Skip to content

Commit

Permalink
removed all source and generated content files. Updated readmes to po…
Browse files Browse the repository at this point in the history
…int to the new content repository.
  • Loading branch information
david-waltermire committed Sep 17, 2020
1 parent 515b797 commit 01c0aa9
Show file tree
Hide file tree
Showing 89 changed files with 7 additions and 921,151 deletions.
8 changes: 1 addition & 7 deletions content/README.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,3 @@
# OSCAL Examples

This directory contains OSCAL examples in both XML and JSON formats. Some examples are considered provisional "finished" versions of OSCAL catalogs and profiles; they are not authoritative but are intended as demonstrations of OSCAL. Other examples are works in progress. Each subdirectory within the examples directory clearly indicates the current status of its example files.

The structure and contents of the examples directory are as follows:

* [fedramp.gov](fedramp.gov): This directory contains examples in XML and JSON formats of the low, moderate, and high baselines defined by FedRAMP (the Federal Risk and Authorization Management Program).
* [nist.gov/SP800-53/rev4](nist.gov/SP800-53/rev4): This directory contains examples in XML and JSON formats of the low, moderate, and high baselines defined by NIST Special Publication (SP) 800-53 Revision 4.

All OSCAL content examples have been moved to the [OSCAL content GitHub repository](https://github.com/usnistgov/oscal-content).
55 changes: 0 additions & 55 deletions content/components/json/example-component-min.json

This file was deleted.

57 changes: 0 additions & 57 deletions content/components/json/example-component.json

This file was deleted.

41 changes: 0 additions & 41 deletions content/components/xml/example-component.xml

This file was deleted.

38 changes: 0 additions & 38 deletions content/components/yaml/example-component.yaml

This file was deleted.

32 changes: 2 additions & 30 deletions content/fedramp.gov/README.md
Original file line number Diff line number Diff line change
@@ -1,31 +1,3 @@
# Federal Risk and Authorization Management Program (FedRAMP) Profile Examples
# Content Moved

The following representations of the "High", "Moderate" and "Low" baselines (profiles) are derived from [source data](https://www.fedramp.gov/documents/) defined by FedRAMP:

- [FedRAMP High Security Controls](https://www.fedramp.gov/assets/resources/documents/FedRAMP_High_Security_Controls.xlsx)
- [FedRAMP MODERATE Security Controls](https://www.fedramp.gov/assets/resources/documents/FedRAMP_Moderate_Security_Controls.xlsx)
- [FedRAMP LOW Security Controls](https://www.fedramp.gov/assets/resources/documents/FedRAMP_Low_Security_Controls.xlsx)

Machine made OSCAL Profile versions:

- [FedRAMP HIGH Baseline OSCAL Profile](xml/FedRAMP_HIGH-baseline_profile.xml)
- [FedRAMP MODERATE Baseline OSCAL Profile](xml/FedRAMP_MODERATE-baseline_profile.xml)
- [FedRAMP LOW Baseline OSCAL Profile](xml/FedRAMP_LOW-baseline_profile.xml)

[JSON versions](json) are also available for the OSCAL profiles above containing equivalent content.

Each one of these captures the (indicated) spreadsheet data and represents it as an OSCAL profile, calling controls in from the appropriate SP 800-53 rev4 baselines or when necessary from the SP 800-53 rev4 catalog.

Specific FedRAMP guidance and parameter constraints are provided for each control.

### Extraction / conversion process

All control information from NIST SP 800-53 revision 4 and all FedRAMP control baseline details are correlated in an MS Access database, which is part of the MS Office 2016 product suite.
The FedRAMP profiles are created with MS Access Visual Basic for Applications (VBA) code, which queries the information and creates OSCAL-compliant XML using MSXML Document Object Model (DOM) Version 6.
This tool represents a proof-of-concept. Open-source tools may be developed in the future.

### Special considerations

Note also the profiles here make reference to profiles and catalogs stored in the neighbor '[SP 800-53](../nist.gov/SP800-53)' directory, on which they are dependent.

Also note that (at least according to Schematron `oscal-profiles-sources.sch`), several of the OSCAL invocations in these profiles could be rewritten to exclude rather than include controls. In a number of cases, invoking controls by exclusion will be much more concise than the same control set (selection) expressed by inclusion; the Schematron detects and reports on this.
All OSCAL FedRAMP content have been moved to the [OSCAL content GitHub repository](https://github.com/usnistgov/oscal-content/tree/master/fedramp.gov).

This file was deleted.

Loading

0 comments on commit 01c0aa9

Please sign in to comment.