Modify frr295 constraint requiring 'this-system' by-component

[Telos-sa]

This is a ...

request - need something additional provided

This relates to ...

• the FedRAMP SSP OSCAL Template (JSON or XML Format)
• the FedRAMP OSCAL Validations

What is your feedback?

The frr295 constraint requires every control statement to have a by-component that links back to the this-system component. In the case that a statement is fully inherited, and there is no implementation local to this-system, I don't think this constraint should be enforced.

Im wondering if the constraint can be modified to require there be at least 1 by-component for each statement, rather than each statement requiring a this-system by-component. Please let me know your thoughts on this, or if you think this should be handled/represented a different way.

Acceptance Criteria

• Revert frr295 #1223
• Update documentation to explain requirement to be "one component must be used and this system should be the catch-all for all control implementation that is leveraged or inherited without 'this system' layer of controls."

Where, exactly?

• OSCAL SSP v1.1.3
• oscal-cli v2.4.0
• up-to-date FedRAMP constraints

Other information

No response

[aj-stein-gsa]

This is the guidance from our updated documentation to release on this topic.

There must always be a “This System” component in the SSP. This is used in several ways:

Holistic Overview: The SSP author may wish to provide a more holistic overview of how several components work together, even if details are provided individually in other by-component assemblies.

Catch-all: Any control response that does not cleanly align with another system component may be described in the “This System” component.

Legacy SSP Conversion: When converting a legacy SSP to OSCAL, the legacy control response statements may initially be associated with the “This System” component until the SSP author is able to provide responses for individual components.

So that is expected behavior for now. That said, we will revisit the constraint given your feedback.