assembly>
      <define-assembly name="information-type" min-occurs="1" max-occurs="unbounded">
        <formal-name>Information Type</formal-name>
        <description>Contains details about one information type that is stored, processed, or transmitted by the system, such as privacy information, and those defined in <a href="https://doi.org/10.6028/NIST.SP.800-60v2r1">NIST SP 800-60</a>.
        </description>
        <group-as name="information-types" in-json="ARRAY"/>
        <define-flag name="uuid" as-type="uuid">
          <formal-name>Information Type Universally Unique Identifier</formal-name>
          <!-- Identifier Declaration -->
          <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this information type elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>information type</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
        </define-flag>
        <model>
          <define-field name="title" as-type="markup-line" min-occurs="1">
            <formal-name>title field</formal-name>
            <description>A human readable name for the information type. This title should be meaningful within the context of the system.</description>
          </define-field>
          <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
            <formal-name>Information Type Description</formal-name>
            <description>A summary of how this information type is used within the system.</description>
          </define-field>
          <define-assembly name="categorization" max-occurs="unbounded">
            <!-- CHANGED: replaced the information-type-id structure with the current structure -->
            <formal-name>Information Type Categorization</formal-name>
            <description>A set of information type identifiers qualified by the given identification <code>system</code> used, such as NIST SP 800-60.</description>
            <group-as name="categorizations" in-json="ARRAY"/>
            <define-flag name="system" as-type="uri" required="yes">
              <formal-name>Information Type Identification System</formal-name>
              <description>Specifies the information type identification system used.</description>
              <constraint>
                <allowed-values allow-other="yes">
                  <enum value="https://doi.org/10.6028/NIST.SP.800-60v2r1">Based on the section identifiers in NIST <a href="https://doi.org/10.6028/NIST.SP.800-60v2r1">Special Publication 800-60 Volume II Revision 1</a>.
                  </enum>
                </allowed-values>
              </constraint>
            </define-flag>
            <model>
              <define-field name="information-type-id" as-type="string" max-occurs="unbounded">
                <!-- This is an id because the idenfier is assigned and managed externally by humans. -->
                <formal-name>Information Type Systematized Identifier</formal-name>
                <!-- Identifier Declaration -->
                <description>A <a href="/concepts/identifier-use/#human-oriented">human-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier qualified by the given identification <code>system</code> used, such as NIST SP 800-60.  This identifier has <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope and can be used to reference this system elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. This id should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
                <json-value-key>id</json-value-key>
                <group-as name="information-type-ids" in-json="ARRAY"/>
              </define-field>
            </model>
          </define-assembly>
          <assembly ref="property" max-occurs="unbounded">
            <group-as name="props" in-json="ARRAY"/>
          </assembly>
          <assembly ref="link" max-occurs="unbounded">
            <group-as name="links" in-json="ARRAY"/>
          </assembly>
          <define-assembly name="confidentiality-impact" min-occurs="1">
            <formal-name>Confidentiality Impact Level</formal-name>
            <description>The expected level of impact resulting from the unauthorized disclosure of the described information.</description>
            <model>
              <assembly ref="property" max-occurs="unbounded">
                <group-as name="props" in-json="ARRAY"/>
              </assembly>
              <assembly ref="link" max-occurs="unbounded">
                <group-as name="links" in-json="ARRAY"/>
              </assembly>
              <field ref="base" min-occurs="1"/>
              <field ref="selected"/>
              <field ref="adjustment-justification" in-xml="WITH_WRAPPER"/>
            </model>
          </define-assembly>
          <define-assembly name="integrity-impact" min-occurs="1">
            <formal-name>Integrity Impact Level</formal-name>
            <description>The expected level of impact resulting from the unauthorized modification of the described information.</description>
            <model>
              <assembly ref="property" max-occurs="unbounded">
                <group-as name="props" in-json="ARRAY"/>
              </assembly>
              <assembly ref="link" max-occurs="unbounded">
                <group-as name="links" in-json="ARRAY"/>
              </assembly>
              <field ref="base" min-occurs="1"/>
              <field ref="selected"/>
              <field ref="adjustment-justification" in-xml="WITH_WRAPPER"/>
            </model>
          </define-assembly>
          <define-assembly name="availability-impact" min-occurs="1">
            <formal-name>Availability Impact Level</formal-name>
            <description>The expected level of impact resulting from the disruption of access to or use of the described information or the information system.</description>
            <model>
              <assembly ref="property" max-occurs="unbounded">
                <group-as name="props" in-json="ARRAY"/>
              </assembly>
              <assembly ref="link" max-occurs="unbounded">
                <group-as name="links" in-json="ARRAY"/>
              </assembly>
              <field ref="base" min-occurs="1"/>
              <field ref="selected"/>
              <field ref="adjustment-justification" in-xml="WITH_WRAPPER"/>
            </model>
          </define-assembly>
        </model>
        <constraint>
          <expect level="WARNING" target="." test="@uuid">
            <message>It is a best practice to provide a UUID.</message>
          </expect>
        </constraint>
      </define-assembly>
    </model>
    <constraint>
      <allowed-values target="prop/@name" allow-other="yes">
        <enum value="privacy-designation">Is this a privacy sensitive system? yes or no</enum>
      </allowed-values>
      <allowed-values target="prop[@name='privacy-designation']/@value">
        <enum value="yes">The system is privacy sensitive.</enum>
        <enum value="no">The system isnot privacy sensitive.</enum>
      </allowed-values>
      <allowed-values target="link/@rel">
        <enum value="privacy-impact-assessment">A link to the privacy impact assessment.</enum>
      </allowed-values>
      <matches target="link[@rel='privacy-impact-assessment']/@href[starts-with(.,'#')]" datatype="uri-reference"/>
      <index-has-key name="index-back-matter-resource" target="link[@rel='privacy-impact-assessment' and starts-with(@href,'#')]">
        <key-field target="@href" pattern="#(.*)"/>
      </index-has-key>
      <matches target="link[@rel='privacy-impact-assessment']/@href[not(starts-with(.,'#'))]" datatype="uri"/>
      <allowed-values target="information-type/(confidentiality-impact|integrity-impact|availability-impact)/(base|selected)">
        <enum value="fips-199-low">A 'low' sensitivity level as defined in <a href="https://doi.org/10.6028/NIST.FIPS.199">FIPS-199</a>.
        </enum>
        <enum value="fips-199-moderate">A 'moderate' sensitivity level as defined in <a href="https://doi.org/10.6028/NIST.FIPS.199">FIPS-199</a>.
        </enum>
        <enum value="fips-199-high">A 'high' sensitivity level as defined in <a href="https://doi.org/10.6028/NIST.FIPS.199">FIPS-199</a>.
        </enum>
        <remarks>
          <p>FIPS-199 taxonomy is provided here as a starting point. We will provide other taxonomies based on community requests.</p>
        </remarks>
      </allowed-values>
    </constraint>
  </define-assembly>
  <define-field name="base" as-type="string" scope="local">
    <formal-name>Base Level (Confidentiality, Integrity, or Availability)</formal-name>
    <description>The prescribed base (Confidentiality, Integrity, or Availability) security impact level.</description>
  </define-field>
  <define-field name="selected" as-type="string" scope="local">
    <formal-name>Selected Level (Confidentiality, Integrity, or Availability)</formal-name>
    <description>The selected (Confidentiality, Integrity, or Availability) security impact level.</description>
  </define-field>
  <define-field name="adjustment-justification" as-type="markup-multiline" scope="local">
    <formal-name>Adjustment Justification</formal-name>
    <description>If the selected security level is different from the base security level, this contains the justification for the change.</description>
  </define-field>
  <define-assembly name="security-impact-level">
    <formal-name>Security Impact Level</formal-name>
    <description>The overall level of expected impact resulting from unauthorized disclosure, modification, or loss of access to information.</description>
    <model>
      <define-field name="security-objective-confidentiality" as-type="string" min-occurs="1">
        <!-- CHANGED: cardinality to min 1 -->
        <formal-name>Security Objective: Confidentiality</formal-name>
        <description>A target-level of confidentiality for the system, based on the sensitivity of information within the system.</description>
      </define-field>
      <define-field name="security-objective-integrity" as-type="string" min-occurs="1">
        <!-- CHANGED: cardinality to min 1 -->
        <formal-name>Security Objective: Integrity</formal-name>
        <description>A target-level of integrity for the system, based on the sensitivity of information within the system.</description>
      </define-field>
      <define-field name="security-objective-availability" as-type="string" min-occurs="1">
        <!-- CHANGED: cardinality to min 1 -->
        <formal-name>Security Objective: Availability</formal-name>
        <description>A target-level of availability for the system, based on the sensitivity of information within the system.</description>
      </define-field>
    </model>
  </define-assembly>
  <define-assembly name="status" scope="local">
    <formal-name>Status</formal-name>
    <description>Describes the operational status of the system.</description>
    <define-flag name="state" required="yes" as-type="string">
      <formal-name>State</formal-name>
      <description>The current operating status.</description>
      <constraint>
        <allowed-values>
          <enum value="operational">The system is currently operating in production.</enum>
          <enum value="under-development">The system is being designed, developed, or implemented</enum>
          <enum value="under-major-modification">The system is undergoing a major change, development, or transition.</enum>
          <enum value="disposition">The system is no longer operational.</enum>
          <enum value="other">Some other state.</enum>
        </allowed-values>
      </constraint>
    </define-flag>
    <model>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <remarks>
      <p>If 'other' is selected, a remark must be included to describe the current state.</p>
    </remarks>
  </define-assembly>
  <define-field name="date-authorized" as-type="date" scope="local">
    <formal-name>System Authorization Date</formal-name>
    <description>The date the system received its authorization.</description>
  </define-field>
  <define-assembly name="authorization-boundary">
    <formal-name>Authorization Boundary</formal-name>
    <description>A description of this system's authorization boundary, optionally supplemented by diagrams that illustrate the authorization boundary.</description>
    <model>
      <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
        <formal-name>Authorization Boundary Description</formal-name>
        <description>A summary of the system's authorization boundary.</description>
      </define-field>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
        <!-- TODO: Model specific link relationships? -->
      </assembly>
      <assembly ref="diagram" max-occurs="unbounded">
        <group-as name="diagrams" in-json="ARRAY"/>
        <remarks>
          <p>A visual depiction of the system's authorization boundary.</p>
        </remarks>
      </assembly>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <is-unique id="unique-ssp-authorization-boundary-diagram" target="diagram">
        <key-field target="@uuid"/>
        <remarks>
          <p>A given <code>uuid</code> must be assigned only once to a diagram.</p>
        </remarks>
      </is-unique>
    </constraint>
  </define-assembly>
  <define-assembly name="diagram">
    <formal-name>Diagram</formal-name>
    <description>A graphic that provides a visual representation the system, or some aspect of it.</description>
    <define-flag name="uuid" as-type="uuid" required="yes">
      <formal-name>Diagram ID</formal-name>
      <!-- Identifier Declaration -->
      <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this diagram elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>diagram</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
    </define-flag>
    <model>
      <define-field name="description" as-type="markup-multiline" in-xml="WITH_WRAPPER">
        <formal-name>Diagram Description</formal-name>
        <description>A summary of the diagram.</description>
        <remarks>
          <p>This description is intended to be used as alternate text to support compliance with requirements from <a href="https://www.section508.gov/manage/laws-and-policies">Section 508 of the United States Workforce Rehabilitation Act of 1973</a>.
          </p>
        </remarks>
      </define-field>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
      </assembly>
      <define-field name="caption" as-type="markup-line">
        <formal-name>Caption</formal-name>
        <description>A brief caption to annotate the diagram.</description>
      </define-field>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <allowed-values target="link/@rel">
        <enum value="diagram">A reference to the diagram image.</enum>
      </allowed-values>
      <matches target="link[@rel='diagram']/@href[starts-with(.,'#')]" datatype="uri-reference"/>
      <index-has-key name="index-back-matter-resource" target="link[@rel='diagram' and starts-with(@href,'#')]">
        <key-field target="@href" pattern="#(.*)"/>
      </index-has-key>
      <matches target="link[@rel='diagram']/@href[not(starts-with(.,'#'))]" datatype="uri"/>
    </constraint>
    <remarks>
      <p>A diagram must include a <code>link</code> with a rel value of "diagram", who's href references a remote URI or an internal reference within this document containing the diagram.</p>
    </remarks>
    <example>
      <remarks>
        <p>The internal reference "#diagram1" points to an attached resource defined in the <code>back-matter</code> as a <code>resource</code>. The <code>media-type</code> indicates that the image is a Portable Network Graphics (PNG) image.</p>
      </remarks>
      <o:diagram xmlns:o="http://csrc.nist.gov/ns/oscal/example" id="boundary-diagram-1">
        <o:description>A boundary diagram.</o:description>
        <o:link rel="diagram" href="#diagram1" media-type="image/png"/>
      </o:diagram>
    </example>
  </define-assembly>
  <define-assembly name="network-architecture">
    <formal-name>Network Architecture</formal-name>
    <description>A description of the system's network architecture, optionally supplemented by diagrams that illustrate the network architecture.</description>
    <model>
      <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
        <formal-name>Network Architecture Description</formal-name>
        <description>A summary of the system's network architecture.</description>
      </define-field>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
        <!-- TODO: Model specific link relationships? -->
      </assembly>
      <assembly ref="diagram" max-occurs="unbounded">
        <group-as name="diagrams" in-json="ARRAY"/>
      </assembly>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <is-unique id="unique-ssp-network-architecture-diagram" target="diagram">
        <key-field target="@uuid"/>
        <remarks>
          <p>A given <code>uuid</code> must be assigned only once to a diagram.</p>
        </remarks>
      </is-unique>
    </constraint>
    
  </define-assembly>
  <define-assembly name="data-flow">
    <formal-name>Data Flow</formal-name>
    <description>A description of the logical flow of information within the system and across its boundaries, optionally supplemented by diagrams that illustrate these flows.</description>
    <model>
      <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
        <formal-name>Data Flow Description</formal-name>
        <description>A summary of the system's data flow.</description>
      </define-field>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
        <!-- TODO: Model specific link relationships? -->
      </assembly>
      <assembly ref="diagram" max-occurs="unbounded">
        <group-as name="diagrams" in-json="ARRAY"/>
      </assembly>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <is-unique id="unique-ssp-data-flow-diagram" target="diagram">
        <key-field target="@uuid"/>
        <remarks>
          <p>A given <code>uuid</code> must be assigned only once to a diagram.</p>
        </remarks>
      </is-unique>
    </constraint>
  </define-assembly>

  <!-- ################################################################ -->
  <!-- # The System Implementation Assembly and supporting constructs # -->
  <!-- ################################################################ -->
  <define-assembly name="system-implementation">
    <formal-name>System Implementation</formal-name>
    <description>Provides information as to how the system is implemented.</description>
    <model>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
        <!-- TODO: Model specific link relationships? -->
      </assembly>
      <define-assembly name="leveraged-authorization" max-occurs="unbounded">
        <formal-name>Leveraged Authorization</formal-name>
        <description>A description of another authorized system from which this system inherits capabilities that satisfy security requirements. Another term for this concept is a <em>common control provider</em>.
        </description>
        <group-as name="leveraged-authorizations" in-json="ARRAY"/>
        <define-flag name="uuid" as-type="uuid" required="yes">
          <formal-name>Leveraged Authorization Universally Unique Identifier</formal-name>
          <!-- Identifier Declaration -->
          <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope and can be used to reference this leveraged authorization elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>leveraged authorization</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
        </define-flag>
        <model>
          <define-field name="title" as-type="markup-line" min-occurs="1">
            <formal-name>title field</formal-name>
            <description>A human readable name for the leveraged authorization in the context of the system.</description>
          </define-field>
          <assembly ref="property" max-occurs="unbounded">
            <group-as name="props" in-json="ARRAY"/>
          </assembly>
          <assembly ref="link" max-occurs="unbounded">
            <group-as name="links" in-json="ARRAY"/>
          </assembly>
          <define-field name="party-uuid" as-type="uuid" min-occurs="1">
            <formal-name>party-uuid field</formal-name>
            <!-- Identifier Reference -->
            <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to the  <code>party</code> that manages the leveraged system.</description>
          </define-field>
          <field ref="date-authorized" min-occurs="1"/>
          <field ref="remarks" in-xml="WITH_WRAPPER"/>
        </model>
        <constraint>
          <allowed-values target="link/@rel">
            <enum value="system-security-plan">A reference to the system security plan for the leveraged authorization.</enum>
          </allowed-values>
          <matches target="link[@rel='system-security-plan']/@href[starts-with(.,'#')]" datatype="uri-reference"/>
          <index-has-key name="index-back-matter-resource" target="link[@rel='system-security-plan' and starts-with(@href,'#')]">
            <key-field target="@href" pattern="#(.*)"/>
          </index-has-key>
          <matches target="link[@rel='system-security-plan']/@href[not(starts-with(.,'#'))]" datatype="uri"/>
        </constraint>
      </define-assembly>

      <assembly ref="system-user" min-occurs="1" max-occurs="unbounded">
        <use-name>user</use-name>
        <group-as name="users" in-json="ARRAY"/>
      </assembly>
      <assembly ref="system-component" min-occurs="1" max-occurs="unbounded">
        <use-name>component</use-name>
        <group-as name="components" in-json="ARRAY"/>
      </assembly>
      <!--         <assembly ref="capability" max-occurs="unbounded">
            <group-as name="capabilities" in-json="BY_KEY"/>
         </assembly>
         -->
      <assembly ref="inventory-item" min-occurs="0" max-occurs="unbounded">
        <group-as name="inventory-items" in-json="ARRAY"/>
        <remarks>
          <p>A set of <code>inventory-item</code> entries that represent the managed inventory instances of the system.</p>
        </remarks>
      </assembly>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <!-- TODO: future: for FedRAMP, have user counts as props: current/internal, current/external, future/internal, future, external -->
      <index name="index-system-implementation-leveraged-authorization-uuid" target="leveraged-authorization">
        <key-field target="@uuid"/>
      </index>
      <index-has-key name="index-system-implementation-leveraged-authorization-uuid" target="component/prop[@name='leveraged-authorization-uuid']">
        <key-field target="@value"/>
      </index-has-key>

      <!-- References to components -->
      <index name="index-system-implementation-component-uuid" target="component">
        <key-field target="@uuid"/>
      </index>
      <index-has-key name="index-system-implementation-component-uuid" target="component/link[@rel='depends-on']">
        <key-field target="@href"/>
      </index-has-key>

      <!-- References to components of @type="validation" -->
      <index name="index-system-implementation-component-uuid-validation" target="component[@type='validation']">
        <key-field target="@uuid"/>
      </index>
      <index-has-key name="index-system-implementation-component-uuid-validation" target="component/link[@rel='validated-by']">
        <key-field target="@href"/>
      </index-has-key>
      <index-has-key name="index-system-implementation-component-uuid-validation" target="component/link[@rel='proof-of-compliance']">
        <key-field target="@href"/>
      </index-has-key>

      <!-- References to components of @type="service" -->
      <index name="index-system-implementation-component-uuid-service" target="component[@type='service']">
        <key-field target="@uuid"/>
      </index>
      <index-has-key name="index-system-implementation-component-uuid-service" target="component/link[@rel='uses-service']">
        <key-field target="@href"/>
      </index-has-key>

      <!-- References to components of @type="software" -->
      <index name="index-system-implementation-component-uuid-software" target="component[@type='service']">
        <key-field target="@uuid"/>
      </index>
      <index-has-key name="index-system-implementation-component-uuid-software" target="component[@type='service']/link[@rel='provided-by']">
        <key-field target="@href"/>
      </index-has-key>

      <allowed-values target="(component | inventory-item)/prop[@name='allows-authenticated-scan']/@value">
        <enum value="yes">The component allows an authenticated scan.</enum>
        <enum value="no">The component does not allow an authenticated scan.</enum>
      </allowed-values>

      <!-- TODO: only allow a single "this-system" component -->

      <is-unique id="unique-ssp-system-implementation-user" target="user">
        <key-field target="@uuid"/>
        <remarks>
          <p>A given <code>uuid</code> must be assigned only once to a user.</p>
        </remarks>
      </is-unique>
    </constraint>
  </define-assembly>

  <define-assembly name="control-implementation" scope="local">
    <formal-name>Control Implementation</formal-name>
    <description>Describes how the system satisfies a set of controls.</description>
    <model>
      <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
        <formal-name>Control Implementation Description</formal-name>
        <description>A statement describing important things to know about how this set of control satisfaction documentation is approached.</description>
      </define-field>
      <assembly ref="set-parameter" max-occurs="unbounded">
        <group-as name="set-parameters" in-json="ARRAY"/>
      </assembly>
      <assembly ref="implemented-requirement" min-occurs="1" max-occurs="unbounded">
        <group-as name="implemented-requirements" in-json="ARRAY"/>
      </assembly>
    </model>
    <constraint>
      <is-unique id="unique-ssp-control-implementation-set-parameter" target="set-parameter">
        <key-field target="@param-id"/>
        <remarks>
          <p>Since multiple <code>set-parameter</code> entries can be provided, each parameter must be set only once.</p>
        </remarks>
      </is-unique>
      <index name="by-component-export-provided-uuid" target="implemented-requirement/by-component/export/provided">
        <key-field target="@uuid"/>
      </index>
    </constraint>
    <remarks>
      <p>Use of <code>set-parameter</code> in this context, sets the parameter for all related controls referenced in an <code>implemented-requirement</code>. If the same parameter is also set in a specific <code>implemented-requirement</code>, then the new value will override this value.</p>
    </remarks>
  </define-assembly>
  <define-assembly name="implemented-requirement" scope="local">
    <formal-name>Control-based Requirement</formal-name>
    <description>Describes how the system satisfies an individual control.</description>
    <define-flag name="uuid" as-type="uuid" required="yes">
      <formal-name>Control Requirement Universally Unique Identifier</formal-name>
      <!-- Identifier Declaration -->
      <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this control requirement elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>control requirement</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
    </define-flag>
    <flag ref="control-id" required="yes"/>
    <model>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
        <!-- TODO: Model specific link relationships -->
      </assembly>
      <assembly ref="set-parameter" max-occurs="unbounded">
        <group-as name="set-parameters" in-json="ARRAY"/>
      </assembly>
      <assembly ref="responsible-role" max-occurs="unbounded">
        <group-as name="responsible-roles" in-json="ARRAY"/>
      </assembly>
      <assembly ref="statement" max-occurs="unbounded">
        <group-as name="statements" in-json="ARRAY"/>
      </assembly>
      <assembly ref="by-component" min-occurs="0" max-occurs="unbounded">
        <group-as name="by-components" in-json="ARRAY"/>
      </assembly>
      <!-- TODO: Implement parameters -->
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <allowed-values target="prop/@name" allow-other="yes">
        <enum value="control-origination">Identifies the source of the implemented control.</enum>
      </allowed-values>
      <allowed-values target="prop[@name='control-origination']/@value">
        <enum value="organization">The control is implemented by the organization owning the system, but is not specific to the system itself.</enum>
        <enum value="system-specific">The control is implemented specifically to this system.</enum>
        <enum value="customer-configured">The control is provided by the system, but must be configured by the customer.</enum>
        <enum value="customer-provided">The control must be implemented by the customer.</enum>
        <enum value="inherited">This control is inherited from an underlying system.</enum>
      </allowed-values>
      <allowed-values target="prop/@name" allow-other="yes">
        <enum value="leveraged-authorization">Indicates all or some portion of this control is inherited from an underlying authorized system.</enum>
      </allowed-values>
      <allowed-values target="responsible-role/@role-id" allow-other="yes">
            &allowed-values-responsible-roles-operations;
      </allowed-values>
      <index-has-key name="index-metadata-role-id" target="responsible-role|statement/responsible-role|.//by-component//responsible-role">
        <key-field target="@role-id"/>
      </index-has-key>
      <index-has-key name="index-metadata-party-uuid" target="responsible-role|statement/responsible-role|.//by-component//responsible-role">
        <key-field target="party-uuid"/>
      </index-has-key>
      <has-cardinality target=".//by-component" min-occurs="1">
        <remarks>
          <p>Since all implementation statements are defined at the by-component level (e.g., type=this-system), there must be at least one by-component.</p>
        </remarks>
      </has-cardinality>
      <is-unique id="unique-ssp-implemented-requirement-set-parameter" target="set-parameter">
        <key-field target="@param-id"/>
        <remarks>
          <p>Since multiple <code>set-parameter</code> entries can be provided, each parameter must be set only once.</p>
        </remarks>
      </is-unique>
      <is-unique id="unique-ssp-implemented-requirement-responsible-role" target="responsible-role">
        <key-field target="@role-id"/>
        <remarks>
          <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
        </remarks>
      </is-unique>
      <is-unique id="unique-ssp-implemented-requirement-statement" target="statement">
        <key-field target="@statement-id"/>
        <remarks>
          <p>Since <code>statement</code> entries can be referenced using the statement's statement-id, each statement must be referenced only once.</p>
        </remarks>
      </is-unique>
      <is-unique id="unique-ssp-implemented-requirement-by-component" target="by-component">
        <key-field target="@component-uuid"/>
        <remarks>
          <p>Since <code>by-component</code> can reference <code>component</code> entries using the component's uuid, each component must be referenced only once. This ensures that all implementation statements are contained in the same <code>by-component</code> entry.</p>
        </remarks>
      </is-unique>
    </constraint>
  </define-assembly>
  <define-assembly name="statement" scope="local">
    <formal-name>Specific Control Statement</formal-name>
    <description>Identifies which statements within a control are addressed.</description>
    <flag ref="statement-id" required="yes">
      <remarks>
        <p>A reference to the specific implemented statement associated with a control.</p>
      </remarks>
    </flag>
    <define-flag name="uuid" as-type="uuid" required="yes">
      <formal-name>Control Statement Reference Universally Unique Identifier</formal-name>
      <!-- Identifier Reference -->
      <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this control statement elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The <em>UUID</em> of the <code>control statement</code> in the source OSCAL instance is sufficient to reference the data item locally or globally (e.g., in an imported OSCAL instance).</description>
    </define-flag>
    <model>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
      </assembly>
      <assembly ref="responsible-role" max-occurs="unbounded">
        <group-as name="responsible-roles" in-json="ARRAY"/>
      </assembly>
      <assembly ref="by-component" max-occurs="unbounded">
        <group-as name="by-components" in-json="ARRAY"/>
      </assembly>
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <allowed-values target="responsible-role/@role-id" allow-other="yes">
            &allowed-values-responsible-roles-operations;
      </allowed-values>
      <is-unique id="unique-ssp-statement-responsible-role" target="responsible-role">
        <key-field target="@role-id"/>
        <remarks>
          <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
        </remarks>
      </is-unique>
      <is-unique id="unique-ssp-implemented-requirement-statement-by-component" target="by-component">
        <key-field target="@component-uuid"/>
        <remarks>
          <p>Since <code>by-component</code> can reference <code>component</code> entries using the component's uuid, each component must be referenced only once. This ensures that all implementation statements are contained in the same <code>by-component</code> entry.</p>
        </remarks>
      </is-unique>
      
    </constraint>
  </define-assembly>
  <define-assembly name="by-component">
    <!-- QUESTION: Should set-parameter be moved here to allow component-specific parameter settings? or "this-system" for the whole system? -->
    <formal-name>Component Control Implementation</formal-name>
    <description>Defines how the referenced component implements a set of controls.</description>
    <define-flag required="yes" name="component-uuid" as-type="uuid">
      <formal-name>Component Universally Unique Identifier Reference</formal-name>
      <!-- Identifier Reference -->
      <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to the <code>component</code> that is implemeting a given control.</description>
    </define-flag>
    <define-flag name="uuid" as-type="uuid" required="yes">
      <formal-name>By-Component Universally Unique Identifier</formal-name>
      <!-- Identifier Declaration -->
      <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this by-component entry elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>by-component</code> entry can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
    </define-flag>
    <model>
      <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
        <formal-name>Control Implementation Description</formal-name>
        <description>An implementation statement that describes how a control or a control statement is implemented within the referenced system component.</description>
      </define-field>
      <assembly ref="property" max-occurs="unbounded">
        <group-as name="props" in-json="ARRAY"/>
      </assembly>
      <assembly ref="link" max-occurs="unbounded">
        <group-as name="links" in-json="ARRAY"/>
      </assembly>
      <assembly ref="set-parameter" max-occurs="unbounded">
        <group-as name="set-parameters" in-json="ARRAY"/>
      </assembly>
      <assembly ref="implementation-status">
        <remarks>
          <p>The <code>implementation-status</code> is used to qualify the <code>status</code> value to indicate the degree to which the control is implemented.</p>
        </remarks>
      </assembly>
      <define-assembly name="export" max-occurs="1">
        <formal-name>Export</formal-name>
        <description>Identifies content intended for external consumption, such as with leveraged organizations.</description>
        <model>
          <define-field name="description" as-type="markup-multiline" in-xml="WITH_WRAPPER">
            <formal-name>Control Implementation Export Description</formal-name>
            <description>An implementation statement that describes the aspects of the control or control statement implementation that can be available to another system leveraging this system.</description>
          </define-field>
          <assembly ref="property" max-occurs="unbounded">
            <group-as name="props" in-json="ARRAY"/>
          </assembly>
          <assembly ref="link" max-occurs="unbounded">
            <group-as name="links" in-json="ARRAY"/>
            <!-- TODO: Model specific link relationships -->
          </assembly>
          <define-assembly name="provided" max-occurs="unbounded">
            <formal-name>Provided Control Implementation</formal-name>
            <description>Describes a capability which may be inherited by a leveraging system.</description>
            <!-- CHANGED: "provided-group" to "provided" -->
            <group-as name="provided" in-json="ARRAY"/>
            <define-flag name="uuid" as-type="uuid" required="yes">
              <formal-name>Provided Universally Unique Identifier</formal-name>
              <!-- Identifier Declaration -->
              <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this provided entry elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>provided</code> entry can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
            </define-flag>
            <model>
              <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
                <formal-name>Provided Control Implementation Description</formal-name>
                <description>An implementation statement that describes the aspects of the control or control statement implementation that can be provided to another system leveraging this system.</description>
              </define-field>
              <assembly ref="property" max-occurs="unbounded">
                <group-as name="props" in-json="ARRAY"/>
              </assembly>
              <assembly ref="link" max-occurs="unbounded">
                <group-as name="links" in-json="ARRAY"/>
                <!-- TODO: Model specific link relationships -->
              </assembly>
              <assembly ref="responsible-role" min-occurs="0" max-occurs="unbounded">
                <group-as name="responsible-roles" in-json="ARRAY"/>
              </assembly>
              <field ref="remarks" in-xml="WITH_WRAPPER"/>
            </model>
            <constraint>
              <is-unique id="unique-provided-responsible-role" target="responsible-role">
                <key-field target="@role-id"/>
                <remarks>
                  <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
                </remarks>
              </is-unique>
            </constraint>
          </define-assembly>
          <define-assembly name="responsibility" max-occurs="unbounded">
            <formal-name>Control Implementation Responsibility</formal-name>
            <description>Describes a control implementation responsibility imposed on a leveraging system.</description>
            <group-as name="responsibilities" in-json="ARRAY"/>
            <define-flag name="uuid" as-type="uuid" required="yes">
              <formal-name>Responsibility Universally Unique Identifier</formal-name>
              <!-- Identifier Declaration -->
              <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this responsibility elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>responsibility</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
            </define-flag>
            <flag ref="provided-uuid" required="no" />
            <model>
              <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
                <formal-name>Control Implementation Responsibility Description</formal-name>
                <description>An implementation statement that describes the aspects of the control or control statement implementation that a leveraging system must implement to satisfy the control provided by a leveraged system.</description>
              </define-field>
              <assembly ref="property" max-occurs="unbounded">
                <group-as name="props" in-json="ARRAY"/>
              </assembly>
              <assembly ref="link" max-occurs="unbounded">
                <group-as name="links" in-json="ARRAY"/>
                <!-- TODO: Model specific link relationships -->
              </assembly>
              <assembly ref="responsible-role" min-occurs="0" max-occurs="unbounded">
                <group-as name="responsible-roles" in-json="ARRAY"/>
                <remarks>
                  <p>A role defined at the by-component level takes precedence over the same role defined on the parent implemented-requirement or on the referenced component. </p>
                </remarks>
              </assembly>
              <field ref="remarks" in-xml="WITH_WRAPPER"/>
            </model>
            <constraint>
              <is-unique id="unique-responsibility-responsible-role" target="responsible-role">
                <key-field target="@role-id"/>
                <remarks>
                  <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
                </remarks>
              </is-unique>
            </constraint>
          </define-assembly>
          <field ref="remarks" in-xml="WITH_WRAPPER"/>
        </model>
        <constraint>
          <has-cardinality target="provided|responsibility" min-occurs="1"/>
          <index-has-key name="by-component-export-provided-uuid" target="responsibility">
            <key-field target="@provided-uuid"/>
          </index-has-key>
        </constraint>
      </define-assembly>
      <define-assembly name="inherited" max-occurs="unbounded">
        <formal-name>Inherited Control Implementation</formal-name>
        <description>Describes a control implementation inherited by a leveraging system.</description>
        <!-- CHANGED: "inherited-group" to "inherited" -->
        <group-as name="inherited" in-json="ARRAY"/>
        <define-flag name="uuid" as-type="uuid" required="yes">
          <formal-name>Inherited Universally Unique Identifier</formal-name>
          <!-- Identifier Declaration -->
          <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this inherited entry elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>inherited control implementation</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
        </define-flag>
        <flag ref="provided-uuid" required="no" />
        <model>
          <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
            <formal-name>Inherited Control Implementation Description</formal-name>
            <description>An implementation statement that describes the aspects of a control or control statement implementation that a leveraging system is inheriting from a leveraged system.</description>
          </define-field>
          <assembly ref="property" max-occurs="unbounded">
            <group-as name="props" in-json="ARRAY"/>
          </assembly>
          <assembly ref="link" max-occurs="unbounded">
            <group-as name="links" in-json="ARRAY"/>
            <!-- TODO: Model specific link relationships -->
          </assembly>
          <assembly ref="responsible-role" min-occurs="0" max-occurs="unbounded">
            <group-as name="responsible-roles" in-json="ARRAY"/>
          </assembly>
        </model>
        <constraint>
          <is-unique id="unique-inherited-responsible-role" target="responsible-role">
            <key-field target="@role-id"/>
            <remarks>
              <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
            </remarks>
          </is-unique>
        </constraint>
      </define-assembly>
      <define-assembly name="satisfied" max-occurs="unbounded">
        <formal-name>Satisfied Control Implementation Responsibility</formal-name>
        <description>Describes how this system satisfies a responsibility imposed by a leveraged system.</description>
        <!-- CHANGED: "satisfied-group" to "satisfied" -->
        <group-as name="satisfied" in-json="ARRAY"/>
        <define-flag name="uuid" as-type="uuid" required="yes">
          <formal-name>Satisfied Universally Unique Identifier</formal-name>
          <!-- Identifier Declaration -->
          <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a>, <a href="/concepts/identifier-use/#globally-unique">globally unique</a> identifier with <a href="/concepts/identifier-use/#cross-instance">cross-instance</a> scope that can be used to reference this satisfied control implementation entry elsewhere in <a href="/concepts/identifier-use/#ssp-identifiers">this or other OSCAL instances</a>. The locally defined <em>UUID</em> of the <code>control implementation</code> can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned <a href="/concepts/identifier-use/#consistency">per-subject</a>, which means it should be consistently used to identify the same subject across revisions of the document.</description>
        </define-flag>
        <flag ref="responsibility-uuid" required="no" />
        <model>
          <define-field name="description" as-type="markup-multiline" min-occurs="1" in-xml="WITH_WRAPPER">
            <formal-name>Satisfied Control Implementation Responsibility Description</formal-name>
            <description>An implementation statement that describes the aspects of a control or control statement implementation that a leveraging system is implementing based on a requirement from a leveraged system.</description>
          </define-field>
          <assembly ref="property" max-occurs="unbounded">
            <group-as name="props" in-json="ARRAY"/>
          </assembly>
          <assembly ref="link" max-occurs="unbounded">
            <group-as name="links" in-json="ARRAY"/>
            <!-- TODO: Model specific link relationships -->
          </assembly>
          <assembly ref="responsible-role" min-occurs="0" max-occurs="unbounded">
            <group-as name="responsible-roles" in-json="ARRAY"/>
          </assembly>
          <field ref="remarks" in-xml="WITH_WRAPPER"/>
        </model>
        <constraint>
          <is-unique id="unique-satisfied-responsible-role" target="responsible-role">
            <key-field target="@role-id"/>
            <remarks>
              <p>Since <code>responsible-role</code> associates multiple <code>party-uuid</code> entries with a single <code>role-id</code>, each role-id must be referenced only once.</p>
            </remarks>
          </is-unique>
        </constraint>
      </define-assembly>
      <assembly ref="responsible-role" max-occurs="unbounded">
        <group-as name="responsible-roles" in-json="ARRAY"/>
      </assembly>
      <!-- CHANGED: removed "set-parameter" -->
      <field ref="remarks" in-xml="WITH_WRAPPER"/>
    </model>
    <constraint>
      <allowed-values target=".//responsible-role/@role-id" allow-other="yes">
            &allowed-values-responsible-roles-operations;
            &allowed-values-responsible-roles-component-production;
      </allowed-values>
      <is-unique id="unique-ssp-by-component-set-parameter" target="set-parameter">
        <key-field target="@param-id"/>
        <remarks>
          <p>Since multiple <code>set-parameter</code> entries can be provided, each parameter must be set only once.</p>
        </remarks>
      </is-unique>
    </constraint>
  </define-assembly>

  <define-flag name="provided-uuid" as-type="uuid" scope="local">
    <formal-name>Provided UUID</formal-name>
    <!-- Identifier Reference -->
    <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to an inherited control implementation that a leveraging system is inheriting from a leveraged system.</description>
  </define-flag>

  <define-flag name="responsibility-uuid" as-type="uuid" scope="local">
    <formal-name>Responsibility UUID</formal-name>
    <!-- Identifier Reference -->
    <description>A <a href="/concepts/identifier-use/#machine-oriented">machine-oriented</a> identifier reference to a control implementation that satisfies a responsibility imposed by a leveraged system.</description>
  </define-flag>
</METASCHEMA>