From 191fe2aa6f885c8fcdb7d32e9c7cb3652a5e03a6 Mon Sep 17 00:00:00 2001 From: Chris Compton Date: Mon, 17 Oct 2022 13:38:31 -0500 Subject: [PATCH] POAM related finding support, fixes #1120 (#1478) * Add related finding assembly. #1120 * Add finding assembly to support related-findings, also moved finding to assessment common from assessment result metaschema. * Accept suggestion to revise description. Co-authored-by: Alexander Stein --- .../oscal_assessment-common_metaschema.xml | 66 +++++++++++++++++++ .../oscal_assessment-results_metaschema.xml | 66 +------------------ src/metaschema/oscal_poam_metaschema.xml | 13 ++++ 3 files changed, 80 insertions(+), 65 deletions(-) diff --git a/src/metaschema/oscal_assessment-common_metaschema.xml b/src/metaschema/oscal_assessment-common_metaschema.xml index ef7d702212..43e8886a46 100644 --- a/src/metaschema/oscal_assessment-common_metaschema.xml +++ b/src/metaschema/oscal_assessment-common_metaschema.xml @@ -786,6 +786,72 @@ + + Finding + Describes an individual finding. + + Finding Universally Unique Identifier + + A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document. + + + + Finding Title + The title for this finding. + + + + Finding Description + A human-readable description of this finding. + + + + + + + + + + + + +

Used to identify the individual and/or tool generated this finding.

+ + + + target + + + Implementation Statement UUID + + A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related. + + + + Related Observation + Relates the finding to a set of referenced observations that were used to determine the finding. + + + Observation Universally Unique Identifier Reference + + A machine-oriented identifier reference to an observation defined in the list of observations. + + + + + Associated Risk + Relates the finding to a set of referenced risks that were used to determine the finding. + + + Risk Universally Unique Identifier Reference + + A machine-oriented identifier reference to a risk defined in the list of risks. + + + + + + Observation Describes an individual observation. diff --git a/src/metaschema/oscal_assessment-results_metaschema.xml b/src/metaschema/oscal_assessment-results_metaschema.xml index 5637803d17..9ae9a4e924 100644 --- a/src/metaschema/oscal_assessment-results_metaschema.xml +++ b/src/metaschema/oscal_assessment-results_metaschema.xml @@ -248,71 +248,7 @@ - - Finding - Describes an individual finding. - - Finding Universally Unique Identifier - - A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this finding in this or other OSCAL instances. The locally defined UUID of the finding can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions of the document. - - - - Finding Title - The title for this finding. - - - - Finding Description - A human-readable description of this finding. - - - - - - - - - - - - -

Used to identify the individual and/or tool generated this finding.

- - - - target - - - Implementation Statement UUID - - A machine-oriented identifier reference to the implementation statement in the SSP to which this finding is related. - - - - Related Observation - Relates the finding to a set of referenced observations that were used to determine the finding. - - - Observation Universally Unique Identifier Reference - - A machine-oriented identifier reference to an observation defined in the list of observations. - - - - - Associated Risk - Relates the finding to a set of referenced risks that were used to determine the finding. - - - Risk Universally Unique Identifier Reference - - A machine-oriented identifier reference to a risk defined in the list of risks. - - - - - + diff --git a/src/metaschema/oscal_poam_metaschema.xml b/src/metaschema/oscal_poam_metaschema.xml index 6a4a52f7e2..840ee94c39 100644 --- a/src/metaschema/oscal_poam_metaschema.xml +++ b/src/metaschema/oscal_poam_metaschema.xml @@ -44,6 +44,9 @@ + + + @@ -129,6 +132,16 @@ + + Related Finding + Relates the poam-item to referenced finding(s). + + + Finding Universally Unique Identifier Reference + A machine-oriented identifier reference to a finding defined in the list of findings. + + +