fedramp-automation
fedramp-automation copied to clipboard
Validator yields error when SSP attached to POA&M Back Matter
Describe the bug
When an SSP is attached to a POA&M via back-matter resource, the validator still yields an error stating that an SSP must be declared as a resource. {A clear and concise description of what the bug is.}
Who is the bug affecting?
Telos
What version of OSCAL are you using? (Check our info on supported OSCAL versions)
What is affected by this bug?
Validation {Describe the impact the bug is having.}
When does this occur?
When Validating POA&M's {Describe the conditions under which the bug is occurring.}
How do we replicate the issue?
{What are the steps to reproduce the behavior?}
- Create an SSP and POA&M file
- Include the SSP as a resource in POA&M back matter
- Run POA&M through validator
- Note errors
{If applicable, add screenshots to help explain your problem.}
"import-ssp":{ "href":"#c9db1389-df23-4118-b1a2-078d33734880"},
...
"back-matter":{
"resources":[ "uuid":"c9db1389-df23-4118-b1a2-078d33734880", "title":"OSCAL-API FedRAMP System Security Plan",
"props":["name":"type", "ns":"https://fedramp.gov/ns/oscal", "value":"ssp" "rlinks":[ "href":"deliverable/OSCAL-API_OSCAL-export_20220923.xml"
Expected behavior (i.e. solution)
SSP is accepted as back matter resource. {A clear and concise description of what you expected to happen.}
Other Comments
{Add any other context about the problem here.}
The problem here is the value of the prop/@value. The Guide is incorrect to use 'ssp'. It should be 'system-security-plan' as shown in the fedramp_values document (linked below).
This will need to be updated by FedRAMP documention.
https://github.com/18F/fedramp-automation/blob/d61203607904f0dfc012af2dcd63d766d9a31586/src/content/resources/xml/fedramp_values.xml#L524