Research Effort: Determine changes and revisions required in the development mapping model.

[Compton-US]

Problem Statement

The mapping model has been available through the development branch, and there are a number of requests to modify and improve the model before release.

• Relates to: OSCAL mapping model support for identifying controls in a catalog that are not mapped OSCAL#1333
• All issues related to mapping requirements and feedback need to be consolidated and synthesized.
• Findings were produced at the end of 2022, but not shared. These need to be summarized as a part of the effort.
• A draft of updates to the model needs to be produced.

Summary of Issues

• Spiral: Determine approach to documenting in the SSP and Component Definition a mapped control or statement. #32 (ssp referencing)
• Spiral: Determine approach to mapping with context of evidence #30 (evidence)
• Spiral: Determine approach for unmapped items in a mapping. #29 (unmapped)
• Spiral: Change Request creation for a provenance assembly in mapping. #28 (provenance)
• Spiral: Change Request creation for a qualifier assembly/tag in mapping. #27 (qualifier)
• Research Effort: Determine changes and revisions required in the development mapping model. #18 (primary)

Reference Links

• Reference Prototype: https://pages.nist.gov/OSCAL-Reference/models/prototype-mapping-model/
• Working Branch: https://github.com/usnistgov/OSCAL/tree/prototype-mapping-model
• Previous Development Model: https://github.com/usnistgov/OSCAL/tree/feature-mapping
• Spiral Documents: https://github.com/usnistgov/OSCAL-DEFINE/tree/main/research-2023/effort-mapping-model

Note: The prototype builds on the previous development model.

[Compton-US]

@iMichaela if the scope of this effort looks good to you, can you comment with concurrence, and/or any additions?

• Spiral 1 will be to consolidate all needs/findings into one document (because there were more related issues that 1333 above)
• Spiral 2 will be to create a draft of revisions for engineering.

[Compton-US]

@iMichaela I'm going to go ahead and move this to ready and discovery based on our April 26 meeting. Will be initiating a first spiral for consolidation of all findings up to this point. We can decide where to go next after we have that spiral content.

[RS-Credentive]

You may already be aware of this, but @iMichaela pointed me to NISTIR 8278, which is related to the OLIR. It provides a very informative model for conceptualizing policy mapping. If we haven't already, we should borrow concepts from this approach.

[Compton-US]

You may already be aware of this, but @iMichaela pointed me to NISTIR 8278, which is related to the OLIR. It provides a very informative model for conceptualizing policy mapping. If we haven't already, we should borrow concepts from this approach.

Thanks @RS-Credentive! I was reading through it last week, and have plans to cite it on the current spiral. Drafts should start appearing this week.

[Compton-US]

I did not create a spiral issue for this topic, but want to capture it here in case we decide to do this at some other point in the research on this effort.

• Option: String Marker in Qualifer

There are many approaches to address a concept like this, at differing levels of complexity and capability.