Inventory - Scan Type

[Rene2mt]

Constraint Task

Consistent with issue #813, these constraints focus on checking that (where applicable) scan type information is provided as part of the inventory.

Intended Outcome

• Every (software?) inventory-item MUST indicate one or more scan type(s), either within the inventory-item itself, or within the component linked by the inventory-item.
• Allowed values must be enforced.
• If the provided value is 'other' or 'not-applicable' for the "scan-type", then the remarks field must be present.

Syntax Type

This is a FedRAMP constraint in the FedRAMP-specific namespace.

Allowed Values

FedRAMP allowed values must be defined or verified.

Metapath(s) to Content

<!-- CONSTRAINT 1 -->
context="//inventory-item"

target=". | //component[@uuid=./implemented-component/@component-uuid]"

exists(./prop[@name='scan-type' @ns='http://fedramp.gov/ns/oscal'])

---
<!-- CONSTRAINT 2 -->

target=". | //component[@uuid=./implemented-component/@component-uuid]/prop[@name='scan-type' @ns='http://fedramp.gov/ns/oscal']/@value"

allow-others: No
- infrastructure: this item is scanned with an infrastructure or operating vulnerability scanner
- database: this item is scanned with a database vulnerability scanner 
- web: this item is scanned with a web vulnerability scanner
- other: this item is scanned with a non-typical vulnerability scanner as described in the remarks
- not-applicable: scanning does not apply to this item as justified in the remarks 

---
<!-- CONSTRAINT 3 -->

exists(target=". | //component[@uuid=./implemented-component/@component-uuid]/prop[@name='scan-type' @ns='http://fedramp.gov/ns/oscal' @value=('other', 'not-applicable')]/remarks")

Purpose of the OSCAL Content

No response

Dependencies

No response

Acceptance Criteria

• All OSCAL adoption content affected by the change in this issue have been updated in accordance with the Documentation Standards.
  • Explanation is present and accurate
  • sample content is present and accurate
  • Metapath is present, accurate, and does not throw a syntax exception using oscal-cli metaschema metapath eval -e "expression".
• All constraints associated with the review task have been created
• The appropriate example OSCAL file is updated with content that demonstrates the FedRAMP-compliant OSCAL presentation.
• The constraint conforms to the FedRAMP Constraint Style Guide.
  • All automated and manual review items that identify non-conformance are addressed; or technical leads (David Waltermire; AJ Stein) have approved the PR and “override” the style guide requirement.
• Known good test content is created for unit testing.
• Known bad test content is created for unit testing.
• Unit testing is configured to run both known good and known bad test content examples.
• Passing and failing unit tests, and corresponding test vectors in the form of known valid and invalid OSCAL test files, are created or updated for each constraint.
• A Pull Request (PR) is submitted that fully addresses the goals section of the User Story in the issue.
• This issue is referenced in the PR.

Other information

No response