Brian Ruf

Customer Responsibility Matrix (CRM) Transform

8

# User Story: As an OSCAL SSP Author, I need to extract customer responsibilities from my OSCAL-based SSP and provide an OSCAL file to customers using the component model syntax....

Customer Responsibility and Inheritance - Export Mechanism

7

# User Story: As an OSCAL SSP Author, I need the ability to export content from my SSP suitable for my customers to import into their SSP. At a minimum,...

Incorrect Interconnection Property Value in SSP Template

1

# Describe the bug In the interconnection example content within the SSP, the Direction property (`prop[@name='direction']`) contains an invalid value. After this example was created, NIST made the decision to...

OSCAL File Fragments - System Inventory

3

# Action Item **This is a ...** - [ ] **enhancement** - Something could be better. **This relates to ...** - [ ] the **Guide to OSCAL-based FedRAMP System Security...

Convert FedRAMP Laws and Regulations to OSCAL Back-Matter Syntax

1

# Action Item **This is a ...** - [ ] **enhancement** - Something could be better. **This relates to ...** - [ ] **General/Overall** ## Describe the problem or enhancement...

SSP Control Implementation Scope/Origination

4

# User Story: As an OSCAL we need to better differentiate scope and origination of responsibility for control and more granular control statements in the SSP model. See the table...

AP/AR/POA&M Local Definitions and Metadata Party/Location Require a Link to Corrected Content

14

# User Story: **When a local definition is a correction, a mechanism is required to link the corrected content to the original content.** We intend for the the AP, AR,...

Documentation Update: Control Representations in SSP

2

# User Story: As an OSCAL SSP author, I need to understand options for representing controls that meet various organizational needs and circumstances, such as representing control responses for a...

Assessment Models: Timing and Expiration

1

# User Story: In an effort to more fully support activities such as continuous assessment, the assessment plan and assessment results models must have the ability to support timing of...

**Is your feature request related to a problem? Please describe.** The OSCAL GUI must be setup to handle UUIDs, which NIST is moving to in OSCAL starting with Milestone Release...