has-required-response-points appears to be validating the wrong statement layers

[Telos-sa]

This is a ...

question - need to understand something

This relates to ...

• the FedRAMP OSCAL Registry
• the FedRAMP OSCAL baselines
• the Guide to OSCAL-based FedRAMP Content
• the Guide to OSCAL-based FedRAMP System Security Plans (SSP)
• the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP)
• the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR)
• the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M)
• the FedRAMP SSP OSCAL Template (JSON or XML Format)
• the FedRAMP SAP OSCAL Template (JSON or XML Format)
• the FedRAMP SAR OSCAL Template (JSON or XML Format)
• the FedRAMP POA&M OSCAL Template (JSON or XML Format)
• the FedRAMP OSCAL Validations

What is your feedback?

When validating an OSCAL SSP we are getting the following errors, stating that we are not including the necessary response-point control layers - this error shows up for 169 different controls (High Baseline). Here is an example of the error for ca-7.4_smt

[ERROR] [/catalog/group[4]/control[6]/control[2]/part[1]] has-required-response-points: All Response points defined in the baseline MUST have corresponding statements values in the SSP. Missing statement: (ca-7.4_smt).

When looking at the FedRAMP High Baseline, there is no response-point prop for ca-7.4_smt - rather the response-points are under ca-7.4_smt.a, ca-7.4_smt.b, and ca-7.4_smt.c:

<part name="statement" id="ca-7.4_smt">
   <p>Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:</p>
   <part name="item" id="ca-7.4_smt.a">
      <prop ns="https://fedramp.gov/ns/oscal"
            name="response-point"
            value="You must fill in this response point."/>
      <prop name="label" value="(a)"/>
      <p>Effectiveness monitoring;</p>
   </part>
   <part name="item" id="ca-7.4_smt.b">
      <prop ns="https://fedramp.gov/ns/oscal"
            name="response-point"
            value="You must fill in this response point."/>
      <prop name="label" value="(b)"/>
      <p>Compliance monitoring; and</p>
   </part>
   <part name="item" id="ca-7.4_smt.c">
      <prop ns="https://fedramp.gov/ns/oscal"
            name="response-point"
            value="You must fill in this response point."/>
      <prop name="label" value="(c)"/>
      <p>Change monitoring.</p>
   </part>
</part>

Is this a known issue? Or am I interpreting the requirements of this has-required-response-points rule incorrectly?
I've updated the telos-fedramp-pilot repository with the OSCAL SSP that generates these errors.

Where, exactly?

• oscal-cli v2.4.0
• up-to-date fedramp-external-allowed-values.xml and fedramp-external-constraints.xml
• OSCAL SSP v1.1.3
• FedRAMP Rev 5 High Baseline - version:fedramp2.1.0-oscal1.0.4

Other information

No response

[wandmagic]

I'll take a look at this and add some unit tests to cover this case to assure the constraint is made correctly

[wandmagic]

once this PR is merged and you're able to test with the new version we can close this

[aj-stein-gsa]

@Telos-sa, can you please test the updated version of this constraint in develop and confirm before an upcoming release that the change resolves the bug you had reported prior? Thanks!

[wandmagic]

Once the fix has been confirmed to work, please close this issue @Telos-sa