usnistgov · wendellpiez · Dec 15, 2020 · Dec 15, 2020 · Dec 15, 2020 · Dec 16, 2020
diff --git a/README.md b/README.md
@@ -10,11 +10,11 @@ These files are maintained by a Continuous Integration and Continuous Deployment
 
 The structure and contents of the examples directory are as follows:
 
-- [components](components): This directory contains sample OSCAL component files.
+- [examples](examples): This directory contains sample OSCAL content organized by OSCAL model.
 - [fedramp.gov](fedramp.gov): This directory contains OSCAL examples of the low, moderate, and high baselines defined by the Federal Risk and Authorization Management Program (FedRAMP).
 - [mini-testing](mini-testing): This directory contains sample files that can be used for unit testing in support of regressions of OSCAL.
 - [nist.gov/SP800-53/rev4](nist.gov/SP800-53/rev4): This directory contains OSCAL examples of the catalog, and low, moderate, and high baselines defined by NIST Special Publication (SP) [800-53 Revision 4](https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final).
 - [nist.gov/SP800-53/rev5](nist.gov/SP800-53/rev5): This directory contains OSCAL examples of the catalog, and low, moderate, and high baselines defined by NIST Special Publication (SP) [800-53 Revision 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final[) and [SP 800-53B](https://csrc.nist.gov/publications/detail/sp/800-53b/final) respectively.
   - [nist.gov/SP800-53/rev5/draft](nist.gov/SP800-53/rev5/draft): Earlier releases of draft content for the Final Public Draft (FPD) version of the Revision 5 catalog and baselines. These drafts, are now superseded by the final versions above, and are provided for reference only.
 - [src](src): This directory contains the source files for all the OSCAL examples located in this repository.
-- [ssp-example](ssp-examples): This directory contains mock-up examples of the OSCAL SSP data model.
+
diff --git a/examples/README.md b/examples/README.md
@@ -0,0 +1,13 @@
+# OSCAL Model-Specific Examples
+
+This directory contains OSCAL examples organized by their corresponding OSCAL model.
+
+The contents of the examples directory are as follows:
+
+- [catalog](catalog): This directory contains sample content for the OSCAL [catalog][catalog-model] model.
+- [component-definition](component-definition): This directory contains sample content for the OSCAL [component definition][component-definition-model] model.
+- [ssp](ssp): This directory contains sample content for the OSCAL [system security plan][ssp-model] (SSP) model.
+
+[catalog-model]: https://pages.nist.gov/OSCAL/documentation/schema/catalog-layer/catalog/
+[component-definition-model]: https://pages.nist.gov/OSCAL/documentation/schema/implementation-layer/component/
+[ssp-model]: https://pages.nist.gov/OSCAL/documentation/schema/implementation-layer/ssp/
diff --git a/examples/catalog/basic-catalog.md b/examples/catalog/basic-catalog.md
@@ -0,0 +1,150 @@
+# Sample Control Catalog
+
+The following catalog examples illustrate a simple control catalog. This catalog is represented in the prose below. OSCAL catalog representations in [XML](xml/basic-catalog.xml), [JSON](json/basic-catalog.json), and [YAML](yaml/basic-catalog.yaml) are also available, which illustrate formatting the prose below in the OSCAL catalog XML, JSON, and YAML formats.
+
+# Example Basic Catalog in Prose
+
+> The following is a short excerpt from [ISO/IEC 27002:2013](https://www.iso.org/standard/54533.html), _Information technology — Security techniques — Code of practice for information security controls_. This work is provided here under copyright "fair use" for non-profit, educational purposes only. Copyrights for this work are held by the publisher, the International Organization for Standardization (ISO).
+
+- Version 1.0
+- Published: 02.02.2020
+- Last Modified: 02.10.2020
+
+## 1 Organization of Information Security
+
+### 1.1 Internal Organization
+
+**Objective:** To establish a management framework to initiate and control the implementation and
+operation of information security within the organization.
+
+#### 1.1.1 Information security roles and responsibilities
+
+**Control**
+
+All information security responsibilities should be defined and allocated.  
+
+**Implementation Guidance**
+
+Allocation of information security responsibilities should be done in accordance with the information security policies. Responsibilities for the protection of individual assets and for carrying out specific information security processes should be identified. Responsibilities for information security risk management activities and in particular for acceptance of residual risks should be defined. These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Local responsibilities for the protection of assets and for carrying out specific security processes should be defined.
+
+Individuals with allocated information security responsibilities may delegate security tasks to others.
+
+Nevertheless, they remain accountable and should determine that any delegated tasks have been correctly performed.
+
+Areas for which individuals are responsible should be stated. In particular the following should take place:
+
+<ol type="a">
+    <li>the assets and information security processes should be identified and defined;</li>
+    <li>the entity responsible for each asset or information security process should be assigned and the details of this responsibility should be documented;</li>
+    <li>authorization levels should be defined and documented;</li>
+    <li>to be able to fulfil responsibilities in the information security area the appointed individuals should be competent in the area and be given opportunities to keep up to date with developments;</li>
+    <li>coordination and oversight of information security aspects of supplier relationships should be identified and documented.</li>
+</ol>
+
+**Other information**
+
+Many organizations appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of controls.
+
+However, responsibility for resourcing and implementing the controls will often remain with individual managers. 
+
+One common practice is to appoint an owner for each asset who then becomes responsible for its day-to-day protection. 
+
+#### 1.1.2 Segregation of duties
+
+**Control**
+
+Conflicting duties and areas of responsibility should be segregated to reduce opportunities for
+unauthorized or unintentional modification or misuse of the organization's assets.
+
+**Implementation guidance**
+
+Care should be taken that no single person can access, modify or use assets without authorization or detection. The initiation of an event should be separated from its authorization. The possibility of collusion should be considered in designing the controls.
+
+Small organizations may find segregation of duties difficult to achieve, but the principle should be applied as far as is possible and practicable. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be considered.
+
+**Other information**
+
+Segregation of duties is a method for reducing the risk of accidental or deliberate misuse of an organization's assets.
+
+## 2 Access Control
+
+### 2.1 Business Requirements of Access Control
+
+**Objective:** To limit access to information and information processing facilities.
+
+#### 2.1.1 Access control policy
+
+**Control**
+
+An access control policy should be established, documented and reviewed based on business and information security requirements.
+
+**Implementation guidance**
+
+Asset owners should determine appropriate access control rules, access rights and restrictions for specific user roles towards their assets, with the amount of detail and the strictness of the controls reflecting the associated information security risks.
+
+Access controls are both logical and physical and these should be considered together.
+
+Users and service providers should be given a clear statement of the business requirements to be met by access controls.
+
+The policy should take account of the following:
+
+<ol type="a">
+    <li>security requirements of business applications;</li>
+    <li>policies for information dissemination and authorization, e.g. the need-to-know principle and information security levels and classification of information;</li>
+    <li>consistency between the access rights and information classification policies of systems and networks;</li>
+    <li>relevant legislation and any contractual obligations regarding limitation of access to data or services;</li>
+    <li>management of access rights in a distributed and networked environment which recognizes all types of connections available;</li>
+    <li>segregation of access control roles, e.g. access request, access authorization, access administration;</li>
+    <li>requirements for formal authorization of access requests;</li>
+    <li>requirements for periodic review of access rights;</li>
+    <li>removal of access rights;</li>
+    <li>archiving of records of all significant events concerning the use and management of user identities and secret authentication information;</li>
+    <li>roles with privileged access.</li>
+</ol>
+
+**Other information**
+
+Care should be taken when specifying access control rules to consider:
+
+<ol type="a">
+    <li>establishing rules based on the premise "Everything is generally forbidden unless expressly permitted" rather than the weaker rule "Everything is generally permitted unless expressly forbidden";</li>
+    <li>changes in information labels that are initiated automatically by information processing facilities and those initiated at the discretion of a user;</li>
+    <li>changes in user permissions that are initiated automatically by the information system and those initiated by an administrator;</li>
+    <li>rules which require specific approval before enactment and those which do not.</li>
+</ol>
+
+Access control rules should be supported by formal procedures and defined responsibilities.
+
+Role based access control is an approach used successfully by many organizations to link access rights with business roles.
+
+Two of the frequent principles directing the access control policy are:
+
+<ol type="a">
+    <li>Need-to-know: you are only granted access to the information you need to perform your tasks (different tasks/roles mean different need-to-know and hence different access profile);</li>
+    <li>Need-to-use: you are only granted access to the information processing facilities (IT equipment, applications, procedures, rooms) you need to perform your task/job/role.</li>
+</ol>
+
+#### 2.1.2 Access to networks and network services
+
+**Control**
+
+Users should only be provided with access to the network and network services that they have been specifically authorized to use.
+
+**Implementation guidance**
+
+A policy should be formulated concerning the use of networks and network services. This policy should cover:
+
+<ol type="a">
+    <li>the networks and network services which are allowed to be accessed;</li>
+    <li>authorization procedures for determining who is allowed to access which networks and networked services;</li>
+    <li>management controls and procedures to protect access to network connections and network services;</li>
+    <li>the means used to access networks and network services (e.g. use of VPN or wireless network);</li>
+    <li>user authentication requirements for accessing various network services;</li>
+    <li>monitoring of the use of network services.</li>
+</ol>
+
+The policy on the use of network services should be consistent with the organization's access control policy.
+
+**Other information**
+
+Unauthorized and insecure connections to network services can affect the whole organization. This control is particularly important for network connections to sensitive or critical business applications or to users in high-risk locations, e.g. public or external areas that are outside the organization's information security management and control.
diff --git a/components/json/example-component-min.json → ...efinition/json/example-component-min.json b/components/json/example-component-min.json → ...efinition/json/example-component-min.json
diff --git a/components/json/example-component.json → ...nt-definition/json/example-component.json b/components/json/example-component.json → ...nt-definition/json/example-component.json
diff --git a/components/xml/example-component.xml → ...nent-definition/xml/example-component.xml b/components/xml/example-component.xml → ...nent-definition/xml/example-component.xml
diff --git a/components/yaml/example-component.yaml → ...nt-definition/yaml/example-component.yaml b/components/yaml/example-component.yaml → ...nt-definition/yaml/example-component.yaml
diff --git a/...json/oscal_leveraged-example_ssp-min.json → ...json/oscal_leveraged-example_ssp-min.json b/...json/oscal_leveraged-example_ssp-min.json → ...json/oscal_leveraged-example_ssp-min.json
diff --git a/...ple/json/oscal_leveraged-example_ssp.json → ...ssp/json/oscal_leveraged-example_ssp.json b/...ple/json/oscal_leveraged-example_ssp.json → ...ssp/json/oscal_leveraged-example_ssp.json
diff --git a/...son/oscal_leveraging-example_ssp-min.json → ...son/oscal_leveraging-example_ssp-min.json b/...son/oscal_leveraging-example_ssp-min.json → ...son/oscal_leveraging-example_ssp-min.json
diff --git a/...le/json/oscal_leveraging-example_ssp.json → ...sp/json/oscal_leveraging-example_ssp.json b/...le/json/oscal_leveraging-example_ssp.json → ...sp/json/oscal_leveraging-example_ssp.json
diff --git a/ssp-example/json/ssp-example-min.json → examples/ssp/json/ssp-example-min.json b/ssp-example/json/ssp-example-min.json → examples/ssp/json/ssp-example-min.json
diff --git a/ssp-example/json/ssp-example.json → examples/ssp/json/ssp-example.json b/ssp-example/json/ssp-example.json → examples/ssp/json/ssp-example.json
diff --git a/...ample/xml/oscal_leveraged-example_ssp.xml → ...s/ssp/xml/oscal_leveraged-example_ssp.xml b/...ample/xml/oscal_leveraged-example_ssp.xml → ...s/ssp/xml/oscal_leveraged-example_ssp.xml
diff --git a/...mple/xml/oscal_leveraging-example_ssp.xml → .../ssp/xml/oscal_leveraging-example_ssp.xml b/...mple/xml/oscal_leveraging-example_ssp.xml → .../ssp/xml/oscal_leveraging-example_ssp.xml
diff --git a/ssp-example/xml/ssp-example.xml → examples/ssp/xml/ssp-example.xml b/ssp-example/xml/ssp-example.xml → examples/ssp/xml/ssp-example.xml
diff --git a/...ple/yaml/oscal_leveraged-example_ssp.yaml → ...ssp/yaml/oscal_leveraged-example_ssp.yaml b/...ple/yaml/oscal_leveraged-example_ssp.yaml → ...ssp/yaml/oscal_leveraged-example_ssp.yaml
diff --git a/...le/yaml/oscal_leveraging-example_ssp.yaml → ...sp/yaml/oscal_leveraging-example_ssp.yaml b/...le/yaml/oscal_leveraging-example_ssp.yaml → ...sp/yaml/oscal_leveraging-example_ssp.yaml
diff --git a/ssp-example/yaml/ssp-example.yaml → examples/ssp/yaml/ssp-example.yaml b/ssp-example/yaml/ssp-example.yaml → examples/ssp/yaml/ssp-example.yaml
diff --git a/oscal b/oscal
diff --git a/src/README.md b/src/README.md
@@ -1,17 +1,17 @@
 ![Process Content](https://github.com/usnistgov/oscal-content/workflows/Process%20Content%20Artifacts/badge.svg)
 
-# OSCAL Examples Source
+# OSCAL Content Sources
 
-This directory contains the source files for all the OSCAL examples located in this repository.
+This directory contains the source files for all the OSCAL content located in this repository.
 
 **Automated:** The source for a given file is in one of the supported XML, JSON, or YAML formats. The Continuous Integration and Continuous Deployment (CI/CD) scripting automatically converts these content sources into the alternate formats. As a result, the example files, who's directories are located in the root directory of this repository, should not be modified. Instead, the source of the file should be edited here.
 
-The structure and contents of the examples directory are as follows:
+The contents of this directory are as follows:
 
- * [nist.gov/SP800-53/rev4](nist.gov/SP800-53/rev4): This directory contains OSCAL examples of the catalog, and low, moderate, and high baselines defined by NIST Special Publication (SP) 800-53 Revision 4.
- * [nist.gov/SP800-53/rev5](nist.gov/SP800-53/rev5): This directory contains OSCAL examples of the catalog, and low, moderate, and high baselines defined by NIST Special Publication (SP) 800-53B Revision 5 and SP 800-53B Revision 5 respectively.
-   * [nist.gov/SP800-53/rev5/draft](nist.gov/SP800-53/rev5/draft): Earlier releases of draft content extractions of the Final Public Draft (FPD) version of the Revision 5 catalog and profiles are available - now superseded, these are provided for reference only.
- * [fedramp.gov](fedramp.gov): This directory contains OSCAL examples of the low, moderate, and high baselines defined by FedRAMP (the Federal Risk and Authorization Management Program).
- * [components](components): This directory contains sample OSCAL component files.
- * [mini-testing](mini-testing): This directory contains sample files that can be used for unit testing in support of regressions of OSCAL.
-
+- [config](config): This configuration file identifies which content files the CI/CD process needs to convert into alternate formats.
+- [examples](examples): This directory contains sample OSCAL content organized by OSCAL model.
+- [fedramp.gov](fedramp.gov): This directory contains OSCAL the low, moderate, and high baselines defined by the [Federal Risk and Authorization Management Program](https://www.fedramp.gov/) (FedRAMP).
+- [mini-testing](mini-testing): This directory contains sample files that can be used for unit testing in support of regressions of OSCAL.
+- [nist.gov/SP800-53/rev4](nist.gov/SP800-53/rev4): This directory contains OSCAL examples of the catalog, and low, moderate, and high baselines defined by NIST Special Publication (SP) [800-53 Revision 4](https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final).
+- [nist.gov/SP800-53/rev5](nist.gov/SP800-53/rev5): This directory contains OSCAL examples of the catalog, and low, moderate, and high baselines defined by NIST Special Publication (SP) [800-53 Revision 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final[) and [SP 800-53B](https://csrc.nist.gov/publications/detail/sp/800-53b/final) respectively.
+  - [nist.gov/SP800-53/rev5/draft](nist.gov/SP800-53/rev5/draft): Earlier releases of draft content for the Final Public Draft (FPD) version of the Revision 5 catalog and baselines. These drafts, are now superseded by the final versions above, and are provided for reference only.
diff --git a/src/components/xml/import_component_definition_ut.xml b/src/components/xml/import_component_definition_ut.xml
diff --git a/src/config b/src/config
@@ -1,7 +1,8 @@
 # path to source|format of source|model of source|format(s) to convert to
-src/ssp-example/json/ssp-example.json|json|ssp|xml
-src/ssp-example/xml/*.xml|xml|ssp|json
-src/components/json/example-component.json|json|component|xml
+src/examples/catalog/xml/*.xml|xml|catalog|json
+src/examples/ssp/xml/*.xml|xml|ssp|json
+src/examples/ssp/json/ssp-example.json|json|ssp|xml
+src/examples/component-definition/json/example-component.json|json|component|xml
 src/fedramp.gov/xml/*profile.xml|xml|profile|json
 src/nist.gov/SP800-53/rev4/xml/*catalog.xml|xml|catalog|json
 src/nist.gov/SP800-53/rev4/xml/*profile.xml|xml|profile|json

diff --git a/src/examples/README.md b/src/examples/README.md
@@ -0,0 +1,13 @@
+# OSCAL Model-Specific Examples
+
+This directory contains the source files for examples organized by their corresponding OSCAL model.
+
+The contents of the examples directory are as follows:
+
+- [catalog](catalog): This directory contains sample content for the OSCAL [catalog][catalog-model] model.
+- [component-definition](component-definition): This directory contains sample content for the OSCAL [component definition][component-definition-model] model.
+- [ssp](ssp): This directory contains sample content for the OSCAL [system security plan][ssp-model] (SSP) model.
+
+[catalog-model]: https://pages.nist.gov/OSCAL/documentation/schema/catalog-layer/catalog/
+[component-definition-model]: https://pages.nist.gov/OSCAL/documentation/schema/implementation-layer/component/
+[ssp-model]: https://pages.nist.gov/OSCAL/documentation/schema/implementation-layer/ssp/