From abd191235b0a498189bca30b82197ffc588e137a Mon Sep 17 00:00:00 2001
From: Guy Zylberberg <guyzyl@gmail.com>
Date: Sun, 13 Mar 2022 19:01:24 +0200
Subject: [PATCH 1/2] Create`<define-assembly name="impact">`

This fixes issues #1129
---
 src/metaschema/oscal_ssp_metaschema.xml | 69 +++++++++----------------
 1 file changed, 24 insertions(+), 45 deletions(-)

diff --git a/src/metaschema/oscal_ssp_metaschema.xml b/src/metaschema/oscal_ssp_metaschema.xml
index e6bee63bfc..1bfc424623 100644
--- a/src/metaschema/oscal_ssp_metaschema.xml
+++ b/src/metaschema/oscal_ssp_metaschema.xml
@@ -236,51 +236,15 @@
           <assembly ref="link" max-occurs="unbounded">
             <group-as name="links" in-json="ARRAY"/>
           </assembly>
-          <define-assembly name="confidentiality-impact" min-occurs="1">
-            <formal-name>Confidentiality Impact Level</formal-name>
-            <description>The expected level of impact resulting from the unauthorized disclosure of the described information.</description>
-            <model>
-              <assembly ref="property" max-occurs="unbounded">
-                <group-as name="props" in-json="ARRAY"/>
-              </assembly>
-              <assembly ref="link" max-occurs="unbounded">
-                <group-as name="links" in-json="ARRAY"/>
-              </assembly>
-              <field ref="base" min-occurs="1"/>
-              <field ref="selected"/>
-              <field ref="adjustment-justification" in-xml="WITH_WRAPPER"/>
-            </model>
-          </define-assembly>
-          <define-assembly name="integrity-impact" min-occurs="1">
-            <formal-name>Integrity Impact Level</formal-name>
-            <description>The expected level of impact resulting from the unauthorized modification of the described information.</description>
-            <model>
-              <assembly ref="property" max-occurs="unbounded">
-                <group-as name="props" in-json="ARRAY"/>
-              </assembly>
-              <assembly ref="link" max-occurs="unbounded">
-                <group-as name="links" in-json="ARRAY"/>
-              </assembly>
-              <field ref="base" min-occurs="1"/>
-              <field ref="selected"/>
-              <field ref="adjustment-justification" in-xml="WITH_WRAPPER"/>
-            </model>
-          </define-assembly>
-          <define-assembly name="availability-impact" min-occurs="1">
-            <formal-name>Availability Impact Level</formal-name>
-            <description>The expected level of impact resulting from the disruption of access to or use of the described information or the information system.</description>
-            <model>
-              <assembly ref="property" max-occurs="unbounded">
-                <group-as name="props" in-json="ARRAY"/>
-              </assembly>
-              <assembly ref="link" max-occurs="unbounded">
-                <group-as name="links" in-json="ARRAY"/>
-              </assembly>
-              <field ref="base" min-occurs="1"/>
-              <field ref="selected"/>
-              <field ref="adjustment-justification" in-xml="WITH_WRAPPER"/>
-            </model>
-          </define-assembly>
+          <assembly ref="impact">
+            <use-name>confidentiality-impact</use-name>
+          </assembly>
+          <assembly ref="impact">
+            <use-name>integrity-impact</use-name>
+          </assembly>
+          <assembly ref="impact">
+            <use-name>availability-impact</use-name>
+          </assembly>
         </model>
         <constraint>
           <expect level="WARNING" target="." test="@uuid">
@@ -318,6 +282,21 @@
       </allowed-values>
     </constraint>
   </define-assembly>
+  <define-assembly name="impact">
+    <formal-name>Impact Level</formal-name>
+    <description>The expected level of impact resulting from the described information.</description>
+    <model>
+      <assembly ref="property" max-occurs="unbounded">
+        <group-as name="props" in-json="ARRAY"/>
+      </assembly>
+      <assembly ref="link" max-occurs="unbounded">
+        <group-as name="links" in-json="ARRAY"/>
+      </assembly>
+      <field ref="base" min-occurs="1"/>
+      <field ref="selected"/>
+      <field ref="adjustment-justification" in-xml="WITH_WRAPPER"/>
+    </model>
+  </define-assembly>
   <define-field name="base" as-type="string" scope="local">
     <formal-name>Base Level (Confidentiality, Integrity, or Availability)</formal-name>
     <description>The prescribed base (Confidentiality, Integrity, or Availability) security impact level.</description>

From 1eb306a35dc6f46dc2de9e51ee883653dddfb367 Mon Sep 17 00:00:00 2001
From: David Waltermire <david.waltermire@nist.gov>
Date: Thu, 25 Aug 2022 07:47:34 -0400
Subject: [PATCH 2/2] Restored C/I/A formal names and descriptions.

---
 src/metaschema/oscal_ssp_metaschema.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/metaschema/oscal_ssp_metaschema.xml b/src/metaschema/oscal_ssp_metaschema.xml
index 1bfc424623..de446373a2 100644
--- a/src/metaschema/oscal_ssp_metaschema.xml
+++ b/src/metaschema/oscal_ssp_metaschema.xml
@@ -237,12 +237,18 @@
             <group-as name="links" in-json="ARRAY"/>
           </assembly>
           <assembly ref="impact">
+            <formal-name>Confidentiality Impact Level</formal-name>
+            <description>The expected level of impact resulting from the unauthorized disclosure of the described information.</description>
             <use-name>confidentiality-impact</use-name>
           </assembly>
           <assembly ref="impact">
+            <formal-name>Integrity Impact Level</formal-name>
+            <description>The expected level of impact resulting from the unauthorized modification of the described information.</description>
             <use-name>integrity-impact</use-name>
           </assembly>
           <assembly ref="impact">
+            <formal-name>Availability Impact Level</formal-name>
+            <description>The expected level of impact resulting from the disruption of access to or use of the described information or the information system.</description>
             <use-name>availability-impact</use-name>
           </assembly>
         </model>