Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for profile tailoring #43

Closed
david-waltermire opened this issue Sep 5, 2017 · 16 comments
Closed

Add support for profile tailoring #43

david-waltermire opened this issue Sep 5, 2017 · 16 comments
Assignees
@wendellpiez @david-waltermire
Labels
LoE: Large Scope: Modeling Issues targeted at development of OSCAL formats User Story
Milestone
OSCAL 1.0 Milesto...

Comments

@david-waltermire
Copy link
Contributor

Goals:

  1. A user can extend an existing profile to create a new profile
  2. A user can choose which controls from a given catalog are excluded from a profile (already done, but needs to be tested). If an extended profile, this should allow controls in the extended profile to be excluded. Build a profile that works by exclusion #34
  3. A user can modify existing statements for a control included in the profile. Use a profile to patch controls #37 The changes made to a control in this way must be discernible. Display the delta between controls #16
  4. A user can set a value for a parameter for a control included in the profile. Set parameter values for controls within the context of the union of multiple profile standards #14
  5. Multiple catalogs must be supported for inclusion of controls.

Dependencies:

  • Existing control catalogs defined for SP 800-53, ISO/IEC 27001/2, COBIT 5
  • Parameters will be used from the SP 800-53 catalog
  • Need a spreadsheet or equivalent content documenting the FedRamp "moderate" baseline

Acceptance Criteria:

  1. A mockup is produced demonstrating implementation of the FedRamp "moderate" baseline that uses profile extension and tailoring features described above (goals 1-4).
  2. A mockup is produced demonstrating implementation of a profile supporting multiple source catalogs used as a basis for a tailored profile. This should include use of all features described above (goals 1-5).
  3. A stylesheet is produced that supports rendering a human-readable view of the profile. The stylesheet will be used with the mockups from items 1 and 2 above.
@akarmel
Copy link
Contributor

akarmel commented Sep 12, 2017

9/12/2017 Sprint Review Call Notes

  • Wendell has been working on this and will show Dave tomorrow.
  • We now have profiles that read profiles. which may create infinite loops. Need to write code to prevent that from happening.
  • We can read multiple catalogs now as well
  • Everything is in one namespace at this time. Namespace needs to be sorted out first.

@wendellpiez
Copy link
Contributor

The current profile resolver XSLT keeps track of profiles it reads, and refuses to read a profile for a second time, thereby preventing cyclic traversals.

This was referenced Sep 19, 2017
Closed
Closed
Closed
Closed
@akarmel
Copy link
Contributor

akarmel commented Sep 19, 2017

9/19/2017 Sprint Review Call Notes

  • This is now working with the exception of one criteria that needs discussion with Dave. Will be addressed during the scheduled working session this Friday.

@akarmel
Copy link
Contributor

akarmel commented Sep 25, 2017

9/25/2017 Sprint Review Call Notes

  • Per Wendell, we're ready to show this next week during the Sprint 4 retrospective / Sprint 5 planning session.
    • Wendell will add a comment to this issue with pointers to the files that require feedback prior to next week's meeting.

@wendellpiez
Copy link
Contributor

wendellpiez commented Sep 27, 2017 •
edited
Loading

A profile describing (what I believe to be*) the MODERATE baseline (profile of SP800-53/a) is here:

working/SP800-53/MODERATE-baseline-profile-oscal.xml

Next to it, you will also find LOW and HIGH.

(*) I say "what I believe to be" since these were pulled via query, and I am assuming both the data and the query are correct. (Under spot checking it looks good.)

Additionally, each of these profile documents can be run through a transformation pipeline that (a) expands (resolves) it against the catalog(s) it calls (always SP800-53-enhanced.xml) and (b) converts it into HTML for display on the web. This addresses point 3 above. The result of running MEDIUM is here:

working/SP800-53/MODERATE-baseline-profile-oscal-rendered.html

... and similarly for the others.

The remaining functionalities relate to correct resolution profiles calling profiles and profiles calling multiple catalogs. A (small) profile calling multiple catalogs is available here:

working/SP800-53/testing-profile.xml

and a profile that calls a profile is here:

working/SP800-53/testing2-profile.xml

They both have rendered (HTML) versions next to them. (The rendering is not what a designer would do but it shows the data with parameter insertion working.)

@wendellpiez
Copy link
Contributor

wendellpiez commented Sep 28, 2017 •
edited
Loading

Additionally, you will find a FedRAMP demo in subdirectory working/FedRAMP. It should have a readme.md explaining it. This together with the "naive" MODERATE baseline mentioned above, should address point 1.

@akarmel
Copy link
Contributor

akarmel commented Oct 24, 2017

10/24/2017 - Sprint 4 Review Call Notes

  • We need to develop an examples directory at the root of OSCAL with complete examples
  • Need to develop a complete, fully reviewed FedRAMP example in the next sprint as a way to prove that we've implemented all the necessary functionality in OSCAL
  • Need to identify requirements around modifying existing statements for a control included in the profile. Use a profile to patch controls #37 The changes made to a control in this way must be discernible. Display the delta between controls #16
  • We will clarify this issue and carry it into Sprint 5

@akarmel
Copy link
Contributor

akarmel commented Oct 31, 2017

10/31/2017 - Sprint 5 Progress Notes

  • Looking at FedRAMP samples and creating artificial, streamlined XML examples per each goal.
    • Andrew will create equivalent JSON examples based off the XML examples
  • Discovering that we will need several new features around the parameters which will be reported next week.
  • Put 800.53 r5 in OSCAL format. With that said, FedRAMP is based off r4.

@wendellpiez
Copy link
Contributor

As of 11/3 we have two separate tracks of activity underway bearing on this Issue

  • In a new /examples/mini-testing directory, we have begun developing a set of unit tests for demonstrating OSCAL functionalities
    • focused initially on profiling and profile-resolution functionalities (semantics of profiling)
    • includes "pathological" examples illustrating range of normal and edge cases
    • eventually it will expand to supporting other regression testing besides profiling e.g. schema(s), Schematron
    • at the same time, it will serve as a public and reference demo
  • We also expect to have a new /examples/FedRAMP directory (as discussed here), contents tbd.

At last week's meeting I admitted that if we worked hard enough, we could perhaps cover the three FedRAMP baselines given the spreadsheet inputs. Now I'd like to qualify this and suggest we aim instead to do enough (a representative subset) so we understand the scale and scope of the entire job -- and prioritize the quality of the expression (as a demo), rather than just slap together the data we have.

@akarmel
Copy link
Contributor

akarmel commented Nov 7, 2017 •
edited
Loading

11/7/2017 - Sprint 5 Progress Notes

  • Per Wendell's comment above, examples subdirectory has been created and associated work is underway.
    - Unit Test examples allows us to regression test the various components of OSCAL.
  • For FedRAMP examples, implemented a rudimentary patching example. Selection parameters haven't been addressed yet.
  • Plan to complete this story by the end of the sprint is to complete the unit tests by the end of the week to pass along to Andrew for the JSON user story, then work on completing the FedRAMP examples.
  • Wendell will reach out to David via email to request feedback. Flag items that require immediate feedback so David can prioritize responses.

@wendellpiez
Copy link
Contributor

The /examples/mini-testing catalog with profiles (various common and exotic), is in place. More examples will be coming.

The /examples/SP800-53 directory now contains more-or-less "reference" or "best available" versions of SP800-53 rev4, and its three defined profiles HIGH, MODERATE and LOW. (How these are related to the production pipeline over in /working/SP800-53, is documented.)

The /examples/FedRAMP directory contains not-yet-finished "castings" of the three FedRAMP spreadsheets, into OSCAL profiles. (These profiles call, respectively, the profiles for HIGH MODERATE and LOW kept in /examples/SP800-53.) These profiles show controls selection, parameterization and patching (if only roughly so far). These too were produced by a semi-automated process maintained in the /working subdirectory (but kept out of the way here); however since the machine cannot do the final revisions, those are left (for demo), with the exception of HIGH, which has been finished about halfway so far.

Andrew has been making regular refreshes to JSON versions of everything.

@akarmel
Copy link
Contributor

akarmel commented Nov 21, 2017

11/21/2017 - Sprint 5 Progress Notes

  • Unit test examples have been created in /examples/mini-testing and are ready for NIST review
  • Readme.md has been updated as well and is ready for NIST review

DETAILED PROGRESS NOTE:
On Github or in your updated copy you will find there is an /examples subdirectory in OSCAL now, containing three subdirectories, including not only the unit tests (/mini-testing) but also the FedRAMP demo (both a /FedRAMP subdir and a subdir /SP800-53 for the latter control catalog and its profiles, on which the FedRAMP profiles depend).

Each directory has a readme.md.

In particular, note that the SP800-53 readme lists the different validations (i.e., not only schema validations but also Schematron) that have been performed on the various files.

Also the FedRAMP readme describes what is going on there. Summary version: while there is definitive progress to show towards getting complete FedRAMP profiles in place (derived from the spreadsheet data) -- it also becomes much clearer where there are "gaps" that have to be bridged in some way.

In some places these are due to gaps remaining in the model (an obvious case would be where catalogs have 'selection' parameters, which as you know we do not support yet), but more pervasively and problematically, they reveal gaps in the process of how we proceed to determine and assign parameter values (with correct syntax and ids) and specify interventions (alterations) -- both in the practical case of these demonstrations, but also more generally (at least if such a process is in scope for OSCAL).

I have made a couple of new issues as placeholders (#66 selection parameters; #67 merging 'invocation trees' in catalog resolution) but nothing about the last set of questions, as I am not yet sure how to address them or what's missing here. (Only that I think something is. Or maybe not: maybe "hand finishing" these profiles is exactly the percentage play here.)

FOR DAVE IN PARTICULAR: Your input before Sprint ends next Tuesday (11/28) would be most welcome especially as it bears on whether we meet acceptance criteria for the user stories. If you are able to take a look at the FedRAMP readme and associated profile examples and provide your thoughts/direction I might still have time to address remaining issues or questions (or at least take notes).

@akarmel
Copy link
Contributor

akarmel commented Nov 29, 2017

11/28/2017 - Sprint 5 Acceptance Notes

  • User Story accepted by David and Michaela
  • David will read through all the examples, see if they are adequately commented and demonstrate adequate functionality with outstanding questions/issues documented as new issues in GitHub for future Sprints.

@david-waltermire
Copy link
Contributor Author

@wendellpiez, Are the latest examples in the sprint-9 branch or are they in your repo in a feature branch? If the latter is true, can you provide a link to your repo branch for me to review?

@wendellpiez
Copy link
Contributor

wendellpiez commented Apr 3, 2018 •
edited
Loading

David @david-waltermire-nist , my repo is here:

https://github.com/wendellpiez/OSCAL/tree/sprint-9

Probably nothing, or not much, in /examples has diverged from the main repo, though I could be wrong. I know they need more than "review"; at least the unit tests are very much partial and WIP.

david-waltermire added a commit that referenced this issue Apr 3, 2018
@david-waltermire
# This is a combination of 29 commits.
5b13d9d 
# The first commit's message is:

# This is a combination of 54 commits.
# The first commit's message is:

# This is a combination of 4 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 6 commits.
# The first commit's message is:

# This is a combination of 3 commits.
# The first commit's message is:

# This is a combination of 111 commits.
# The first commit's message is:

Initial commit of docs branch.

# This is the commit message #2:

Create CONTRIBUTING.md
# This is the commit message #3:

Create ROADMAP.md
# This is the commit message #4:

Update README.md
# This is the commit message #5:

Create README.md
# This is the commit message #6:

Update README.md
# This is the commit message #7:

Update README.md
# This is the commit message #8:

Create OSCAL-PRODUCERS.md
# This is the commit message #9:

Create OSCAL-CONSUMERS.md
# This is the commit message #10:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #11:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #12:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #13:

Update README.md
# This is the commit message #14:

Update README.md
# This is the commit message #15:

Update USERS.md
# This is the commit message #16:

Update README.md
# This is the commit message #17:

Update IMPLEMENTERS.md
# This is the commit message #18:

Update README.md
# This is the commit message #19:

Update ROADMAP.md
# This is the commit message #20:

Update USERS.md
# This is the commit message #21:

Update CONTRIBUTORS.md
# This is the commit message #22:

Update README.md
# This is the commit message #23:

Update README.md
# This is the commit message #24:

Update IMPLEMENTERS.md
# This is the commit message #25:

Update IMPLEMENTERS.md
# This is the commit message #26:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #27:

Create control.md
# This is the commit message #28:

Update control.md
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Add files via upload
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Create temp.md
# This is the commit message #35:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #36:

Add files via upload
# This is the commit message #37:

Delete temp.md
# This is the commit message #38:

Add files via upload
# This is the commit message #39:

Update control.md
# This is the commit message #40:

Add files via upload
# This is the commit message #41:

Add files via upload
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Update CONTRIBUTING.md
# This is the commit message #44:

Update CONTRIBUTING.md
# This is the commit message #45:

Update USERS.md
# This is the commit message #46:

Update CONTRIBUTING.md
# This is the commit message #47:

Delete CONTRIBUTING.md
# This is the commit message #48:

Delete USERS.md
# This is the commit message #49:

Add files via upload
# This is the commit message #50:

Delete CSA-CCM-IAM02.png
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #55:

Update control.md
# This is the commit message #56:

Update control.md
# This is the commit message #57:

Update control.md
# This is the commit message #58:

Update control.md
# This is the commit message #59:

Update control.md
# This is the commit message #60:

Update control.md
# This is the commit message #61:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #62:

Update README.md
# This is the commit message #63:

Update control.md
# This is the commit message #64:

Update control.md
# This is the commit message #65:

Add files via upload
# This is the commit message #66:

Delete ISO-27001-Control-A9.png
# This is the commit message #67:

Update control.md
# This is the commit message #68:

Add files via upload
# This is the commit message #69:

Add files via upload
# This is the commit message #70:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #71:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #72:

Update control.md
# This is the commit message #73:

Update control.md
# This is the commit message #74:

Update control.md
# This is the commit message #75:

Update control.md
# This is the commit message #76:

Update control.md
# This is the commit message #77:

Update README.md
# This is the commit message #78:

Update IMPLEMENTERS.md
# This is the commit message #79:

Add files via upload
# This is the commit message #80:

Delete oscal-layers.png
# This is the commit message #81:

Add files via upload
# This is the commit message #82:

Delete oscal-layers.png
# This is the commit message #83:

Add files via upload
# This is the commit message #84:

Update IMPLEMENTERS.md
# This is the commit message #85:

Update control.md
# This is the commit message #86:

Update IMPLEMENTERS.md
# This is the commit message #87:

Update control.md
# This is the commit message #88:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #89:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #90:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #91:

Create catalog-xml.md
# This is the commit message #92:

Rename control.md to catalog.md
# This is the commit message #93:

Update catalog.md
# This is the commit message #94:

Update catalog.md
# This is the commit message #95:

Update catalog.md
# This is the commit message #96:

Update catalog-xml.md
# This is the commit message #97:

Update catalog-xml.md
# This is the commit message #98:

Update catalog-xml.md
# This is the commit message #99:

Update catalog-xml.md
# This is the commit message #100:

Update catalog-xml.md
# This is the commit message #101:

Update catalog-xml.md
# This is the commit message #102:

Update catalog-xml.md
# This is the commit message #103:

Update catalog-xml.md
# This is the commit message #104:

Update catalog-xml.md
# This is the commit message #105:

Update catalog-xml.md
# This is the commit message #106:

Docset migration to Slate

# This is the commit message #107:

Removing unused file.

# This is the commit message #108:

Update README.md

Corrected a typo
# This is the commit message #109:

Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
# This is the commit message #110:

Create CONTRIBUTING.md
# This is the commit message #111:

Create ROADMAP.md
# This is the commit message #2:

Create README.md
# This is the commit message #3:

Update README.md
# This is the commit message #2:

Create OSCAL-PRODUCERS.md
# This is the commit message #3:

Create OSCAL-CONSUMERS.md
# This is the commit message #4:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #5:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #6:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #2:

Update USERS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #2:

Update ROADMAP.md
# This is the commit message #3:

Update USERS.md
# This is the commit message #4:

Update CONTRIBUTORS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Update IMPLEMENTERS.md
# This is the commit message #4:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #5:

Create control.md
# This is the commit message #6:

Update control.md
# This is the commit message #7:

Update control.md
# This is the commit message #8:

Update control.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Add files via upload
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Create temp.md
# This is the commit message #13:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #14:

Add files via upload
# This is the commit message #15:

Delete temp.md
# This is the commit message #16:

Add files via upload
# This is the commit message #17:

Update control.md
# This is the commit message #18:

Add files via upload
# This is the commit message #19:

Add files via upload
# This is the commit message #20:

Update control.md
# This is the commit message #21:

Update CONTRIBUTING.md
# This is the commit message #22:

Update CONTRIBUTING.md
# This is the commit message #23:

Update USERS.md
# This is the commit message #24:

Update CONTRIBUTING.md
# This is the commit message #25:

Delete CONTRIBUTING.md
# This is the commit message #26:

Delete USERS.md
# This is the commit message #27:

Add files via upload
# This is the commit message #28:

Delete CSA-CCM-IAM02.png
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Update control.md
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Update control.md
# This is the commit message #35:

Update control.md
# This is the commit message #36:

Update control.md
# This is the commit message #37:

Update control.md
# This is the commit message #38:

Update control.md
# This is the commit message #39:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #40:

Update README.md
# This is the commit message #41:

Update control.md
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Add files via upload
# This is the commit message #44:

Delete ISO-27001-Control-A9.png
# This is the commit message #45:

Update control.md
# This is the commit message #46:

Add files via upload
# This is the commit message #47:

Add files via upload
# This is the commit message #48:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #49:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #50:

Update control.md
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Add files via upload
# This is the commit message #4:

Delete oscal-layers.png
# This is the commit message #5:

Add files via upload
# This is the commit message #6:

Delete oscal-layers.png
# This is the commit message #7:

Add files via upload
# This is the commit message #8:

Update IMPLEMENTERS.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Update IMPLEMENTERS.md
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #13:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #14:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #15:

Create catalog-xml.md
# This is the commit message #16:

Rename control.md to catalog.md
# This is the commit message #17:

Update catalog.md
# This is the commit message #18:

Update catalog.md
# This is the commit message #19:

Update catalog.md
# This is the commit message #20:

Update catalog-xml.md
# This is the commit message #21:

Update catalog-xml.md
# This is the commit message #22:

Update catalog-xml.md
# This is the commit message #23:

Update catalog-xml.md
# This is the commit message #24:

Update catalog-xml.md
# This is the commit message #25:

Update catalog-xml.md
# This is the commit message #26:

Update catalog-xml.md
# This is the commit message #27:

Update catalog-xml.md
# This is the commit message #28:

Update catalog-xml.md
# This is the commit message #29:

Fixed typos, updated repo documentation, and migrated documentation for use in Slate.

Corrected a typo (+4 squashed commit)

Squashed commit:

[6ada57f] Removing unused file.

[503ad71] Docset migration to Slate

[351257e] Update catalog-xml.md

[aae1e8b] Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
david-waltermire pushed a commit that referenced this issue Apr 5, 2018
@wendellpiez @david-waltermire
# This is a combination of 60 commits.
840961c 
# The first commit's message is:

Restructuring for new initiative

Moved everything into 'old' and added a new subdirectory for new
experiments.

More early iteration over names

More adjustments in names mostly

HTML page for Word import testing

Just touchups this time

Updates and misc improvements

Changed document element to 'catalog'

Improved and renamed mapping transformation

Adjustments to models, schema, Schematron

Managing gitignore

Same

Minor adjustments

First cut at 27K mapping into OSCAL

Renamed directories for consistency

Cleanup

Bit more cleanup

Adjustments to mapping

Same

Numerous enhancements, some reorg

Planning notes

Added starter FO XSLT

First cut at FO XSL

Minor improvements

Small adjustments

Many/much schema enhancements; proto XSD version

First cut at inline declarations with live validation

Implementing declarations; styling

Refinements and extensions; new assign, select, withdrawn elements

More support for parameters etc.

Now implementing parameters etc.

More touches

Misc improvements

Sundry adjustments

Many more small improvements

Much documentation

More touchups

Updates

Misc adjustments and notes

Significant rework following design session esp declarations

More improvements incl extending declarations to groups

More adjustments; now mapping SP800-53A also.

More polishing and maintenance

Much more including hierarchical number checking

Adjustments, extensions, corrections

Name changes in the model

More adjustments

Cleanup of obsolete artifacts

Minor alignment

Mostly CSS, also Schematron improvements

ISO27002 mapping document

Many enhancements; new COBIT 5 mappings

More on COBIT

Improvements to mapping docs

Adjustments to mappings incl HTML versions

Moved screenshot for documentation

More adjustments and docs

Mostly improvements to documentation

Refreshed 800-53 data with adjustments

More general improvements to models and mappings

Continuing refinements to validations in samples

Update README.md

Update README.md

Update README.md

Update README.md

Minor tweaks

Including initial cut at profiling (1st, rule-based control extraction) among other refinements and improvements

No longer extant

Added new control to COBIT5 example

Misc improvements including more COBIT5 support

File rename and further adjustments

Misc adjustment; SaxonJS demo files

Misc adjustments

Updated readme contents to reflect merge.

Fixed links.

Changed text to better reflect current state and to add more links.

Rearrangement and cleanup

Schematron and schema adjustment and refactoring

SP800-53 extraction improvement, enhancement, cleanup

Improvements and enhancements to ISO27002 extraction

OSCAL Documentation

COBIT5 example tweakage

Organizational notes

Adjustments

Removed old files directory.
Moved files from draft to root.

Updated README.md to reflect new pathing.

Updated readme to contain more documentation of the OSCAL layers.

Added documentation for the working directory.

Update README.md

Edited the text.

Update README.md

Edited the text.

Added Aug 10 tiger team slides with notes

Create a prose overview of OSCAL

Update OSCAL Overview.md

Update OSCAL Overview.md

Profile and catalog mapping: a trivial example

Replacing graphic with rescaled version

Update OSCAL Overview.md

Rescaled image

Update OSCAL Overview.md

Mods to oXygen project file

Removing 'demo' (till later)

Moved proprietary file

Refinements to ISO27002 mappings (new model)

Refining SP800-53 conversion/mappings

Updating lib support for new model

Top-level org

Draft readme docs

Further adjustment to directory readme.md

More adjustments to ISO 27002 and SP800-53 (new model etc.)

More cleanup to main sample subdirectories + readme tweakage

Mostly restructuring

More adjustments to extraction, parameter support

Includes more model refinements; draft implementation of parameter resolution

Adjustments for revised models

Adjustments to demos and conversion pipelines

Experimenting with profiles

Infrastructure adjustments

Schema modifications

# This is the commit message #2:

Minor correction to schema docs merge
# This is the commit message #3:

Updating XSD w/ docs
# This is the commit message #4:

More element renaming/adjustment
# This is the commit message #5:

Now a stable schema again? With SP800-53 extraction adjustments
# This is the commit message #6:

Profile-related mods

# This is the commit message #7:

Org stuff

# This is the commit message #8:

Moved mappind docs; added readme
# This is the commit message #9:

schema documentation
# This is the commit message #10:

Schema production and documentation pipeline
# This is the commit message #11:

More reorg; tweaked schema; more docs
# This is the commit message #12:

Improvements to tag library
# This is the commit message #13:

Another attempt at internal links in md
# This is the commit message #14:

trying again
# This is the commit message #15:

Gonna get this eventually
# This is the commit message #16:

More updates and tuneups
# This is the commit message #17:

More updates to schema and docs
# This is the commit message #18:

Lighter adjustments
# This is the commit message #19:

Similarly subtle adjustments
# This is the commit message #20:

Adjustments supporting parameter assignments
# This is the commit message #21:

More docs
# This is the commit message #22:

Enhancements to demo
# This is the commit message #23:

Moving distractions out of the way
# This is the commit message #24:

Slight readme tweakage
# This is the commit message #25:

Tag library tweaks
# This is the commit message #26:

More tag library adjustments
# This is the commit message #27:

New readme for Schematrons
# This is the commit message #28:

Adjustments to readme
# This is the commit message #29:

Adjustments to mapping documents
# This is the commit message #30:

Adjustments to readme
# This is the commit message #31:

More adjustments to mapping documents
# This is the commit message #32:

Updated punchlist
# This is the commit message #33:

Updates to mapping docs
# This is the commit message #34:


# This is the commit message #35:

CSS for local editing of OSCAL OSCAL
# This is the commit message #36:

Slight adjustments
# This is the commit message #37:

Light editing
# This is the commit message #38:

Light editing
# This is the commit message #39:

Light edits
# This is the commit message #40:

Light edits
# This is the commit message #41:

Light edits
# This is the commit message #42:

Light edits
# This is the commit message #43:

More work on profiles
# This is the commit message #44:

Revised directory descriptions
# This is the commit message #45:

Added an explanation of the demo directories
# This is the commit message #46:

More on profiling
# This is the commit message #47:

Editorial tweaks to oscal-oscal.xml
# This is the commit message #48:

Editorial tweaks to oscal-oscal.xml
# This is the commit message #49:

Edits to schema documentation
# This is the commit message #50:

More enhancements to tag library and its presentation
# This is the commit message #51:

Internal links?
# This is the commit message #52:

Slight adjustments
# This is the commit message #53:

Further touchups to schema docs and their HTML rendering
# This is the commit message #54:

Support for 'pre'
# This is the commit message #55:

Rearranged and touched up profile experiments
# This is the commit message #56:

More touchups to tag library (linking)
# This is the commit message #57:

More adjustments to copy
# This is the commit message #58:

More adjustments
# This is the commit message #59:

Correcting display bug failing to render chars in CSS
# This is the commit message #60:

Added a PDF with the notes.
@david-waltermire david-waltermire added this to the OSCAL 1.0 M1 milestone Apr 6, 2018
david-waltermire pushed a commit that referenced this issue Apr 13, 2018
@wendellpiez @david-waltermire
# This is a combination of 3 commits.
5131631 
# The first commit's message is:

# This is a combination of 60 commits.
# The first commit's message is:

# This is a combination of 17 commits.
# The first commit's message is:

Restructuring for new initiative

Moved everything into 'old' and added a new subdirectory for new
experiments.

More early iteration over names

More adjustments in names mostly

HTML page for Word import testing

Just touchups this time

Updates and misc improvements

Changed document element to 'catalog'

Improved and renamed mapping transformation

Adjustments to models, schema, Schematron

Managing gitignore

Same

Minor adjustments

First cut at 27K mapping into OSCAL

Renamed directories for consistency

Cleanup

Bit more cleanup

Adjustments to mapping

Same

Numerous enhancements, some reorg

Planning notes

Added starter FO XSLT

First cut at FO XSL

Minor improvements

Small adjustments

Many/much schema enhancements; proto XSD version

First cut at inline declarations with live validation

Implementing declarations; styling

Refinements and extensions; new assign, select, withdrawn elements

More support for parameters etc.

Now implementing parameters etc.

More touches

Misc improvements

Sundry adjustments

Many more small improvements

Much documentation

More touchups

Updates

Misc adjustments and notes

Significant rework following design session esp declarations

More improvements incl extending declarations to groups

More adjustments; now mapping SP800-53A also.

More polishing and maintenance

Much more including hierarchical number checking

Adjustments, extensions, corrections

Name changes in the model

More adjustments

Cleanup of obsolete artifacts

Minor alignment

Mostly CSS, also Schematron improvements

ISO27002 mapping document

Many enhancements; new COBIT 5 mappings

More on COBIT

Improvements to mapping docs

Adjustments to mappings incl HTML versions

Moved screenshot for documentation

More adjustments and docs

Mostly improvements to documentation

Refreshed 800-53 data with adjustments

More general improvements to models and mappings

Continuing refinements to validations in samples

Update README.md

Update README.md

Update README.md

Update README.md

Minor tweaks

Including initial cut at profiling (1st, rule-based control extraction) among other refinements and improvements

No longer extant

Added new control to COBIT5 example

Misc improvements including more COBIT5 support

File rename and further adjustments

Misc adjustment; SaxonJS demo files

Misc adjustments

Updated readme contents to reflect merge.

Fixed links.

Changed text to better reflect current state and to add more links.

Rearrangement and cleanup

Schematron and schema adjustment and refactoring

SP800-53 extraction improvement, enhancement, cleanup

Improvements and enhancements to ISO27002 extraction

OSCAL Documentation

COBIT5 example tweakage

Organizational notes

Adjustments

Removed old files directory.
Moved files from draft to root.

Updated README.md to reflect new pathing.

Updated readme to contain more documentation of the OSCAL layers.

Added documentation for the working directory.

Update README.md

Edited the text.

Update README.md

Edited the text.

Added Aug 10 tiger team slides with notes

Create a prose overview of OSCAL

Update OSCAL Overview.md

Update OSCAL Overview.md

Profile and catalog mapping: a trivial example

Replacing graphic with rescaled version

Update OSCAL Overview.md

Rescaled image

Update OSCAL Overview.md

Mods to oXygen project file

Removing 'demo' (till later)

# This is the commit message #2:

Moved proprietary file

# This is the commit message #3:

Refinements to ISO27002 mappings (new model)

# This is the commit message #4:

Refining SP800-53 conversion/mappings

# This is the commit message #5:

Updating lib support for new model

# This is the commit message #6:

Top-level org

# This is the commit message #7:

Draft readme docs

# This is the commit message #8:

Further adjustment to directory readme.md

# This is the commit message #9:

More adjustments to ISO 27002 and SP800-53 (new model etc.)

# This is the commit message #10:

More cleanup to main sample subdirectories + readme tweakage

# This is the commit message #11:

Mostly restructuring

# This is the commit message #12:

More adjustments to extraction, parameter support

# This is the commit message #13:

Includes more model refinements; draft implementation of parameter resolution

# This is the commit message #14:

Adjustments for revised models

# This is the commit message #15:

Adjustments to demos and conversion pipelines

# This is the commit message #16:

Experimenting with profiles

# This is the commit message #17:

Infrastructure adjustments

# This is the commit message #2:

Minor correction to schema docs merge
# This is the commit message #3:

Updating XSD w/ docs
# This is the commit message #4:

More element renaming/adjustment
# This is the commit message #5:

Now a stable schema again? With SP800-53 extraction adjustments
# This is the commit message #6:

Profile-related mods

# This is the commit message #7:

Org stuff

# This is the commit message #8:

Moved mappind docs; added readme
# This is the commit message #9:

schema documentation
# This is the commit message #10:

Schema production and documentation pipeline
# This is the commit message #11:

More reorg; tweaked schema; more docs
# This is the commit message #12:

Improvements to tag library
# This is the commit message #13:

Another attempt at internal links in md
# This is the commit message #14:

trying again
# This is the commit message #15:

Gonna get this eventually
# This is the commit message #16:

More updates and tuneups
# This is the commit message #17:

More updates to schema and docs
# This is the commit message #18:

Lighter adjustments
# This is the commit message #19:

Similarly subtle adjustments
# This is the commit message #20:

Adjustments supporting parameter assignments
# This is the commit message #21:

More docs
# This is the commit message #22:

Enhancements to demo
# This is the commit message #23:

Moving distractions out of the way
# This is the commit message #24:

Slight readme tweakage
# This is the commit message #25:

Tag library tweaks
# This is the commit message #26:

More tag library adjustments
# This is the commit message #27:

New readme for Schematrons
# This is the commit message #28:

Adjustments to readme
# This is the commit message #29:

Adjustments to mapping documents
# This is the commit message #30:

Adjustments to readme
# This is the commit message #31:

More adjustments to mapping documents
# This is the commit message #32:

Updated punchlist
# This is the commit message #33:

Updates to mapping docs
# This is the commit message #34:

# This is the commit message #35:

CSS for local editing of OSCAL OSCAL
# This is the commit message #36:

Slight adjustments
# This is the commit message #37:

Light editing
# This is the commit message #38:

Light editing
# This is the commit message #39:

Light edits
# This is the commit message #40:

Light edits
# This is the commit message #41:

Light edits
# This is the commit message #42:

Light edits
# This is the commit message #43:

More work on profiles
# This is the commit message #44:

Revised directory descriptions
# This is the commit message #45:

Added an explanation of the demo directories
# This is the commit message #46:

More on profiling
# This is the commit message #47:

Editorial tweaks to oscal-oscal.xml
# This is the commit message #48:

Editorial tweaks to oscal-oscal.xml
# This is the commit message #49:

Edits to schema documentation
# This is the commit message #50:

More enhancements to tag library and its presentation
# This is the commit message #51:

Internal links?
# This is the commit message #52:

Slight adjustments
# This is the commit message #53:

Further touchups to schema docs and their HTML rendering
# This is the commit message #54:

Support for 'pre'
# This is the commit message #55:

Rearranged and touched up profile experiments
# This is the commit message #56:

More touchups to tag library (linking)
# This is the commit message #57:

More adjustments to copy
# This is the commit message #58:

More adjustments
# This is the commit message #59:

Correcting display bug failing to render chars in CSS
# This is the commit message #60:

Added a PDF with the notes.

# This is the commit message #2:

Decided to risk it
# This is the commit message #3:

One more readme
david-waltermire added a commit that referenced this issue Apr 13, 2018
@david-waltermire
# This is a combination of 7 commits.
05a5fff 
# The first commit's message is:

# This is a combination of 4 commits.
# The first commit's message is:

# This is a combination of 60 commits.
# The first commit's message is:

# This is a combination of 17 commits.
# The first commit's message is:

Restructuring for new initiative

Moved everything into 'old' and added a new subdirectory for new
experiments.

More early iteration over names

More adjustments in names mostly

HTML page for Word import testing

Just touchups this time

Updates and misc improvements

Changed document element to 'catalog'

Improved and renamed mapping transformation

Adjustments to models, schema, Schematron

Managing gitignore

Same

Minor adjustments

First cut at 27K mapping into OSCAL

Renamed directories for consistency

Cleanup

Bit more cleanup

Adjustments to mapping

Same

Numerous enhancements, some reorg

Planning notes

Added starter FO XSLT

First cut at FO XSL

Minor improvements

Small adjustments

Many/much schema enhancements; proto XSD version

First cut at inline declarations with live validation

Implementing declarations; styling

Refinements and extensions; new assign, select, withdrawn elements

More support for parameters etc.

Now implementing parameters etc.

More touches

Misc improvements

Sundry adjustments

Many more small improvements

Much documentation

More touchups

Updates

Misc adjustments and notes

Significant rework following design session esp declarations

More improvements incl extending declarations to groups

More adjustments; now mapping SP800-53A also.

More polishing and maintenance

Much more including hierarchical number checking

Adjustments, extensions, corrections

Name changes in the model

More adjustments

Cleanup of obsolete artifacts

Minor alignment

Mostly CSS, also Schematron improvements

ISO27002 mapping document

Many enhancements; new COBIT 5 mappings

More on COBIT

Improvements to mapping docs

Adjustments to mappings incl HTML versions

Moved screenshot for documentation

More adjustments and docs

Mostly improvements to documentation

Refreshed 800-53 data with adjustments

More general improvements to models and mappings

Continuing refinements to validations in samples

Update README.md

Update README.md

Update README.md

Update README.md

Minor tweaks

Including initial cut at profiling (1st, rule-based control extraction) among other refinements and improvements

No longer extant

Added new control to COBIT5 example

Misc improvements including more COBIT5 support

File rename and further adjustments

Misc adjustment; SaxonJS demo files

Misc adjustments

Updated readme contents to reflect merge.

Fixed links.

Changed text to better reflect current state and to add more links.

Rearrangement and cleanup

Schematron and schema adjustment and refactoring

SP800-53 extraction improvement, enhancement, cleanup

Improvements and enhancements to ISO27002 extraction

OSCAL Documentation

COBIT5 example tweakage

Organizational notes

Adjustments

Removed old files directory.
Moved files from draft to root.

Updated README.md to reflect new pathing.

Updated readme to contain more documentation of the OSCAL layers.

Added documentation for the working directory.

Update README.md

Edited the text.

Update README.md

Edited the text.

Added Aug 10 tiger team slides with notes

Create a prose overview of OSCAL

Update OSCAL Overview.md

Update OSCAL Overview.md

Profile and catalog mapping: a trivial example

Replacing graphic with rescaled version

Update OSCAL Overview.md

Rescaled image

Update OSCAL Overview.md

Mods to oXygen project file

Removing 'demo' (till later)

# This is the commit message #2:

Moved proprietary file

# This is the commit message #3:

Refinements to ISO27002 mappings (new model)

# This is the commit message #4:

Refining SP800-53 conversion/mappings

# This is the commit message #5:

Updating lib support for new model

# This is the commit message #6:

Top-level org

# This is the commit message #7:

Draft readme docs

# This is the commit message #8:

Further adjustment to directory readme.md

# This is the commit message #9:

More adjustments to ISO 27002 and SP800-53 (new model etc.)

# This is the commit message #10:

More cleanup to main sample subdirectories + readme tweakage

# This is the commit message #11:

Mostly restructuring

# This is the commit message #12:

More adjustments to extraction, parameter support

# This is the commit message #13:

Includes more model refinements; draft implementation of parameter resolution

# This is the commit message #14:

Adjustments for revised models

# This is the commit message #15:

Adjustments to demos and conversion pipelines

# This is the commit message #16:

Experimenting with profiles

# This is the commit message #17:

Infrastructure adjustments

# This is the commit message #2:

Minor correction to schema docs merge
# This is the commit message #3:

Updating XSD w/ docs
# This is the commit message #4:

More element renaming/adjustment
# This is the commit message #5:

Now a stable schema again? With SP800-53 extraction adjustments
# This is the commit message #6:

Profile-related mods

# This is the commit message #7:

Org stuff

# This is the commit message #8:

Moved mappind docs; added readme
# This is the commit message #9:

schema documentation
# This is the commit message #10:

Schema production and documentation pipeline
# This is the commit message #11:

More reorg; tweaked schema; more docs
# This is the commit message #12:

Improvements to tag library
# This is the commit message #13:

Another attempt at internal links in md
# This is the commit message #14:

trying again
# This is the commit message #15:

Gonna get this eventually
# This is the commit message #16:

More updates and tuneups
# This is the commit message #17:

More updates to schema and docs
# This is the commit message #18:

Lighter adjustments
# This is the commit message #19:

Similarly subtle adjustments
# This is the commit message #20:

Adjustments supporting parameter assignments
# This is the commit message #21:

More docs
# This is the commit message #22:

Enhancements to demo
# This is the commit message #23:

Moving distractions out of the way
# This is the commit message #24:

Slight readme tweakage
# This is the commit message #25:

Tag library tweaks
# This is the commit message #26:

More tag library adjustments
# This is the commit message #27:

New readme for Schematrons
# This is the commit message #28:

Adjustments to readme
# This is the commit message #29:

Adjustments to mapping documents
# This is the commit message #30:

Adjustments to readme
# This is the commit message #31:

More adjustments to mapping documents
# This is the commit message #32:

Updated punchlist
# This is the commit message #33:

Updates to mapping docs
# This is the commit message #34:

# This is the commit message #35:

CSS for local editing of OSCAL OSCAL
# This is the commit message #36:

Slight adjustments
# This is the commit message #37:

Light editing
# This is the commit message #38:

Light editing
# This is the commit message #39:

Light edits
# This is the commit message #40:

Light edits
# This is the commit message #41:

Light edits
# This is the commit message #42:

Light edits
# This is the commit message #43:

More work on profiles
# This is the commit message #44:

Revised directory descriptions
# This is the commit message #45:

Added an explanation of the demo directories
# This is the commit message #46:

More on profiling
# This is the commit message #47:

Editorial tweaks to oscal-oscal.xml
# This is the commit message #48:

Editorial tweaks to oscal-oscal.xml
# This is the commit message #49:

Edits to schema documentation
# This is the commit message #50:

More enhancements to tag library and its presentation
# This is the commit message #51:

Internal links?
# This is the commit message #52:

Slight adjustments
# This is the commit message #53:

Further touchups to schema docs and their HTML rendering
# This is the commit message #54:

Support for 'pre'
# This is the commit message #55:

Rearranged and touched up profile experiments
# This is the commit message #56:

More touchups to tag library (linking)
# This is the commit message #57:

More adjustments to copy
# This is the commit message #58:

More adjustments
# This is the commit message #59:

Correcting display bug failing to render chars in CSS
# This is the commit message #60:

Added a PDF with the notes.

# This is the commit message #2:

Decided to risk it
# This is the commit message #3:

One more readme
# This is the commit message #4:

Added timestamping to extractors

# This is the commit message #2:

Light edits to oscal-oscal.xml
# This is the commit message #3:

More edits to oscal-oscal.xml with regenerated materials
# This is the commit message #4:

Refining markdown export
# This is the commit message #5:

More edits to docs and rendering
# This is the commit message #6:

This time smaller adjustments
# This is the commit message #7:

More improvements to docs and rendering
@david-waltermire david-waltermire added Discussion Needed This issues needs to be reviewed by the OSCAL development team. Scope: Modeling Issues targeted at development of OSCAL formats labels May 9, 2019
@wendellpiez
Copy link
Contributor

FedRAMP profiles call SP800-53 profiles as well as the base catalog. These will work for testing for now. Closing.

@david-waltermire david-waltermire removed Discussion Needed This issues needs to be reviewed by the OSCAL development team. labels Jun 6, 2019
@nikitawootten-nist nikitawootten-nist mentioned this issue Aug 31, 2022
Closed
3 tasks
@wendellpiez wendellpiez mentioned this issue Sep 7, 2023
Closed
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@wendellpiez wendellpiez

@david-waltermire david-waltermire

Labels
LoE: Large Scope: Modeling Issues targeted at development of OSCAL formats User Story
Projects
None yet
Milestone
OSCAL 1.0 Milestone 1
Development

No branches or pull requests
3 participants
@wendellpiez @david-waltermire @akarmel