Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Response Point for Objective too low to cover entire control statement (si-4.24) #404

Open
1 task
Telos-sa opened this issue Mar 29, 2023 · 1 comment
Open
1 task
Assignees
Labels

Comments

@Telos-sa
Copy link

Action Item

This is a ...

  • [ X ] fix - Something needs to be different.

This relates to ...

  • [ X ] Other FedRAMP Baseline Profiles

NOTE: For issues related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

Describe the problem or enhancement

SI-4.24 statement - The information system discovers, collects, distributes, and uses indicators of compromise.

However the test objective to validate is:
SI-4(24)[1] - discovers indicators of compromise;

This is only a portion of the control. Requesting that the response points either move up one level to si-4.24_obj, or the additional response points for SI-4(24)[2], SI-4(24)[3], and SI-4(24)[4] are added to ensure full coverage of the control.

Goals:

{A clear and concise description of what you want to happen. This should be outcome focused. Include concise description of any alternative solutions or features you've considered. Feel free to include screenshots or examples about the feature request here.}

Dependencies:

{Describe any previous issues or related work that must be completed to start or complete this issue.}

Acceptance Criteria

  • All FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.
  • [ X ] A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.
@volpet2014
Copy link
Contributor

Verified by @Rene2mt/@volpet2014 as an issue. Response points should either be moved to the parent part (e.g., SI-4(24)) or added to all its child parts (SI-4(24)[1], SI-4(24)[2], ...). A subsequent PR will be opened to address a fix for this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: 📋 Backlog
Development

No branches or pull requests

4 participants