Control Mapping in OSCAL JSON Allows an Empty Relationship Object

[aj-stein-nist]

Question

@openprivacy pointed out today during the OSCAL Model Meeting in the current version of the develop branch's Control Mapping Model as of 37a3f11, the "relationship": {} can be defined as empty. And relationship has a required minimum cardinality of 1. It is not sure this is intentional or an area for improvement.

[iMichaela]

@Compton-NIST - Can you please add this issue to the list of the Control Mapping Model issues you planned on reviewing? Even though issue #1333 documents the need of identifying the gaps, empty relationship is most likely not the desired solution but rather a bug.

[Compton-US]

@iMichaela Will do!

[david-waltermire]

I am not sure this is a schema issue.

Looking at the XML and JSON implementations, the relationship value is required.

This appears to be an issue with the generated documentation instead.

[david-waltermire]

@aj-stein-nist investigated this with me and we identified a JSON schema generation bug that is causing this. usnistgov/metaschema#240 was created to fix the schema generation bug. Nothing more to do here until that issue is resolved.

The documentation is also buggy. Issue usnistgov/metaschema#241 was established to fix this.

Once these issues are addressed and the fixes confirmed, this issue can be closed.

[Compton-US]

To do after fixes:

• Validate that the relationship is correct in the json schema.
• Review documentation to ensure it is accurate for relationship.

[david-waltermire]

@aj-stein-nist Can you confirm that develop has been updated to point to the latest Metaschema submodule commit?

[aj-stein-nist]

@aj-stein-nist Can you confirm that develop has been updated to point to the latest Metaschema submodule commit?

This still needs CI/CD fixes, need to circle back of this during the sprint.

[aj-stein-nist]

Sigh also blocked by usnistgov/oscal-content#116. Moving to the following sprint after the recently started one. Marking this as blocked.

[aj-stein-nist]

It appears the relevant work was previously completed and oscal-content testing is no longer necessary, closing.