Automation is difficult with OSCAL catalog named parameters

[degenaro]

• This is a ...

  • concern - I think something needs to be different.
  • question - I didn't understand something.
  • kudos - I found something helpful and want to encourage it in future FedRAMP publications.
  • request - I would like to see something additional provided.

• This relates to ...

  • the FedRAMP OSCAL Registry (Excel File)
  • the Guide to OSCAL-based FedRAMP Content (PDF)
  • the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Reports (SAR) (PDF)
  • the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • General/Overall
  • Other

NOTE: For feedback related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

• Where, exactly?
  • For the registry, please indicate the tab and cell, or other clear identifier
  • For the guide, please indicate the section number and printed page number (lower right corner)
  • For the OSCAL XML or JSON files, please indicate XML or JSON; and indicate the line number, field id, or other clear location identifier

References:

1. https://www.fedramp.gov/assets/resources/templates/FedRAMP-SSP-Moderate-Baseline-Template.docx
2. https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev4/json/NIST_SP-800-53_rev4_catalog.json

Further details given below.

• What is your feedback?

Good case:

In FedRAMP-SSP-Moderate-Baseline-Template we see:

Correspondingly in NIST 800-53 we see:

This allows for easy mapping between:

PS-7(d)-1 : ps-7_prm_1

PS-7(d)-2 : ps-7_prm_2

Bad case:

In FedRAMP-SSP-Moderate-Baseline-Template we see:

Correspondingly in NIST 800-53 we see:

This does not allow for easy mapping between:

SI-6(d)-2 : si-6_prm_7

• Is this report specifically related to the Word or Excel files from fedramp.gov? If so, please do not open an issue here. Follow the guidance in this repository's README and contact [email protected].

Yes. However, @Rene2mt requested that an issue be opened.

• What version of OSCAL are you using? (Check our info on supported OSCAL versions)

1.0.2

• What action would you like to see from the FedRAMP PMO?

The documentation (ref 1) and/or the OSCAL catalog (ref 2) should provide means to easily map parameters, such as SI-6(d)-2 to si-6_prm_7.

• Other information (e.g. detailed explanation, related issues, suggestions how to fix, links for us to have context, eg. slack, gitter, etc)

See usnistgov/OSCAL#1426