Implementation Layer Samples

[brian-ruf]

User Story:

As an OSCAL implementer, I would benefit from examples demonstrating both component and SSP content.

NOTE: Due to the sensitivity of SSP content, samples must be fictitious.

Goals:

• Provide component examples, that cover several use cases, including a single vendor product, a single policy or process, and a capability comprised of a grouping of products, policies, and processes.
• Provide SSP examples that cover several use cases, including "flat-file" SSP (classic word-based document conversion), and a component-based SSP.

Dependencies:

Issue usnistgov/OSCAL#246

Acceptance Criteria

• At least one component example of an Individual product or service
• At least one component example of a policy or procedure
• At least one component example of a capability, consisting of one or more products, one or more policies, and one or more procedures.
• At least one flat-file SSP example
• At least one component-based SSP example

[david-waltermire]

We need both SSP and Component samples. These should be artificial, constructed samples that will help a content creator better understand the SSP and component models.

[david-waltermire]

A component can be a software application, service, technology, policy, procedure, or an aggregation of the previous. Some specific examples of each type would be helpful.

[iMichaela]

9/5/2019

The existing SSP sample needs a review to make sure the syntax did not change and the sample is still valid. A different sample might be needed to exercise the component aggregation approach of the SSP layer. @JoshLoveUSAF's small planned sample might be useful here.

[david-waltermire]

This issue was partially addressed by PR usnistgov/OSCAL#492, which includes a component-based SSP. More work is needed to complete the other samples. Adding to sprint 25.

[bradh]

Can this task be split into individual tasks? The acceptance criteria is:

1. At least one component example of an Individual product or service
2. At least one component example of a policy or procedure
3. At least one component example of a capability, consisting of one or more products, one or more policies, and one or more procedures.
4. At least one flat-file SSP example
5. At least one component-based SSP example

It looks like 5 was implemented in usnistgov/OSCAL#492

I have a sample in usnistgov/OSCAL#585 that could be useful for 1, when its reviewed / complete.

[AdamOlineDOJ]

Here is a sample SSP generated from DOJ's Cyber Security Assessment and Management (CSAM) tool populated with fictional data. The CSAM SSP format was designed to follow the NIST 800-18 Rev1 guidelines fairly closely.

The Minimum Security Controls section contains an artificially small subset of Controls compared with typical real-world SSPs. The intent was to include a small sample of Controls demonstrating various applicability scenarios (e.g. Applicable, Fully Inherited, Hybrid Inherited).

CSAM SystemSecurityPlan Sample For OSCAL.docx

[david-waltermire]

These samples have been provided by way of templates in the FedRAMP automation repository and also by the examples (SSP and component) in the OSCAL content GitHub repository.