Provide example OSCAL Profile representation for controls with testing requirements included

[mlysaght2017]

Feature Request

Description of Problem:

#326 includes an attempt at representing a sample of common controls in an OSCAL Profile representation, with the inclusion of associated testing requirements. It is still unclear how best to represent the testing requirements for the controls within an OSCAL profile and it is agreed that the current OSCAL profile "PoC" in #326 needs to be massaged.

Potential Solutions:

With the controls and testing requirements in #326 as a starting point, provide an updated OSCAL control catalog/profile representation that aligns with best practice/NIST guidance so that we have an example target state to start building automation for.

[iMichaela]

Based on the current content, the OSCAL artifact will be a catalog (mini). A profile can be created from that catalog afterwards.

[mlysaght2017]

From @iMichaela : generated the attached samples of CCC catalog resolved which is equivalent to a mini catalog. Need to further discuss the way the data is represented and to settle on some details.

Initial: oscal-catalog.json

Also need to discuss where we keep such as example files in CCC repo

[eddie-knight]

@d1gital-f could we set up a strategy session discussing the OSCAL outputs? (user value, needs, etc)

[github-actions[bot]]

This issue will be closed as stale in 7 days. Please update this issue if it is still needed.

[github-actions[bot]]

Closed as stale. An update may reopen this issue.