diff --git a/json/convert/oscal_complete_xml-to-json-converter.xsl b/json/convert/oscal_complete_xml-to-json-converter.xsl
index 4aff0b6d79..01e535d7a1 100644
--- a/json/convert/oscal_complete_xml-to-json-converter.xsl
+++ b/json/convert/oscal_complete_xml-to-json-converter.xsl
@@ -76,7 +76,7 @@
-
+
@@ -624,7 +624,7 @@
-
@@ -2658,6 +2658,13 @@
+
+
+
+
+
+
+
@@ -2723,6 +2730,13 @@
+
+
+
+
+
+
+
@@ -4497,7 +4511,7 @@
-
-
-
-
-
+
+
+
+
+
@@ -29692,6 +29717,395 @@
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ identified-subject
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ status
+
+
+
+
+
+
+
+
+
+
+ implementation-statement-uuid
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -29782,6 +30196,14 @@
+
+
+
+
+
+
diff --git a/json/convert/oscal_poam_xml-to-json-converter.xsl b/json/convert/oscal_poam_xml-to-json-converter.xsl
index 5e79516a4f..cd4be00cc8 100644
--- a/json/convert/oscal_poam_xml-to-json-converter.xsl
+++ b/json/convert/oscal_poam_xml-to-json-converter.xsl
@@ -76,7 +76,7 @@
-
+
@@ -111,6 +111,13 @@
+
+
+
+
+
+
+
@@ -878,6 +885,96 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ target
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ implementation-status
+
+
+
+
+
@@ -906,6 +1003,13 @@
+
+
+
+
+
+
+
@@ -1556,7 +1660,7 @@
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -1884,6 +2076,17 @@
+
+
+
+
+
@@ -5898,7 +6101,7 @@
-
@@ -5916,7 +6119,7 @@
-
@@ -5938,7 +6141,7 @@
-
@@ -5956,24 +6159,86 @@
-
-
-
-
-
-
-
-
-
-
+
+
+ text
+
+
+
+
+
-
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ identified-subject
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+ status
+
+
+
+
+
+
+
+
+
+
+ implementation-statement-uuid
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/json/schema/oscal_assessment-plan_schema.json b/json/schema/oscal_assessment-plan_schema.json
index 49bb202861..fba22cf4d9 100644
--- a/json/schema/oscal_assessment-plan_schema.json
+++ b/json/schema/oscal_assessment-plan_schema.json
@@ -1523,6 +1523,83 @@
"target-id",
"status" ],
"additionalProperties" : false },
+ "oscal-ap-oscal-assessment-common:finding" :
+ { "title" : "Finding",
+ "description" : "Describes an individual finding.",
+ "$id" : "#assembly_oscal-assessment-common_finding",
+ "type" : "object",
+ "properties" :
+ { "uuid" :
+ { "title" : "Finding Universally Unique Identifier",
+ "description" : "A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "title" :
+ { "title" : "Finding Title",
+ "description" : "The title for this finding.",
+ "type" : "string" },
+ "description" :
+ { "title" : "Finding Description",
+ "description" : "A human-readable description of this finding.",
+ "type" : "string" },
+ "props" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_property" } },
+ "links" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_link" } },
+ "origins" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-assessment-common_origin" } },
+ "target" :
+ { "$ref" : "#assembly_oscal-assessment-common_finding-target" },
+ "implementation-statement-uuid" :
+ { "title" : "Implementation Statement UUID",
+ "description" : "A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "related-observations" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Related Observation",
+ "description" : "Relates the finding to a set of referenced observations that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "observation-uuid" :
+ { "title" : "Observation Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to an observation defined in the list of observations.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "observation-uuid" ],
+ "additionalProperties" : false } },
+ "related-risks" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Associated Risk",
+ "description" : "Relates the finding to a set of referenced risks that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "risk-uuid" :
+ { "title" : "Risk Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to a risk defined in the list of risks.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "risk-uuid" ],
+ "additionalProperties" : false } },
+ "remarks" :
+ { "$ref" : "#field_oscal-metadata_remarks" } },
+ "required" :
+ [ "uuid",
+ "title",
+ "description",
+ "target" ],
+ "additionalProperties" : false },
"oscal-ap-oscal-assessment-common:observation" :
{ "title" : "Observation",
"description" : "Describes an individual observation.",
diff --git a/json/schema/oscal_assessment-results_schema.json b/json/schema/oscal_assessment-results_schema.json
index fd9efdcdb7..47b059de4b 100644
--- a/json/schema/oscal_assessment-results_schema.json
+++ b/json/schema/oscal_assessment-results_schema.json
@@ -212,7 +212,7 @@
{ "type" : "array",
"minItems" : 1,
"items" :
- { "$ref" : "#assembly_oscal-ar_finding" } },
+ { "$ref" : "#assembly_oscal-assessment-common_finding" } },
"remarks" :
{ "$ref" : "#field_oscal-metadata_remarks" } },
"required" :
@@ -222,83 +222,6 @@
"start",
"reviewed-controls" ],
"additionalProperties" : false },
- "oscal-ar-oscal-ar:finding" :
- { "title" : "Finding",
- "description" : "Describes an individual finding.",
- "$id" : "#assembly_oscal-ar_finding",
- "type" : "object",
- "properties" :
- { "uuid" :
- { "title" : "Finding Universally Unique Identifier",
- "description" : "A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.",
- "$ref" : "#/definitions/UUIDDatatype" },
- "title" :
- { "title" : "Finding Title",
- "description" : "The title for this finding.",
- "type" : "string" },
- "description" :
- { "title" : "Finding Description",
- "description" : "A human-readable description of this finding.",
- "type" : "string" },
- "props" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "$ref" : "#assembly_oscal-metadata_property" } },
- "links" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "$ref" : "#assembly_oscal-metadata_link" } },
- "origins" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "$ref" : "#assembly_oscal-assessment-common_origin" } },
- "target" :
- { "$ref" : "#assembly_oscal-assessment-common_finding-target" },
- "implementation-statement-uuid" :
- { "title" : "Implementation Statement UUID",
- "description" : "A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.",
- "$ref" : "#/definitions/UUIDDatatype" },
- "related-observations" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "title" : "Related Observation",
- "description" : "Relates the finding to a set of referenced observations that were used to determine the finding.",
- "type" : "object",
- "properties" :
- { "observation-uuid" :
- { "title" : "Observation Universally Unique Identifier Reference",
- "description" : "A machine-oriented identifier reference to an observation defined in the list of observations.",
- "$ref" : "#/definitions/UUIDDatatype" } },
- "required" :
- [ "observation-uuid" ],
- "additionalProperties" : false } },
- "related-risks" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "title" : "Associated Risk",
- "description" : "Relates the finding to a set of referenced risks that were used to determine the finding.",
- "type" : "object",
- "properties" :
- { "risk-uuid" :
- { "title" : "Risk Universally Unique Identifier Reference",
- "description" : "A machine-oriented identifier reference to a risk defined in the list of risks.",
- "$ref" : "#/definitions/UUIDDatatype" } },
- "required" :
- [ "risk-uuid" ],
- "additionalProperties" : false } },
- "remarks" :
- { "$ref" : "#field_oscal-metadata_remarks" } },
- "required" :
- [ "uuid",
- "title",
- "description",
- "target" ],
- "additionalProperties" : false },
"oscal-ar-oscal-ar:import-ap" :
{ "title" : "Import Assessment Plan",
"description" : "Used by assessment-results to import information about the original plan for assessing the system.",
@@ -1753,6 +1676,83 @@
"target-id",
"status" ],
"additionalProperties" : false },
+ "oscal-ar-oscal-assessment-common:finding" :
+ { "title" : "Finding",
+ "description" : "Describes an individual finding.",
+ "$id" : "#assembly_oscal-assessment-common_finding",
+ "type" : "object",
+ "properties" :
+ { "uuid" :
+ { "title" : "Finding Universally Unique Identifier",
+ "description" : "A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "title" :
+ { "title" : "Finding Title",
+ "description" : "The title for this finding.",
+ "type" : "string" },
+ "description" :
+ { "title" : "Finding Description",
+ "description" : "A human-readable description of this finding.",
+ "type" : "string" },
+ "props" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_property" } },
+ "links" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_link" } },
+ "origins" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-assessment-common_origin" } },
+ "target" :
+ { "$ref" : "#assembly_oscal-assessment-common_finding-target" },
+ "implementation-statement-uuid" :
+ { "title" : "Implementation Statement UUID",
+ "description" : "A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "related-observations" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Related Observation",
+ "description" : "Relates the finding to a set of referenced observations that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "observation-uuid" :
+ { "title" : "Observation Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to an observation defined in the list of observations.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "observation-uuid" ],
+ "additionalProperties" : false } },
+ "related-risks" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Associated Risk",
+ "description" : "Relates the finding to a set of referenced risks that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "risk-uuid" :
+ { "title" : "Risk Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to a risk defined in the list of risks.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "risk-uuid" ],
+ "additionalProperties" : false } },
+ "remarks" :
+ { "$ref" : "#field_oscal-metadata_remarks" } },
+ "required" :
+ [ "uuid",
+ "title",
+ "description",
+ "target" ],
+ "additionalProperties" : false },
"oscal-ar-oscal-assessment-common:observation" :
{ "title" : "Observation",
"description" : "Describes an individual observation.",
diff --git a/json/schema/oscal_complete_schema.json b/json/schema/oscal_complete_schema.json
index 114a262b47..618dfb0cd4 100644
--- a/json/schema/oscal_complete_schema.json
+++ b/json/schema/oscal_complete_schema.json
@@ -3879,6 +3879,83 @@
"target-id",
"status" ],
"additionalProperties" : false },
+ "oscal-complete-oscal-assessment-common:finding" :
+ { "title" : "Finding",
+ "description" : "Describes an individual finding.",
+ "$id" : "#assembly_oscal-assessment-common_finding",
+ "type" : "object",
+ "properties" :
+ { "uuid" :
+ { "title" : "Finding Universally Unique Identifier",
+ "description" : "A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "title" :
+ { "title" : "Finding Title",
+ "description" : "The title for this finding.",
+ "type" : "string" },
+ "description" :
+ { "title" : "Finding Description",
+ "description" : "A human-readable description of this finding.",
+ "type" : "string" },
+ "props" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_property" } },
+ "links" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_link" } },
+ "origins" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-assessment-common_origin" } },
+ "target" :
+ { "$ref" : "#assembly_oscal-assessment-common_finding-target" },
+ "implementation-statement-uuid" :
+ { "title" : "Implementation Statement UUID",
+ "description" : "A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "related-observations" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Related Observation",
+ "description" : "Relates the finding to a set of referenced observations that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "observation-uuid" :
+ { "title" : "Observation Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to an observation defined in the list of observations.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "observation-uuid" ],
+ "additionalProperties" : false } },
+ "related-risks" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Associated Risk",
+ "description" : "Relates the finding to a set of referenced risks that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "risk-uuid" :
+ { "title" : "Risk Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to a risk defined in the list of risks.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "risk-uuid" ],
+ "additionalProperties" : false } },
+ "remarks" :
+ { "$ref" : "#field_oscal-metadata_remarks" } },
+ "required" :
+ [ "uuid",
+ "title",
+ "description",
+ "target" ],
+ "additionalProperties" : false },
"oscal-complete-oscal-assessment-common:observation" :
{ "title" : "Observation",
"description" : "Describes an individual observation.",
@@ -4747,7 +4824,7 @@
{ "type" : "array",
"minItems" : 1,
"items" :
- { "$ref" : "#assembly_oscal-ar_finding" } },
+ { "$ref" : "#assembly_oscal-assessment-common_finding" } },
"remarks" :
{ "$ref" : "#field_oscal-metadata_remarks" } },
"required" :
@@ -4757,83 +4834,6 @@
"start",
"reviewed-controls" ],
"additionalProperties" : false },
- "oscal-complete-oscal-ar:finding" :
- { "title" : "Finding",
- "description" : "Describes an individual finding.",
- "$id" : "#assembly_oscal-ar_finding",
- "type" : "object",
- "properties" :
- { "uuid" :
- { "title" : "Finding Universally Unique Identifier",
- "description" : "A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.",
- "$ref" : "#/definitions/UUIDDatatype" },
- "title" :
- { "title" : "Finding Title",
- "description" : "The title for this finding.",
- "type" : "string" },
- "description" :
- { "title" : "Finding Description",
- "description" : "A human-readable description of this finding.",
- "type" : "string" },
- "props" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "$ref" : "#assembly_oscal-metadata_property" } },
- "links" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "$ref" : "#assembly_oscal-metadata_link" } },
- "origins" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "$ref" : "#assembly_oscal-assessment-common_origin" } },
- "target" :
- { "$ref" : "#assembly_oscal-assessment-common_finding-target" },
- "implementation-statement-uuid" :
- { "title" : "Implementation Statement UUID",
- "description" : "A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.",
- "$ref" : "#/definitions/UUIDDatatype" },
- "related-observations" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "title" : "Related Observation",
- "description" : "Relates the finding to a set of referenced observations that were used to determine the finding.",
- "type" : "object",
- "properties" :
- { "observation-uuid" :
- { "title" : "Observation Universally Unique Identifier Reference",
- "description" : "A machine-oriented identifier reference to an observation defined in the list of observations.",
- "$ref" : "#/definitions/UUIDDatatype" } },
- "required" :
- [ "observation-uuid" ],
- "additionalProperties" : false } },
- "related-risks" :
- { "type" : "array",
- "minItems" : 1,
- "items" :
- { "title" : "Associated Risk",
- "description" : "Relates the finding to a set of referenced risks that were used to determine the finding.",
- "type" : "object",
- "properties" :
- { "risk-uuid" :
- { "title" : "Risk Universally Unique Identifier Reference",
- "description" : "A machine-oriented identifier reference to a risk defined in the list of risks.",
- "$ref" : "#/definitions/UUIDDatatype" } },
- "required" :
- [ "risk-uuid" ],
- "additionalProperties" : false } },
- "remarks" :
- { "$ref" : "#field_oscal-metadata_remarks" } },
- "required" :
- [ "uuid",
- "title",
- "description",
- "target" ],
- "additionalProperties" : false },
"oscal-complete-oscal-ar:import-ap" :
{ "title" : "Import Assessment Plan",
"description" : "Used by assessment-results to import information about the original plan for assessing the system.",
@@ -4877,6 +4877,11 @@
"minItems" : 1,
"items" :
{ "$ref" : "#assembly_oscal-assessment-common_risk" } },
+ "findings" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-assessment-common_finding" } },
"poam-items" :
{ "type" : "array",
"minItems" : 1,
@@ -4954,6 +4959,21 @@
"required" :
[ "actors" ],
"additionalProperties" : false } },
+ "related-findings" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Related Finding",
+ "description" : "Relates the poam-item to referenced finding(s).",
+ "type" : "object",
+ "properties" :
+ { "finding-uuid" :
+ { "title" : "Finding Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to a finding defined in the list of findings.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "finding-uuid" ],
+ "additionalProperties" : false } },
"related-observations" :
{ "type" : "array",
"minItems" : 1,
diff --git a/json/schema/oscal_poam_schema.json b/json/schema/oscal_poam_schema.json
index 68483162f3..889674ec71 100644
--- a/json/schema/oscal_poam_schema.json
+++ b/json/schema/oscal_poam_schema.json
@@ -32,6 +32,11 @@
"minItems" : 1,
"items" :
{ "$ref" : "#assembly_oscal-assessment-common_risk" } },
+ "findings" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-assessment-common_finding" } },
"poam-items" :
{ "type" : "array",
"minItems" : 1,
@@ -109,6 +114,21 @@
"required" :
[ "actors" ],
"additionalProperties" : false } },
+ "related-findings" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Related Finding",
+ "description" : "Relates the poam-item to referenced finding(s).",
+ "type" : "object",
+ "properties" :
+ { "finding-uuid" :
+ { "title" : "Finding Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to a finding defined in the list of findings.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "finding-uuid" ],
+ "additionalProperties" : false } },
"related-observations" :
{ "type" : "array",
"minItems" : 1,
@@ -2089,6 +2109,83 @@
"target-id",
"status" ],
"additionalProperties" : false },
+ "oscal-poam-oscal-assessment-common:finding" :
+ { "title" : "Finding",
+ "description" : "Describes an individual finding.",
+ "$id" : "#assembly_oscal-assessment-common_finding",
+ "type" : "object",
+ "properties" :
+ { "uuid" :
+ { "title" : "Finding Universally Unique Identifier",
+ "description" : "A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "title" :
+ { "title" : "Finding Title",
+ "description" : "The title for this finding.",
+ "type" : "string" },
+ "description" :
+ { "title" : "Finding Description",
+ "description" : "A human-readable description of this finding.",
+ "type" : "string" },
+ "props" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_property" } },
+ "links" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-metadata_link" } },
+ "origins" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "$ref" : "#assembly_oscal-assessment-common_origin" } },
+ "target" :
+ { "$ref" : "#assembly_oscal-assessment-common_finding-target" },
+ "implementation-statement-uuid" :
+ { "title" : "Implementation Statement UUID",
+ "description" : "A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.",
+ "$ref" : "#/definitions/UUIDDatatype" },
+ "related-observations" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Related Observation",
+ "description" : "Relates the finding to a set of referenced observations that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "observation-uuid" :
+ { "title" : "Observation Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to an observation defined in the list of observations.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "observation-uuid" ],
+ "additionalProperties" : false } },
+ "related-risks" :
+ { "type" : "array",
+ "minItems" : 1,
+ "items" :
+ { "title" : "Associated Risk",
+ "description" : "Relates the finding to a set of referenced risks that were used to determine the finding.",
+ "type" : "object",
+ "properties" :
+ { "risk-uuid" :
+ { "title" : "Risk Universally Unique Identifier Reference",
+ "description" : "A machine-oriented identifier reference to a risk defined in the list of risks.",
+ "$ref" : "#/definitions/UUIDDatatype" } },
+ "required" :
+ [ "risk-uuid" ],
+ "additionalProperties" : false } },
+ "remarks" :
+ { "$ref" : "#field_oscal-metadata_remarks" } },
+ "required" :
+ [ "uuid",
+ "title",
+ "description",
+ "target" ],
+ "additionalProperties" : false },
"oscal-poam-oscal-assessment-common:observation" :
{ "title" : "Observation",
"description" : "Describes an individual observation.",
diff --git a/xml/convert/oscal_complete_json-to-xml-converter.xsl b/xml/convert/oscal_complete_json-to-xml-converter.xsl
index 1333edc312..7ae80de945 100644
--- a/xml/convert/oscal_complete_json-to-xml-converter.xsl
+++ b/xml/convert/oscal_complete_json-to-xml-converter.xsl
@@ -318,9 +318,9 @@
-
+
-
+
target
@@ -1290,6 +1290,7 @@
+
@@ -1319,6 +1320,7 @@
+
@@ -3401,8 +3403,8 @@
-
+
-
-
+
-
-
+
-
-
+
-
-
+
-
+
+
+
+
+
+
+
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ identified-subject
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ status
+
+
+
+
+
+
+
+
+
+
+
+ implementation-statement-uuid
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -30834,6 +31310,14 @@
+
+
+
+
+
+
+
diff --git a/xml/convert/oscal_poam_json-to-xml-converter.xsl b/xml/convert/oscal_poam_json-to-xml-converter.xsl
index bbd803fc3b..f6756e964a 100644
--- a/xml/convert/oscal_poam_json-to-xml-converter.xsl
+++ b/xml/convert/oscal_poam_json-to-xml-converter.xsl
@@ -107,6 +107,7 @@
+
@@ -442,6 +443,54 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ target
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ implementation-status
+
+
+
+
+
@@ -452,6 +501,7 @@
+
@@ -1200,8 +1250,8 @@
-
+
-
@@ -1572,6 +1622,108 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ identified-subject
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ title
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ description
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ status
+
+
+
+
+
+
+
+
+
+
+
+ implementation-statement-uuid
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -6080,6 +6706,14 @@
+
+
+
+
+
+
+
diff --git a/xml/schema/oscal_assessment-plan_schema.xsd b/xml/schema/oscal_assessment-plan_schema.xsd
index caa1f553b8..ddddeb57ad 100644
--- a/xml/schema/oscal_assessment-plan_schema.xsd
+++ b/xml/schema/oscal_assessment-plan_schema.xsd
@@ -2749,6 +2749,144 @@
+
+
+
+ Finding
+ Describes an individual finding.
+
+
+ Finding: Describes an individual finding.
+
+
+
+
+
+
+ Finding Title
+ The title for this finding.
+
+
+ Finding Title: The title for this finding.
+
+
+
+
+
+
+
+
+
+
+ Finding Description
+ A human-readable description of this finding.
+
+
+ Finding Description: A human-readable description of this finding.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Implementation Statement UUID
+ A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+ Implementation Statement UUID: A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+
+
+
+
+
+
+ Related Observation
+ Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+ Related Observation: Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+
+
+ Observation Universally Unique Identifier Reference
+ A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+ Observation Universally Unique Identifier Reference: A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+
+
+
+
+
+
+ Associated Risk
+ Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+ Associated Risk: Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+
+
+ Risk Universally Unique Identifier Reference
+ A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+ Risk Universally Unique Identifier Reference: A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+
+
+
+
+
+ Remarks
+ Additional commentary about the containing object.
+
+
+ Remarks: Additional commentary about the containing object.
+
+
+
+
+
+
+
+
+
+ Finding Universally Unique Identifier
+ A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+ Finding Universally Unique Identifier: A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+
diff --git a/xml/schema/oscal_assessment-results_schema.xsd b/xml/schema/oscal_assessment-results_schema.xsd
index 4ad4f9bd44..dc6f971d0b 100644
--- a/xml/schema/oscal_assessment-results_schema.xsd
+++ b/xml/schema/oscal_assessment-results_schema.xsd
@@ -358,7 +358,7 @@
minOccurs="0"
maxOccurs="unbounded"/>
@@ -386,144 +386,6 @@
-
-
-
- Finding
- Describes an individual finding.
-
-
- Finding: Describes an individual finding.
-
-
-
-
-
-
- Finding Title
- The title for this finding.
-
-
- Finding Title: The title for this finding.
-
-
-
-
-
-
-
-
-
-
- Finding Description
- A human-readable description of this finding.
-
-
- Finding Description: A human-readable description of this finding.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Implementation Statement UUID
- A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
-
-
- Implementation Statement UUID: A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
-
-
-
-
-
-
-
-
- Related Observation
- Relates the finding to a set of referenced observations that were used to determine the finding.
-
-
- Related Observation: Relates the finding to a set of referenced observations that were used to determine the finding.
-
-
-
-
- Observation Universally Unique Identifier Reference
- A machine-oriented identifier reference to an observation defined in the list of observations.
-
-
- Observation Universally Unique Identifier Reference: A machine-oriented identifier reference to an observation defined in the list of observations.
-
-
-
-
-
-
-
-
- Associated Risk
- Relates the finding to a set of referenced risks that were used to determine the finding.
-
-
- Associated Risk: Relates the finding to a set of referenced risks that were used to determine the finding.
-
-
-
-
- Risk Universally Unique Identifier Reference
- A machine-oriented identifier reference to a risk defined in the list of risks.
-
-
- Risk Universally Unique Identifier Reference: A machine-oriented identifier reference to a risk defined in the list of risks.
-
-
-
-
-
-
-
- Remarks
- Additional commentary about the containing object.
-
-
- Remarks: Additional commentary about the containing object.
-
-
-
-
-
-
-
-
-
- Finding Universally Unique Identifier
- A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
-
-
- Finding Universally Unique Identifier: A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
-
-
-
@@ -3174,6 +3036,144 @@
+
+
+
+ Finding
+ Describes an individual finding.
+
+
+ Finding: Describes an individual finding.
+
+
+
+
+
+
+ Finding Title
+ The title for this finding.
+
+
+ Finding Title: The title for this finding.
+
+
+
+
+
+
+
+
+
+
+ Finding Description
+ A human-readable description of this finding.
+
+
+ Finding Description: A human-readable description of this finding.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Implementation Statement UUID
+ A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+ Implementation Statement UUID: A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+
+
+
+
+
+
+ Related Observation
+ Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+ Related Observation: Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+
+
+ Observation Universally Unique Identifier Reference
+ A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+ Observation Universally Unique Identifier Reference: A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+
+
+
+
+
+
+ Associated Risk
+ Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+ Associated Risk: Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+
+
+ Risk Universally Unique Identifier Reference
+ A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+ Risk Universally Unique Identifier Reference: A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+
+
+
+
+
+ Remarks
+ Additional commentary about the containing object.
+
+
+ Remarks: Additional commentary about the containing object.
+
+
+
+
+
+
+
+
+
+ Finding Universally Unique Identifier
+ A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+ Finding Universally Unique Identifier: A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+
diff --git a/xml/schema/oscal_complete_schema.xsd b/xml/schema/oscal_complete_schema.xsd
index 6d999a5dab..0662d32010 100644
--- a/xml/schema/oscal_complete_schema.xsd
+++ b/xml/schema/oscal_complete_schema.xsd
@@ -6680,6 +6680,144 @@
+
+
+
+ Finding
+ Describes an individual finding.
+
+
+ Finding: Describes an individual finding.
+
+
+
+
+
+
+ Finding Title
+ The title for this finding.
+
+
+ Finding Title: The title for this finding.
+
+
+
+
+
+
+
+
+
+
+ Finding Description
+ A human-readable description of this finding.
+
+
+ Finding Description: A human-readable description of this finding.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Implementation Statement UUID
+ A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+ Implementation Statement UUID: A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+
+
+
+
+
+
+ Related Observation
+ Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+ Related Observation: Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+
+
+ Observation Universally Unique Identifier Reference
+ A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+ Observation Universally Unique Identifier Reference: A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+
+
+
+
+
+
+ Associated Risk
+ Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+ Associated Risk: Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+
+
+ Risk Universally Unique Identifier Reference
+ A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+ Risk Universally Unique Identifier Reference: A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+
+
+
+
+
+ Remarks
+ Additional commentary about the containing object.
+
+
+ Remarks: Additional commentary about the containing object.
+
+
+
+
+
+
+
+
+
+ Finding Universally Unique Identifier
+ A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+ Finding Universally Unique Identifier: A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+
@@ -8139,7 +8277,7 @@
minOccurs="0"
maxOccurs="unbounded"/>
@@ -8167,144 +8305,6 @@
-
-
-
- Finding
- Describes an individual finding.
-
-
- Finding: Describes an individual finding.
-
-
-
-
-
-
- Finding Title
- The title for this finding.
-
-
- Finding Title: The title for this finding.
-
-
-
-
-
-
-
-
-
-
- Finding Description
- A human-readable description of this finding.
-
-
- Finding Description: A human-readable description of this finding.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Implementation Statement UUID
- A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
-
-
- Implementation Statement UUID: A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
-
-
-
-
-
-
-
-
- Related Observation
- Relates the finding to a set of referenced observations that were used to determine the finding.
-
-
- Related Observation: Relates the finding to a set of referenced observations that were used to determine the finding.
-
-
-
-
- Observation Universally Unique Identifier Reference
- A machine-oriented identifier reference to an observation defined in the list of observations.
-
-
- Observation Universally Unique Identifier Reference: A machine-oriented identifier reference to an observation defined in the list of observations.
-
-
-
-
-
-
-
-
- Associated Risk
- Relates the finding to a set of referenced risks that were used to determine the finding.
-
-
- Associated Risk: Relates the finding to a set of referenced risks that were used to determine the finding.
-
-
-
-
- Risk Universally Unique Identifier Reference
- A machine-oriented identifier reference to a risk defined in the list of risks.
-
-
- Risk Universally Unique Identifier Reference: A machine-oriented identifier reference to a risk defined in the list of risks.
-
-
-
-
-
-
-
- Remarks
- Additional commentary about the containing object.
-
-
- Remarks: Additional commentary about the containing object.
-
-
-
-
-
-
-
-
-
- Finding Universally Unique Identifier
- A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
-
-
- Finding Universally Unique Identifier: A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
-
-
-
@@ -8376,6 +8376,10 @@
type="oscal-assessment-common-risk-ASSEMBLY"
minOccurs="0"
maxOccurs="unbounded"/>
+
+
+
+
+
+ Related Finding
+ Relates the poam-item to referenced finding(s).
+
+
+ Related Finding: Relates the poam-item to referenced finding(s).
+
+
+
+
+ Finding Universally Unique Identifier Reference
+ A machine-oriented identifier reference to a finding defined in the list of findings.
+
+
+ Finding Universally Unique Identifier Reference: A machine-oriented identifier reference to a finding defined in the list of findings.
+
+
+
+
diff --git a/xml/schema/oscal_poam_schema.xsd b/xml/schema/oscal_poam_schema.xsd
index 13a168a887..f3ee3e7cad 100644
--- a/xml/schema/oscal_poam_schema.xsd
+++ b/xml/schema/oscal_poam_schema.xsd
@@ -54,6 +54,10 @@
type="oscal-assessment-common-risk-ASSEMBLY"
minOccurs="0"
maxOccurs="unbounded"/>
+
+
+
+
+
+ Related Finding
+ Relates the poam-item to referenced finding(s).
+
+
+ Related Finding: Relates the poam-item to referenced finding(s).
+
+
+
+
+ Finding Universally Unique Identifier Reference
+ A machine-oriented identifier reference to a finding defined in the list of findings.
+
+
+ Finding Universally Unique Identifier Reference: A machine-oriented identifier reference to a finding defined in the list of findings.
+
+
+
+
@@ -3794,6 +3820,144 @@
+
+
+
+ Finding
+ Describes an individual finding.
+
+
+ Finding: Describes an individual finding.
+
+
+
+
+
+
+ Finding Title
+ The title for this finding.
+
+
+ Finding Title: The title for this finding.
+
+
+
+
+
+
+
+
+
+
+ Finding Description
+ A human-readable description of this finding.
+
+
+ Finding Description: A human-readable description of this finding.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Implementation Statement UUID
+ A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+ Implementation Statement UUID: A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related.
+
+
+
+
+
+
+
+
+ Related Observation
+ Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+ Related Observation: Relates the finding to a set of referenced observations that were used to determine the finding.
+
+
+
+
+ Observation Universally Unique Identifier Reference
+ A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+ Observation Universally Unique Identifier Reference: A machine-oriented identifier reference to an observation defined in the list of observations.
+
+
+
+
+
+
+
+
+ Associated Risk
+ Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+ Associated Risk: Relates the finding to a set of referenced risks that were used to determine the finding.
+
+
+
+
+ Risk Universally Unique Identifier Reference
+ A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+ Risk Universally Unique Identifier Reference: A machine-oriented identifier reference to a risk defined in the list of risks.
+
+
+
+
+
+
+
+ Remarks
+ Additional commentary about the containing object.
+
+
+ Remarks: Additional commentary about the containing object.
+
+
+
+
+
+
+
+
+
+ Finding Universally Unique Identifier
+ A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+ Finding Universally Unique Identifier: A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document.
+
+
+