diff --git a/.github/workflows/config/.lycheeignore b/.github/workflows/config/.lycheeignore
index f17c4e3..1a26d16 100755
--- a/.github/workflows/config/.lycheeignore
+++ b/.github/workflows/config/.lycheeignore
@@ -2,3 +2,6 @@ https://search.usa.gov/search
http://csrc.nist.gov/ns/*
https://fedramp.gov/ns/*
http://www.first.org/cvss/v3
+# TODO: Review this exemption when prudent, details in this issue:
+# https://github.com/GSA/automate.fedramp.gov/issues/54
+https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf
diff --git a/.github/workflows/workflow-generate-website.yml b/.github/workflows/workflow-generate-website.yml
index 95e7646..1778479 100644
--- a/.github/workflows/workflow-generate-website.yml
+++ b/.github/workflows/workflow-generate-website.yml
@@ -38,7 +38,7 @@ jobs:
run: echo "GH_TOKEN=${GITHUB_TOKEN}" >> $GITHUB_ENV
# use this for overything else (i.e., pull requests) where publication is not needed
- name: Checkout Latest
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+ uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
with:
submodules: recursive
- name: Setup Swap Space
@@ -47,7 +47,7 @@ jobs:
with:
swap-size-gb: 10
- name: Set up NodeJS
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8
+ uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6
with:
node-version-file: '.nvmrc'
cache: 'npm'
@@ -81,7 +81,7 @@ jobs:
run: |
zip ${{ runner.temp }}/website.zip -r _site-test
- name: Upload generated site
- uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874
with:
name: website
path: |
@@ -100,14 +100,14 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
continue-on-error: true
- name: Upload link check report
- uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874
with:
name: html-link-report
path: html-link-report.md
retention-days: 5
- name: Create issue if bad links detected
if: ${{ !cancelled() && env.lychee_exit_code != 0 && env.INPUT_ISSUE_ON_ERROR == 'true' }}
- uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94
+ uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd
with:
title: Scheduled Check of Website Content Found Bad Hyperlinks
content-filepath: ./lychee/out.md
diff --git a/content/documentation/general-concepts/3-fedramp-extensions-and-accepted-values.md b/content/documentation/general-concepts/3-fedramp-extensions-and-accepted-values.md
index 783ac4b..d5ae906 100644
--- a/content/documentation/general-concepts/3-fedramp-extensions-and-accepted-values.md
+++ b/content/documentation/general-concepts/3-fedramp-extensions-and-accepted-values.md
@@ -1,8 +1,8 @@
---
-title: FedRAMP Extensions and Accepted Values
+title: FedRAMP Extensions
weight: 150
---
-# FedRAMP Extensions and Accepted Values
+# FedRAMP Extensions
The core OSCAL syntax is designed to represent cybersecurity
information that is common to any organization and compliance framework.
@@ -116,49 +116,913 @@ All FedRAMP extensions will appear as:
assembly to be used for extensions. This is not currently the case for
the OSCAL SSP, SAP, SAR, or POA&M.
-**FedRAMP extensions are cited in relevant portions of this document and
-summarized in the FedRAMP OSCAL Registry.**
+---
+## Summary of FedRAMP Extensions
-## FedRAMP Conformity Tagging
+FedRAMP extensions are cited in relevant portions of this documentation site and
+summarized below.
-FedRAMP collaborated with NIST to address the ambiguities in OSCAL
-syntax necessitating conformity tags.
+### Assessment Type
-### OSCAL and FedRAMP-Defined Identifiers and Accepted Values
+| | |
+|----|----|
+| ID | assessment-type |
+| Description | The type of assessment (e.g., initial authorization, annual assessment, assessment for a significant change, or another type of assessment). |
+| Allowed Values | "initial","annual","significant-change", and "other" |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
-OSCAL now defines *allowed values* in a way that supersedes FedRAMP's
-separate handling of *defined identifiers* and *accepted values*. To
-better align with OSCAL, FedRAMP has also shifted to this approach.
-Further, many FedRAMP *defined values* are now recognized by OSCAL as
-part of the core OSCAL syntax.
+### Asset Type
-Any remaining *defined identifiers* or *accepted values* are enumerated
-in the FedRAMP OSCAL registry as *allowed values*.
+| | |
+|----|----|
+| ID | asset-type |
+| Description | Identifies the type of asset. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. The value may be locally defined using the "http://csrc.nist.gov/ns/oscal" namespace values for this prop. |
-### OSCAL and FedRAMP Allowed Values
+### Authentication Method
-To facilitate consistent processing, the value for property names,
-annotation names, and some field values is limited to a list of
-*case-sensitive* allowed values. In many instances, OSCAL defines allowed
-values, which are enforced by OSCAL-based syntax validation mechanisms.
+| | |
+|----|----|
+| ID | authentication-method |
+| Description | The authentication method(s) for users of a leveraged service or external interconnection. Refer to for authentication methods NIST 800-63B (https://pages.nist.gov/800-63-3/sp800-63b.html) for authentication methods |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
-In some cases, FedRAMP defines or adds allowed values specific to
-FedRAMP ATO processing. Where defined, only these values are recognized
-by FedRAMP processing tools.
+### Authorization Date
-For example, every control requires an implementation status. FedRAMP
-only accepts one of five possible responses for this status, which must
-be provided using one of the specified choices.
+| | |
+|----|----|
+| ID | authorization-date |
+| Description | The date the system was authorized. Omit or leave blank for an initial authorization. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. This information should be obtained from the imported SSP's date-authorized. |
+
+### Authorization Recommendation
+
+| | |
+|----|----|
+| ID | authorization-recommendation |
+| Description | Indicates whether the assessor recommends the system be authorized by the authorizing official. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. Use "recommend-authorization" FedRAMP extension prop instead. |
+
+### Authorization Type
+
+| | |
+|----------------|-----------------------------------------------------|
+| ID | authorization-type |
+| Description | Identifies the FedRAMP authorization type. |
+| Allowed Values | "fedramp-agency" |
+| Status | Active |
+| Remarks | The "fedramp-jab" authorization type is deprecated. |
+
+### Authorized Users
+
+| | |
+|----|----|
+| ID | authorized-users |
+| Description | The users or roles that can access the leveraged service or external interconnection. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Circuit Service Processor
+
+| | |
+|----|----|
+| ID | circuit |
+| Description | A circuit used for the communication. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | E.g., a circuit ID. To provide a general reference for a service processor, use the "service-processor" FedRAMP extension instead. |
+
+### Control Implementation Status
+
+| | |
+|----|----|
+| ID | control-implementation-status |
+| Description | Indicates the implementation status of the control. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. Use "http://csrc.nist.gov/ns/oscal" namespace values prop instead. |
+
+### Objective Implementation Status
+
+| | |
+|----|----|
+| ID | control-objective-implementation-status |
+| Description | Indicates the implementation status of the control objective. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. Use "http://csrc.nist.gov/ns/oscal" namespace values prop instead. |
+
+### Control Origination
+
+| | |
+|----|----|
+| ID | control-origination |
+| Description | The point(s) from which the control satisfaction originates. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. Use "http://csrc.nist.gov/ns/oscal" namespace values prop instead. |
+
+### Core Control
+
+| | |
+|----|----|
+| ID | CORE |
+| Description | Identifies a control that must be included in every FedRAMP assessment. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Core controls must be assessed every year, and are often subject to additional scrutiny by assessors and adjudication reviewers. |
+
+### Cryptographic Module Usage
+
+| | |
+|----|----|
+| ID | cryptographic-module-usage |
+| Description | The cryptographic module is used for data at rest (DAT) or data in transit (DIT). |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### CSP Validated
+
+| | |
+|----|----|
+| ID | csp-validated |
+| Description | The CSP ensured the independent assessor team roles are appropriately filled. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Description
+
+| | |
+|----------------|------------------------------------|
+| ID | description |
+| Description | A brief description of the system. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Discrepancies
+
+| | |
+|----|----|
+| ID | discrepancies |
+| Description | Any discrepancies between inventory that was in scope for the planned assessment and the assets in the assessment results. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Discrepancies Reason
+
+| | |
+|----|----|
+| ID | discrepencies-reason |
+| Description | The justification or reason for any discrepancies between inventory that was in scope for the planned assessment and the assets in the assessment results. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### False Positive
+
+| | |
+|----------------|---------------------------------------------------|
+| ID | false-positive |
+| Description | The risk was found to be a false positive report. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Fully Operational Date
+
+| | |
+|----|----|
+| ID | fully-operational-date |
+| Description | The date when security control implementations for the appropriate control baseline was completed. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. “Fully operational” means there are no “gaps” in the security control baseline implementations for the system. The CSP attests that the security controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements. |
+
+### IA Manual Review
+
+| | |
+|----|----|
+| ID | ia-manual-review |
+| Description | Confirmation that the independent assessor performed a manual review of (scan) configuration files to analyze for existing vulnerabilities. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### IA Validated
+
+| | |
+|----|----|
+| ID | ia-validated |
+| Description | The independent assessor ensured the assessment team roles are appropriately filled. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Impact Level
+
+| | |
+|----|----|
+| ID | impact-level |
+| Description | The impact level of a leveraged authorization. |
+| Allowed Values | "fips-199-high", "fips-199-moderate", and "fips-199-low". |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Information Transmitted
+
+| | |
+|----|----|
+| ID | information |
+| Description | Describes the information transmitted over the interconnection. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Interconnection Compliance
+
+| | |
+|----|----|
+| ID | interconnection-compliance |
+| Description | Any (security) compliance certifications the third party external service has (e.g., PCI SOC 2, CSA STAR Level 2, etc.). |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Interconnection Data Categorization
+
+| | |
+|----|----|
+| ID | interconnection-data-categorization |
+| Description | The security impact level of the data (Low, Moderate, High), processed by or stored in the external service, in accordance with FIPS 199 & NIST 800-60 Vol. 2. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Interconnection Data Type
+
+| | |
+|----|----|
+| ID | interconnection-data-type |
+| Description | The type of data / information processed by or stored in the external service, in accordance with NIST 800-60 Vol. 2. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Interconnection Direction
+
+| | |
+|----|----|
+| ID | interconnection-direction |
+| Description | Identifies the direction of information flow for the interconnection. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. Use core OSCAL "direction" prop instead. |
+
+### Interconnection Hosting Environment
+
+| | |
+|----|----|
+| ID | interconnection-hosting-environment |
+| Description | A description of the hosting environment (e.g., corporate network, IaaS, or self-hosted) for the external service. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Interconnection Risk
+
+| | |
+|----|----|
+| ID | interconnection-risk |
+| Description | A description of the potential risks introduced by the external system/service and impact to the CSO or federal data if the confidentiality, integrity, and availability (CIA) of the system/service is compromised. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Interconnection Security
+
+| | |
+|----|----|
+| ID | interconnection-security |
+| Description | Identifies the mechanisms/protocol(s) used to secure the communication. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Renamed from "connection-security" to "interconnection-security". |
+
+### Interconnection Type
+
+| | |
+|----|----|
+| ID | interconnection-type |
+| Description | Numeric indicator of the type of interconnection, where 1 = Non-FedRAMP Authorized Cloud Services, 2 = Corporate Shared Services, and 3 = Update Services for In-Boundary Software/Services. |
+| Allowed Values | "1", "2", or "3" |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. May specify "4" if none of the other types apply. |
+
+### Inventory Item State.
+
+| | |
+|----|----|
+| ID | inventory-item-state |
+| Description | Different states of inventory items: public, private, et cetera |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### IPv4 Address
+
+| | |
+|----|----|
+| ID | ipv4-address |
+| Description | The IP address of a component, inventory item, or other asset. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. Core OSCAL has an "ipv4-address" prop which can be used for specific component types and for inventory items. This extension can be used instead, and is also applicable for other assemblies such as assessment-platform. |
+
+### IPv4 Subnet
+
+| | |
+|----|----|
+| ID | ipv4-subnet |
+| Description | The subnet for a component of inventory item. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### ISO/IEC 17020 Identifier
+
+| | |
+|----|----|
+| ID | iso-iec-17020-identifier |
+| Description | The ISO/IEC-17020 identifier assigned to the assessor related to their status as an A2LA Accredited Third Party Assessment Organization. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### KEV Catalog
+
+| | |
+|----|----|
+| ID | kev-catalog |
+| Description | Indicates if this vulnerability is on the CISA Known Exploited Vulnerabilities (KEV) Catalog. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. In accordance with Binding Operational Directive (BOD) 22-01, CSPs must track their vulnerabilities against the KEV catalog. |
+
+### KEV Due Date
+
+| | |
+|----|----|
+| ID | kev-due-date |
+| Description | The KEV catalog specified due date by which the vulnerability must be remediated. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. In accordance with Binding Operational Directive (BOD) 22-01, CSPs must track their vulnerabilities against the KEV catalog. |
+
+### Label - Test ID
+
+| | |
+|----|----|
+| ID | label |
+| Description | The test ID for the manual test method. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Leveraged Authorization
+
+| | |
+|----|----|
+| ID | leveraged-authorization |
+| Description | Indicates a leveraged authorization used for this control. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | This is for legacy SSP conversion to OSCAL. The preferred approach is to specify the leveraged system as a component and reference it in the control using by-component. |
+
+### Leveraged System Identifier
+
+| | |
+|----|----|
+| ID | leveraged-system-identifier |
+| Description | The identifier corresponding to the FedRAMP package ID. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Likelihood
+
+| | |
+|----------------|------------------------------|
+| ID | likelihood |
+| Description | The likelihood of a risk. |
+| Allowed Values | "high", "moderate", or "low" |
+| Status | Active |
+| Remarks | No remarks |
+
+### Login ID
+
+| | |
+|----------------|-------------------------------------------------------|
+| ID | login-id |
+| Description | The login ID used to assess the web application. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension renamed from "task-login-id" to "login-id". |
+
+### Login URL
+
+| | |
+|----------------|---------------------------------------------------------|
+| ID | login-url |
+| Description | The login URL for a web application. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension renamed from "task-login-url" to "login-url". |
+
+### Name
+
+| | |
+|----|----|
+| ID | name |
+| Description | The product or tool name for a component or inventory item. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. For local defi |
+
+### Nature of Agreement
+
+| | |
+|----|----|
+| ID | nature-of-agreement |
+| Description | Any type of agreement between a CSP and the leveraged CSP vendors who support products (e.g., End User Licensing Agreement (EULA), Service-Level Agreement (SLA), App License Agreement, Contract, etc.). |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Referenced Authorization Date
+
+| | |
+|----------------|---------------------------------------------------------|
+| ID | no-oscal-ssp-authorization-date |
+| Description | The date of the system's initial FedRAMP authorization. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Relevant Baseline
+
+| | |
+|----|----|
+| ID | no-oscal-ssp-import-profile |
+| Description | Identifies the relevant OSCAL baseline. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | As with all URIs in OSCAL, this may contain a URI fragment, which identifies the local resource containing the relevant profile. Only use when an OSCAL SSP cannot be referenced. |
+
+### Short System Name
+
+| | |
+|----------------|-----------------------------------------|
+| ID | no-oscal-ssp-purpose |
+| Description | The FedRAMP-assigned system identifier. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Short System Name
+
+| | |
+|----------------|-----------------------------------------|
+| ID | no-oscal-ssp-system-id |
+| Description | The FedRAMP-assigned system identifier. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Short System Name
+
+| | |
+|----------------|----------------------------------------------------------|
+| ID | no-oscal-ssp-title-short |
+| Description | The abbreviated name for the system, such as an acronym. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Operational Requirement
+
+| | |
+|----|----|
+| ID | operational-requirement |
+| Description | Use to indicate that risk cannot be remediated without impact to the system and must be accepted. |
+| Allowed Values | "investigating", "pending", "approved" |
+| Status | Active |
+| Remarks | No remarks |
+
+### Planned Completion Date
+
+| | |
+|----|----|
+| ID | planned-completion-date |
+| Description | Provides the date the control expects to be implemented. Must be present when Implementation Status is "Planned" |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Plugin Identifier
+
+| | |
+|----|----|
+| ID | plugin-identifier |
+| Description | A tool assigned Plugin ID. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Some vulnerability scanners provide a plug-in ID for a given vulnerability, which should be reported in the POA&M. |
+
+### POA&M ID
+
+| | |
+|----------------|----------------------------------|
+| ID | poam-id |
+| Description | A CSP-assigned POA&M identifier. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Impacted Control
+
+| | |
+|----|----|
+| ID | poam-impacted-control |
+| Description | A control impacted by this POA&M item. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Impacted control is required in the POA&M and optional in the SAR. It is allowed in the SAR in anticipation of duplicating open risks from the SAR to the POA&M. |
+
+### Privacy Designation
+
+| | |
+|----------------|-----------------------------------------------------|
+| ID | privacy-designation |
+| Description | Indicates whether this system is privacy sensitive. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Privacy Threshold Analysis Q1
+
+| | |
+|----|----|
+| ID | privacy-threshold-analysis-q1 |
+| Description | Does the ISA collect, maintain, or share PII in any identifiable form? |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Privacy Threshold Analysis Q2
+
+| | |
+|----|----|
+| ID | privacy-threshold-analysis-q2 |
+| Description | Does the ISA collect, maintain, or share PII from or about the public? |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Privacy Threshold Analysis Q3
+
+| | |
+|----|----|
+| ID | privacy-threshold-analysis-q3 |
+| Description | Has a Privacy Impact Assessment (PIA) ever been performed for the ISA? |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Privacy Threshold Analysis Q4
+
+| | |
+|----|----|
+| ID | privacy-threshold-analysis-q4 |
+| Description | Is there a Privacy Act System of Records Notice (SORN) for this ISA system? |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Purpose
+
+| | |
+|----------------|----------------------------------------------------|
+| ID | purpose |
+| Description | Explains the system's purpose. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | May be used to provide prose for the SAP or POA&M. |
+
+### Assessor's Authorization Recommendation
+
+| | |
+|----|----|
+| ID | recommend-authorization |
+| Description | Indicates the assessor's recommendation for initial or continued authorization. |
+| Allowed Values | "yes" or "no" |
+| Status | Active |
+| Remarks | No remarks |
+
+### Resolution Resource
+
+| | |
+|----|----|
+| ID | resolution-resource |
+| Description | The back-matter resource reference used to determine which FedRAMP validation rule sets apply. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Response Point
+
+| | |
+|----|----|
+| ID | response-point |
+| Description | A property whose presence indicates its parent part is a required point of response for FedRAMP stakeholders. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | This appears in FedRAMP profiles and resolved profile catalogs. For control statements, it signals to the CSP which statements require a response in the SSP. For control objectives, it signals to the assessor which control objectives must appear in the assessment results, which aligns with the FedRAMP test case workbook. |
+
+### Party Identifier
+
+| | |
+|----------------|--------------------------------------------------|
+| ID | revision-history-party-uuid |
+| Description | Identifies the party who authored this revision. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Risk Adjustment
+
+| | |
+|----|----|
+| ID | risk-adjustment |
+| Description | Use to indicate that mitigating factors were identified or implemented, reducing the likelihood or impact of the risk. |
+| Allowed Values | "investigating", "pending", "approved" |
+| Status | Active |
+| Remarks | No remarks |
+
+### Sampling
+
+| | |
+|----|----|
+| ID | sampling |
+| Description | Indicates whether a sampling methodology was used instead of assessing the entire system. |
+| Allowed Values | "yes" or "no" |
+| Status | Active |
+| Remarks | No remarks |
+
+### Risk Priority
+
+| | |
+|----|----|
+| ID | sar-risk-priority |
+| Description | Assessor's recommended risk priority. Lower numbers are higher priority. One (1) is highest priority. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Scan Percentage
+
+| | |
+|----|----|
+| ID | scan-percentage |
+| Description | The scan coverage |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Scan Type
+
+| | |
+|----|----|
+| ID | scan-type |
+| Description | Identifies the type(s) of scans to be performed on this inventory-item or component. |
+| Allowed Values | "infrastructure", "database", "web", or "other" |
+| Status | Active |
+| Remarks | No remarks |
+
+### eAuth Level (OVERALL)
+
+| | |
+|----|----|
+| ID | security-cia-level |
+| Description | The overall electronic authentication (eAuth) level applied to the system. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Service Processor
+
+| | |
+|----------------|------------------------------------------------|
+| ID | service-processor |
+| Description | Name of the interconnection service processor. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Service Used By
+
+| | |
+|----------------|-----------------------------------|
+| ID | service-used-by |
+| Description | Identifies what uses the service. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Use rel set to "used-by" instead. |
+
+### Significant Changes Scope
+
+| | |
+|----|----|
+| ID | significant-changes-scope |
+| Description | The general quantity of significant change(s) in scope. |
+| Allowed Values | "none", "one" or "many" |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### SORN ID
+
+| | |
+|----|----|
+| ID | sorn-id |
+| Description | An assigned System of Records Notice (SORN) identifier for this system. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Deprecated. |
+
+### Sort ID
+
+| | |
+|----|----|
+| ID | sort-id |
+| Description | Identifier for sort ordering content. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Core OSCAL has a "sort-id" prop, however this "sort-id" extension can be applied to any assembly that provided information which may need to be rendered in a specific order. The step assembly is an example of this. |
+
+### Still Supported
+
+| | |
+|----|----|
+| ID | still-supported |
+| Description | Specify if the product / component is still supported by the vendor / manufacturer. |
+| Allowed Values | "yes" or "no" |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### System Identifier
+
+| | |
+|----------------|------------------------------------------------------------|
+| ID | system-id |
+| Description | The FedRAMP-assigned identifier for this system. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Use this extension when an OSCAL SSP cannot be referenced. |
+
+### Test Type
+
+| | |
+|----------------|-----------------------------------------------------|
+| ID | task-test-type |
+| Description | Indicates the type of test represented by the task. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### User Identifier
+
+| | |
+|----------------|-----------------------------------------------------|
+| ID | task-user-uuid |
+| Description | Cites the SSP defined user role to use for testing. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Short Title
+
+| | |
+|----------------|------------------------------------------------------------|
+| ID | title-short |
+| Description | The short name for the system represented in the resource. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
+
+### Type
+
+| | |
+|----|----|
+| ID | type |
+| Description | The "type" of back-matter resource. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. For locally defined resource types. |
+
+### User Sensitivity Level
+
+| | |
+|----|----|
+| ID | user-sensitivity-level |
+| Description | Defines the sensitivity level of the identified user type. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | Values are as required by FedRAMP for packages based on NIST 800-53, Revision 4. Authoritative source: OPM Position Designation (Page 18). |
+
+### External Users
+
+| | |
+|----------------|-----------------------------------------------------------|
+| ID | users-external |
+| Description | The current number of users external to the organization. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | No remarks |
+
+### Future External Users
+
+| | |
+|----|----|
+| ID | users-external-future |
+| Description | The anticipated number of users external to the organization in one year. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | No remarks |
+
+### Internal Users
+
+| | |
+|----------------|-----------------------------------------------------------|
+| ID | users-internal |
+| Description | The current number of users internal to the organization. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | No remarks |
+
+### Future Internal Users
+
+| | |
+|----|----|
+| ID | users-internal-future |
+| Description | The anticipated number of users internal to the organization in one year. |
+| Allowed Values | Unrestricted |
+| Status | Deprecated in version 1.0.2 |
+| Remarks | No remarks |
+
+### Vendor Dependency
+
+| | |
+|----------------|--------------------------------------------------------|
+| ID | vendor-dependency |
+| Description | A vendor resolution is pending, but not yet available. |
+| Allowed Values | "investigating", "pending", "approved" |
+| Status | Active |
+| Remarks | No remarks |
+
+### Vendor Name
+
+| | |
+|----|----|
+| ID | vendor-name |
+| Description | The vendor or manufacturer of a component or inventory item. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | Extension added to align with information in FedRAMP rev 5 templates. |
+
+### Vulnerability Identifier
+
+| | |
+|----------------|-----------------------------------|
+| ID | vulnerability-identifier |
+| Description | A tool assigned vulnerability ID. |
+| Allowed Values | Unrestricted |
+| Status | Active |
+| Remarks | No remarks |
-**FedRAMP allowed values are cited in relevant portions of each
-guidebook and summarized in the FedRAMP OSCAL Registry.**
-{{}}
-_***Revised FedRAMP Registry Approach*** }}
diff --git a/content/documentation/general-concepts/fedramp-allowed-values.md b/content/documentation/general-concepts/fedramp-allowed-values.md
new file mode 100644
index 0000000..7d6b4c7
--- /dev/null
+++ b/content/documentation/general-concepts/fedramp-allowed-values.md
@@ -0,0 +1,7592 @@
+---
+title: FedRAMP Allowed Values
+weight: 150
+---
+# FedRAMP Allowed Values
+
+To facilitate consistent processing, the value for property names,
+annotation names, and some field values is limited to a list of
+*case-sensitive* allowed values. In many instances, OSCAL defines allowed
+values, which are enforced by OSCAL-based syntax validation mechanisms.
+
+In some cases, FedRAMP defines or adds allowed values specific to
+FedRAMP ATO processing. Where defined, only these values are recognized
+by FedRAMP processing tools.
+
+For example, every control requires an implementation status. FedRAMP
+only accepts one of five possible responses for this status, which must
+be provided using one of the specified choices.
+
+## Allowed Value Constraints
+
+FedRAMP allowed values are cited in relevant portions of the online documentation and summarized in these sub-sections:
+- [SSP Allowed Values](#ssp-allowed-values)
+- [SAP Allowed Values](#sap-allowed-values)
+- [SAR Allowed Values](#sar-allowed-values)
+- [POA&M Allowed Values](#poam-allowed-values)
+- [Other Allowed Values](#other-allowed-values)
+
+### SSP Allowed Values
+
+#### /System Security Plan/Back Matter/Resource/Citation/Link/@Rel
+
+| Location | Target | Values | Allow Other | Source |
+| --- | --- | --- | --- | --- |
+| [Location](/system-security-plan/back-matter/resource/citation/link/@rel) | . | | True | builtin |
+
+#### /System Security Plan/Back Matter/Resource/Citation/Prop/@Name
+
+| Location | Target | Values | Allow Other | Source |
+| --- | --- | --- | --- | --- |
+| [Location](/system-security-plan/back-matter/resource/citation/prop) | .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name | | False | builtin |
+
+#### /System Security Plan/Back Matter/Resource/Document Id/@Scheme
+
+| Location | Target | Values | Allow Other | Source |
+| --- | --- | --- | --- | --- |
+| [Location](/system-security-plan/back-matter/resource/document-id/@scheme) | . | | True | builtin |
+
+#### /System Security Plan/Back Matter/Resource/Prop/@Name
+
+| Location | Target | Values | Allow Other | Source |
+| --- | --- | --- | --- | --- |
+| [Location](/system-security-plan/back-matter/resource) | prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name | | False | builtin |
+| [Location](/system-security-plan/back-matter/resource/prop) | .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name | | False | builtin |
+
+#### /System Security Plan/Back Matter/Resource/Prop/@Value
+
+| Identifier | Location | Target | Values | Allow Other | Source |
+| --- | --- | --- | --- | --- | --- |
+| attachment-type | [Location](/system-security-plan) | back-matter/resource/prop[@name='type'][@ns='https://fedramp.gov/ns/oscal']/@value | law regulation standard guidance policy procedure guide rules-of-behavior plan system-security-plan artifact evidence screen-shot image tool-report raw-tool-output interview-notes questionnaire report fedramp-citations fedramp-acronyms fedramp-logo separation-of-duties-matrix logo personally-identifiable-information agreement isa-agreement incident-response-plan information-security-policies-and-procedures users-guide privacy-impact-assessment information-system-contingency-plan configuration-management-plan logo image screen-shot law regulation standard external-guidance acronyms citation policy procedure system-guide users-guide administrators-guide rules-of-behavior plan artifact evidence tool-output raw-data interview-notes questionnaire report agreement SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider implemented partial planned alternative not-applicable asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider implemented partial planned alternative not-applicable organization system-specific customer-configured customer-provided inherited asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider organization system-specific customer-configured customer-provided inherited asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider implemented partial planned alternative not-applicable asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider organization system-specific customer-configured customer-provided inherited asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider organization system-specific customer-configured customer-provided inherited asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management canonical alternate latest-version predecessor-version successor-version creator prepared-by prepared-for content-approver contact canonical alternate predecessor-version successor-version version-history identity-assurance-level authenticator-assurance-level federation-assurance-level cloud-deployment-model cloud-service-model fedramp-jab fedramp-agency fedramp-li-saas public-cloud private-cloud government-only-cloud hybrid-cloud other fedramp-jab fedramp-agency fedramp-li-saas public-cloud private-cloud community-cloud hybrid-cloud government-only-cloud other authorizing-official authorizing-official-poc system-owner system-poc-management system-poc-technical system-poc-other information-system-security-officer privacy-poc operational under-development under-major-modification disposition other https://fedramp.gov http://fedramp.gov/ns/oscal https://ietf.org/rfc/rfc4122 http://ietf.org/rfc/rfc4122 fips-199-low fips-199-moderate fips-199-high fips-199-low fips-199-moderate fips-199-high https://doi.org/10.6028/NIST.SP.800-60v2r1 http://doi.org/10.6028/NIST.SP.800-60v2r1 fips-199-low fips-199-moderate fips-199-high fips-199-low fips-199-moderate fips-199-high fips-199-low fips-199-moderate fips-199-high fips-199-low fips-199-moderate fips-199-high privacy-impact-assessment interconnection software hardware service policy physical process-procedure plan guidance standard validation this-system system network this-system system interconnection software hardware service policy physical process-procedure plan guidance standard validation network depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network imported-from implementation-point leveraged-authorization-uuid inherited-uuid asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function version patch-level model release-date validation-type validation-reference isa-title isa-date isa-remote-system-name ipv4-address ipv6-address direction ipsec vpn tls dtls certificate secure-file-transfer other infrastructure database web other operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider isa-poc-local isa-poc-remote isa-authorizing-official-local isa-authorizing-official-remote infrastructure database web other under-development operational disposition other version patch-level model release-date validation-type validation-reference asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function infrastructure database web other asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management infrastructure database web other ipv4-address ipv6-address fqdn uri serial-number netbios-name mac-address physical-location is-scanned hardware-model os-name os-version software-name software-version software-patch-level asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function infrastructure database web other operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider infrastructure database web other infrastructure database web other infrastructure database web other infrastructure database web other internal external privileged read read-write write no-access internal external general-public privileged non-privileged no-logical-access asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management this-system system interconnection software hardware service policy physical process-procedure plan guidance standard validation network depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network imported-from implementation-point leveraged-authorization-uuid inherited-uuid asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function version patch-level model release-date validation-type validation-reference isa-title isa-date isa-remote-system-name ipv4-address ipv6-address direction operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider isa-poc-local isa-poc-remote isa-authorizing-official-local isa-authorizing-official-remote under-development operational disposition other component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource law regulation standard guidance policy procedure guide rules-of-behavior plan system-security-plan artifact evidence screen-shot image tool-report raw-tool-output interview-notes questionnaire report fedramp-citations fedramp-acronyms fedramp-logo separation-of-duties-matrix logo personally-identifiable-information agreement isa-agreement incident-response-plan information-security-policies-and-procedures users-guide privacy-impact-assessment information-system-contingency-plan configuration-management-plan logo image screen-shot law regulation standard external-guidance acronyms citation policy procedure system-guide users-guide administrators-guide rules-of-behavior plan artifact evidence tool-output raw-data interview-notes questionnaire report agreement SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 this-system system interconnection software hardware service policy physical process-procedure plan guidance standard validation network depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network imported-from implementation-point leveraged-authorization-uuid inherited-uuid asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function version patch-level model release-date validation-type validation-reference isa-title isa-date isa-remote-system-name ipv4-address ipv6-address direction operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider isa-poc-local isa-poc-remote isa-authorizing-official-local isa-authorizing-official-remote under-development operational disposition other version patch-level model release-date validation-type validation-reference asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management ipv4-address ipv6-address fqdn uri serial-number netbios-name mac-address physical-location is-scanned hardware-model os-name os-version software-name software-version software-patch-level asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider objective assessment assessment-objective assessment-method label sort-id alt-identifier label sort-id alt-identifier internal external general-public privileged non-privileged no-logical-access asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management canonical alternate latest-version predecessor-version successor-version creator prepared-by prepared-for content-approver contact canonical alternate predecessor-version successor-version version-history component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource seconds minutes hours days months years rules-of-engagement disclosures assessment-inclusions assessment-exclusions results-delivery assumptions methodology law regulation standard guidance policy procedure guide rules-of-behavior plan system-security-plan artifact evidence screen-shot image tool-report raw-tool-output interview-notes questionnaire report fedramp-citations fedramp-acronyms fedramp-logo separation-of-duties-matrix logo personally-identifiable-information agreement isa-agreement incident-response-plan information-security-policies-and-procedures users-guide privacy-impact-assessment information-system-contingency-plan configuration-management-plan logo image screen-shot law regulation standard external-guidance acronyms citation policy procedure system-guide users-guide administrators-guide rules-of-behavior plan artifact evidence tool-output raw-data interview-notes questionnaire report agreement SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 objective assessment assessment-objective assessment-method label sort-id alt-identifier label sort-id alt-identifier canonical alternate latest-version predecessor-version successor-version creator prepared-by prepared-for content-approver contact canonical alternate predecessor-version successor-version version-history component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource implemented partial planned alternative not-applicable this-system system interconnection software hardware service policy physical process-procedure plan guidance standard validation network depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network imported-from implementation-point leveraged-authorization-uuid inherited-uuid asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function version patch-level model release-date validation-type validation-reference isa-title isa-date isa-remote-system-name ipv4-address ipv6-address direction operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider isa-poc-local isa-poc-remote isa-authorizing-official-local isa-authorizing-official-remote under-development operational disposition other component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource seconds minutes hours days months years this-system system interconnection software hardware service policy physical process-procedure plan guidance standard validation network depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network imported-from implementation-point leveraged-authorization-uuid inherited-uuid asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function version patch-level model release-date validation-type validation-reference isa-title isa-date isa-remote-system-name ipv4-address ipv6-address direction operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider isa-poc-local isa-poc-remote isa-authorizing-official-local isa-authorizing-official-remote under-development operational disposition other version patch-level model release-date validation-type validation-reference asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management ipv4-address ipv6-address fqdn uri serial-number netbios-name mac-address physical-location is-scanned hardware-model os-name os-version software-name software-version software-patch-level asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider internal external general-public privileged non-privileged no-logical-access asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management EXAMINE INTERVIEW TEST UNKNOWN tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user resource ssp-statement-issue control-objective mitigation finding historic likelihood impact risk severity access-vector access-complexity authentication confidentiality-impact integrity-impact availability-impact exploitability remediation-level report-confidence collateral-damage-potential target-distribution confidentiality-requirement integrity-requirement availability-requirement attack-vector access-complexity privileges-required user-interaction scope confidentiality-impact integrity-impact availability-impact exploit-code-maturity remediation-level report-confidence modified-attack-vector modified-attack-complexity modified-privileges-required modified-user-interaction modified-scope modified-confidentiality modified-integrity modified-availability confidentiality-requirement integrity-requirement availability-requirement http://fedramp.gov http://fedramp.gov/ns/oscal http://csrc.nist.gov/ns/oscal http://csrc.nist.gov/ns/oscal/unknown http://cve.mitre.org http://www.first.org/cvss/v2.0 http://www.first.org/cvss/v3.0 http://www.first.org/cvss/v3.1 local adjacent-network network unproven proof-of-concept functional high not-defined official-fix temporary-fix workaround unavailable not-defined unconfirmed uncorroborated confirmed not-defined none low low-medium medium-high high not-defined none low medium high not-defined network adjacent local physical not-defined unproven proof-of-concept functional high not-defined official-fix temporary-fix workaround unavailable not-defined unknown reasonable confirmed not-defined network adjacent local physical not-defined unchanged changed tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user resource tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource false-positive accepted risk-adjusted priority recommendation planned completed tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource avoid mitigate transfer accept share contingency none component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource seconds minutes hours days months years vendor-check-in status-update milestone-complete mitigation remediated closed dr-submission dr-updated dr-approved dr-rejected component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource open investigating remediating deviation-requested deviation-approved closed open investigating remediating deviation-requested deviation-approved closed http://fedramp.gov http://fedramp.gov/ns/oscal law regulation standard guidance policy procedure guide rules-of-behavior plan system-security-plan artifact evidence screen-shot image tool-report raw-tool-output interview-notes questionnaire report fedramp-citations fedramp-acronyms fedramp-logo separation-of-duties-matrix logo personally-identifiable-information agreement isa-agreement incident-response-plan information-security-policies-and-procedures users-guide privacy-impact-assessment information-system-contingency-plan configuration-management-plan logo image screen-shot law regulation standard external-guidance acronyms citation policy procedure system-guide users-guide administrators-guide rules-of-behavior plan artifact evidence tool-output raw-data interview-notes questionnaire report agreement SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource implemented partial planned alternative not-applicable this-system system interconnection software hardware service policy physical process-procedure plan guidance standard validation network depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network imported-from implementation-point leveraged-authorization-uuid inherited-uuid asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function version patch-level model release-date validation-type validation-reference isa-title isa-date isa-remote-system-name ipv4-address ipv6-address direction operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider isa-poc-local isa-poc-remote isa-authorizing-official-local isa-authorizing-official-remote under-development operational disposition other this-system system interconnection software hardware service policy physical process-procedure plan guidance standard validation network depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network imported-from implementation-point leveraged-authorization-uuid inherited-uuid asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function version patch-level model release-date validation-type validation-reference isa-title isa-date isa-remote-system-name ipv4-address ipv6-address direction operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider isa-poc-local isa-poc-remote isa-authorizing-official-local isa-authorizing-official-remote under-development operational disposition other version patch-level model release-date validation-type validation-reference asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management ipv4-address ipv6-address fqdn uri serial-number netbios-name mac-address physical-location is-scanned hardware-model os-name os-version software-name software-version software-patch-level asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider canonical alternate latest-version predecessor-version successor-version creator prepared-by prepared-for content-approver contact canonical alternate predecessor-version successor-version version-history EXAMINE INTERVIEW TEST UNKNOWN tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user resource ssp-statement-issue control-objective mitigation finding historic tool assessment-platform party likelihood impact risk severity access-vector access-complexity authentication confidentiality-impact integrity-impact availability-impact exploitability remediation-level report-confidence collateral-damage-potential target-distribution confidentiality-requirement integrity-requirement availability-requirement attack-vector access-complexity privileges-required user-interaction scope confidentiality-impact integrity-impact availability-impact exploit-code-maturity remediation-level report-confidence modified-attack-vector modified-attack-complexity modified-privileges-required modified-user-interaction modified-scope modified-confidentiality modified-integrity modified-availability confidentiality-requirement integrity-requirement availability-requirement http://fedramp.gov http://fedramp.gov/ns/oscal http://csrc.nist.gov/ns/oscal http://csrc.nist.gov/ns/oscal/unknown http://cve.mitre.org http://www.first.org/cvss/v2.0 http://www.first.org/cvss/v3.0 http://www.first.org/cvss/v3.1 local adjacent-network network unproven proof-of-concept functional high not-defined official-fix temporary-fix workaround unavailable not-defined unconfirmed uncorroborated confirmed not-defined none low low-medium medium-high high not-defined none low medium high not-defined network adjacent local physical not-defined unproven proof-of-concept functional high not-defined official-fix temporary-fix workaround unavailable not-defined unknown reasonable confirmed not-defined network adjacent local physical not-defined unchanged changed tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user resource tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource false-positive accepted risk-adjusted priority recommendation planned completed tool assessment-platform party component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource avoid mitigate transfer accept share contingency none component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource seconds minutes hours days months years vendor-check-in status-update milestone-complete mitigation remediated closed dr-submission dr-updated dr-approved dr-rejected component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource component inventory-item location party user component inventory-item location party user resource component inventory-item location party user resource open investigating remediating deviation-requested deviation-approved closed open investigating remediating deviation-requested deviation-approved closed http://fedramp.gov http://fedramp.gov/ns/oscal https://fedramp.gov http://fedramp.gov/ns/oscal https://ietf.org/rfc/rfc4122 http://ietf.org/rfc/rfc4122 law regulation standard guidance policy procedure guide rules-of-behavior plan system-security-plan artifact evidence screen-shot image tool-report raw-tool-output interview-notes questionnaire report fedramp-citations fedramp-acronyms fedramp-logo separation-of-duties-matrix logo personally-identifiable-information agreement isa-agreement incident-response-plan information-security-policies-and-procedures users-guide privacy-impact-assessment information-system-contingency-plan configuration-management-plan logo image screen-shot law regulation standard external-guidance acronyms citation policy procedure system-guide users-guide administrators-guide rules-of-behavior plan artifact evidence tool-output raw-data interview-notes questionnaire report agreement SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 reference related required incorporated-into moved-to reference related required incorporated-into moved-to label sort-id alt-identifier alt-label overview statement guidance example assessment assessment-method objective assessment-objective objective assessment-objective objective assessment-objective objective assessment-objective objects assessment-objects overview statement guidance example assessment assessment-method objective assessment-objective objects assessment-objects label sort-id alt-identifier label sort-id alt-identifier label sort-id alt-identifier status label sort-id alt-identifier status reference related required incorporated-into moved-to reference related required incorporated-into moved-to label sort-id alt-identifier alt-label overview statement guidance example assessment assessment-method objective assessment-objective objective assessment-objective objective assessment-objective objective assessment-objective objects assessment-objects overview statement guidance example assessment assessment-method objective assessment-objective objects assessment-objects label sort-id alt-identifier label sort-id alt-identifier label sort-id alt-identifier status label sort-id alt-identifier status label sort-id alt-identifier alt-label label sort-id alt-identifier label sort-id alt-identifier label sort-id alt-identifier label sort-id alt-identifier source-profile source-profile-uuid canonical alternate latest-version predecessor-version successor-version resolution-tool source-profile-uuid creator prepared-by prepared-for content-approver contact canonical alternate predecessor-version successor-version version-history label sort-id alt-identifier alt-label law regulation standard guidance policy procedure guide rules-of-behavior plan system-security-plan artifact evidence screen-shot image tool-report raw-tool-output interview-notes questionnaire report fedramp-citations fedramp-acronyms fedramp-logo separation-of-duties-matrix logo personally-identifiable-information agreement isa-agreement incident-response-plan information-security-policies-and-procedures users-guide privacy-impact-assessment information-system-contingency-plan configuration-management-plan logo image screen-shot law regulation standard external-guidance acronyms citation policy procedure system-guide users-guide administrators-guide rules-of-behavior plan artifact evidence tool-output raw-data interview-notes questionnaire report agreement SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 interconnection software hardware service policy physical process-procedure plan guidance standard validation asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider depends-on validation proof-of-compliance baseline-template uses-service system-security-plan uses-network version patch-level model release-date validation-type validation-reference asset-type asset-id asset-tag public virtual vlan-id network-id label sort-id baseline-configuration-name allows-authenticated-scan function operating-system database web-server dns-server email-server directory-server pbx firewall router switch storage-array appliance asset-owner asset-administrator security-operations network-operations incident-response help-desk configuration-management maintainer provider canonical alternate latest-version predecessor-version successor-version creator prepared-by prepared-for content-approver contact canonical alternate predecessor-version successor-version version-history law regulation standard guidance policy procedure guide rules-of-behavior plan system-security-plan artifact evidence screen-shot image tool-report raw-tool-output interview-notes questionnaire report fedramp-citations fedramp-acronyms fedramp-logo separation-of-duties-matrix logo personally-identifiable-information agreement isa-agreement incident-response-plan information-security-policies-and-procedures users-guide privacy-impact-assessment information-system-contingency-plan configuration-management-plan logo image screen-shot law regulation standard external-guidance acronyms citation policy procedure system-guide users-guide administrators-guide rules-of-behavior plan artifact evidence tool-output raw-data interview-notes questionnaire report agreement SHA-224 SHA-256 SHA-384 SHA-512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 label sort-id alt-identifier alt-label label sort-id alt-identifier label sort-id alt-identifier canonical alternate latest-version predecessor-version successor-version creator prepared-by prepared-for content-approver contact canonical alternate predecessor-version successor-version version-history before after starting ending label sort-id alt-identifier alt-label label sort-id alt-identifier label sort-id alt-identifier label sort-id alt-identifier param prop link part mapping map
@@ -89,7 +90,7 @@ address is within the United States of America.
Haven
ME
00000
- us
+ US
@@ -1209,7 +1211,7 @@ a URI fragment. The fragment must start with a hashtag (#) and include the UUID