Conditional parameter insertion for CM-06 in FedRAMP Profiles

[anweiss]

User Story:

As an OSCAL profile maintainer, I have the ability to define dynamic parameters based on certain requirements. While not a common scenario, a specific example can be found with cm-6_prm_1 and the FedRAMP Profiles. The FedRAMP High and Moderate profiles simply define one value for cm-6_prm_1, which is United States Government Configuration Baseline (USGCB). However, the FedRAMP profiles also list two custom requirements for cm-6.a but that aren't defined as parameter values:

CM-6 (a) Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available.
CM-6 (a) Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).

These requirements (if met), can be interpreted as conditional (dynamic) values for parameter cm-6_prm_1. However, there's no way to define any sort of conditional parameter value. Instead, the entirety of the text would have to be inserted into cm-6_prm_1 and interpreted as something like the following:

<set-param param-id="cm-6_prm_1">
    <constraint>
        <p>United States Government Configuration Baseline (USGCB) or;</p>
    </constraint>
    <constraint>
        <ul>
            <li>Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available.</li>
            <li>Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).</li>
        </ul>
    </constraint>
</set-param>

Some sort of multi-constraint logic would be helpful. This could likely be accomplished with the "declarations" model that allows one to apply attributes to the constraint elements for defining any sort of custom logic defined by profile maintainers.

Goals:

More granular parameter insertion logic can be defined and parsed.

Dependencies:

Related to #14, #106, #66.

Acceptance Criteria

Conditional logic can be applied to parameter insertions to allow for dynamic parameters.

[wendellpiez]

I think this could be (more simply) a choice not a constraint:

<set-param id="cm-6_prm_1">
    <choice>United States Government Configuration Baseline (USGCB) or;</choice>
    <choice>Requirement 1: The service provider shall use the Center for Internet Security
        guidelines (Level 1) to establish configuration settings or establishes its own
        configuration settings if USGCB is not available. Requirement 2: The service
        provider shall ensure that checklists for configuration settings are Security
        Content Automation Protocol (SCAP) validated or SCAP compatible (if validated
        checklists are not available). </choice>
</set-param>

(Note the actual choice is between A and B-and-C; there are not three choices.)

However I also think that new requirements might be added to the control as an amendment (alteration) in the profile -- and that at higher levels (SSP etc) there will have to be language addressing these, to satisfy the control as FedRAMP defines it.

This is the simple solution ("it can be done by hand"). We could go further modeling the interdependencies but I think that probably needs to wait till we look more closely at the possibilities with constraint. We have suggested that it would be used for lexical and datatyping constraints but there may be co-occurrence constraints of this sort, that could also be validable.

[david-waltermire]

@anweiss Do you think that @wendellpiez suggestion above would suffice? If not, let's address this in M2.

[anweiss]

@wendellpiez is it possible to delineate between "sub-choices" in this case? as in, can we tag "B" and "C" as "sub-choices" so it can be more clearly denoted?

[wendellpiez]

@anweiss not as currently modeled, no. There are also further ways to work around, which we could discuss.

[anweiss]

Thanks @wendellpiez. Maybe something to think about for M2, but otherwise, not a priority at the moment IMO.

[brian-ruf]

Will update profiles to reflect additional constraints. May need to seek approval since this deviates from the published baselines.

[david-waltermire]

@brianrufgsa Ok. We can put this issue on hold until the necessary approvals are completed.

[david-waltermire]

This is being worked in PR #471. Need to confirm this has been completed before closing.

[wendellpiez]

Sprint 23 Progress Sep 5

@brianrufgsa could you please update on current status, in regard to CM-6 and in general?

I believe our current models are adequate, but the acid test is in the FedRAMP data.

[brian-ruf]

This should have all been addressed in the latest FedRAMP profiles. @brianrufgsa to verify.