Action Item

This is a ...

• fix - Something needs to be different.
• enhancement - Something could be better.
• [ X] investigation - Something needs to be investigated further.

This relates to ...

• the FedRAMP OSCAL Registry (Excel File)
• the Guide to OSCAL-based FedRAMP Content (PDF)
• [ X] the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
• the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
• the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR) (PDF)
• the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
• the FedRAMP SSP OSCAL Template (JSON or XML Format)
• the FedRAMP SAP OSCAL Template (JSON or XML Format)
• the FedRAMP SAR OSCAL Template (JSON or XML Format)
• the FedRAMP POA&M OSCAL Template (JSON or XML Format)
• General/Overall
• Other

NOTE: For issues related to the OSCAL syntax itself, please create or add to an issue in the NIST OSCAL Repository.

Describe the problem or enhancement

There is no information related to how to handle the adjustments to the users section as it relates to the separation of duties SSP template changes for Rev 5 doc template. This was an overhaul from rev 4 to rev 5, and we need confirmation that specific elements are still required for OSCAL. Elements which include sensitivity, privilege-level, and type.

Goals:

Understanding of how users relates to the separation of duties table, and clear guidance on how to incorporate the different props into this table/feature. If select elements are being removed, clear descriptions and an update to the OSCAL guide so the props are no longer included.

Dependencies:

Update of FedRAMP SSP OSCAL guide to capture all elements and interdependencies. Determination if the SSP doc Template, or the OSCAL Template is the definitive source of truth (which will help with base lines and other discrepancies).

Acceptance Criteria

• [X ] All FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.
• A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

Other Comments

{Add any other context about the problem here.}