Baseline Documents OSCAL Version is 1.0.4 when 1.1.1 is Out

[hahsan-ti]

• This is a ...

  • concern - I think something needs to be different.
  • question - I didn't understand something.
  • kudos - I found something helpful and want to encourage it in future FedRAMP publications.
  • request - I would like to see something additional provided.

• This relates to ...

  • the FedRAMP OSCAL Registry (Excel File)
  • the Guide to OSCAL-based FedRAMP Content (PDF)
  • the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR) (PDF)
  • the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • General/Overall
  • Other

• Where, exactly?

• In FedRAMP Rev 4 and 5 OSCAL files XML and others, the OSCAL version used is 1.0.4, when (at the time of creating this issue) 1.1.1 is out. For example see FedRAMP_rev5_HIGH-baseline-resolved-profile_catalog.xml line 8 or xpath: catalog/metadata/osca-version.

• What is your feedback?

I would like to know why FedRAMP OSCAL files are behind in OSCAL versions. I'd assume that this number should be updated whenever there is a minor update -- I can live without patch updates.

• What version of OSCAL are you using? (Check our info on supported OSCAL versions)

I want to be using 1.1.1 but I'm using 1.0.4 because of the baseline documents.

• What action would you like to see from the FedRAMP PMO?

Just a helpful comment :-)

• Other information (e.g. detailed explanation, related issues, suggestions how to fix, links for us to have context, eg. slack, gitter, etc)

[volpet2014]

FedRAMP is planning on updating to 1.1.1 by mid-October at the latest. We are working through validation issues from Rev 4 and Rev 5 baselines which are requiring changes to Schematron and Rev 5 profiles.