Assessment Plan Model Development Snapshot XML Format Reference
The following is the XML format reference for this model, which is organized hierarchically. Each entry represents the corresponding XML element or attribute in the model’s XML format, and provides details about the semantics and use of the element or attribute. The XML Format Outline provides a streamlined, hierarchical representation of this model’s XML format which can be used along with this reference to better understand the XML representation of this model.
XML namespace http://csrc.nist.gov/ns/oscal/1.0
Description An assessment plan, such as those provided by a FedRAMP assessor.
Attribute (1)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this assessment plan in this or other OSCAL instances. The locally defined UUID of the assessment plan can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Elements (9)
Description Provides information about the containing document, and defines concepts that are shared across the document.
Remarks
All OSCAL documents use the same metadata structure, that provides a consistent way of expressing OSCAL document metadata across all OSCAL models. The metadata section also includes declarations of individual objects (i.e., roles, location, parties) that may be referenced within and across linked OSCAL documents.
The metadata in an OSCAL document has few required fields, representing only the bare minimum data needed to differentiate one instance from another. Tools and users creating OSCAL documents may choose to use any of the optional fields, as well as extension mechanisms (e.g., properties, links) to go beyond this minimum to suit their use cases.
A publisher of OSCAL content can use the published, last-modified, and version fields to establish information about an individual in a sequence of successive revisions
of a given OSCAL-based publication. The metadata for a previous revision can be represented
as a revision within this object. Links may also be provided using the predecessor-version and successor-version link relations to provide for direct access to the related resource. These relations
can be provided as a link child of this object or as link within a given revision.
A responsible-party entry in this context refers to roles and parties that have responsibility relative
to the production, review, publication, and use of the containing document.
Constraints (14)
index for role an index index-metadata-role-ids shall list values returned by targets role using keys constructed of key field(s) @id
is unique for document-id: any target value must be unique (i.e., occur only once)
is unique for prop: any target value must be unique (i.e., occur only once)
index for .//prop an index index-metadata-property-uuid shall list values returned by targets .//prop using keys constructed of key field(s) @uuid
is unique for link: any target value must be unique (i.e., occur only once)
index for role an index index-metadata-role-id shall list values returned by targets role using keys constructed of key field(s) @id
index for location an index index-metadata-location-uuid shall list values returned by targets location using keys constructed of key field(s) @uuid
index for party an index index-metadata-party-uuid shall list values returned by targets party using keys constructed of key field(s) @uuid
index for party[@type='organization'] an index index-metadata-party-organizations-uuid shall list values returned by targets party[@type='organization'] using keys constructed of key field(s) @uuid
is unique for responsible-party: any target value must be unique (i.e., occur only once)
allowed values for responsible-party/@role-id
The value may be locally defined, or one of the following:
- creator: Indicates the person or organization that created this content.
- prepared-by: Indicates the person or organization that prepared this content.
- prepared-for: Indicates the person or organization for which this content was created.
- content-approver: Indicates the person or organization responsible for all content represented in the "document".
- contact: Indicates the person or organization to contact for questions or support related to this content.
allowed value for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- keywords: The value identifies a comma-seperated listing of keywords associated with this content. These keywords may be used as search terms for indexing and other applications.
allowed values for link/@rel
The value may be locally defined, or one of the following:
- canonical: The link identifies the authoritative location for this resource. Defined by RFC 6596.
- alternate: The link identifies an alternative location or format for this resource. Defined by the HTML Living Standard
- latest-version: This link identifies a resource containing the latest version in the version history. Defined by RFC 5829.
- predecessor-version: This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
- successor-version: This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
is unique for document-id: any target value must be unique (i.e., occur only once)
Elements (15)
Description A name given to the document, which may be used by a tool for display and navigation.
Description The date and time the document was last made available.
Remarks
Typically, this date value will be machine-generated at the time the containing document is published.
In some cases, an OSCAL document may be derived from some source material provided
in a different format. In such a case, the published value should indicate when the OSCAL document instance was last published, not the
source material.
Description The date and time the document was last stored for later retrieval.
Remarks
This value represents the point in time when the OSCAL document was last updated, or at the point of creation the creation date. Typically, this date value will be machine generated at time of creation or modification. Ideally, this field will be managed by the editing tool or service used to make modifications when storing the modified document.
The intent of the last modified timestamp is to distinguish between significant change milestones when the document may be accessed by multiple entities. This allows a given entity to differentiate between mutiple document states at specific points in time. It is possible to make multiple modifications to the document without storing these changes. In such a case, the last modified timestamp might not be updated until the document is finally stored.
In some cases, an OSCAL document may be derived from some source material in a different
format. In such a case, the last-modified value should indicate the last modification time of the OSCAL document instance,
not the source material.
Description Used to distinguish a specific revision of an OSCAL document from other previous and future versions.
Remarks
A version may be a release number, sequence number, date, or other identifier sufficient to distinguish between different document revisions.
While not required, it is recommended that OSCAL content authors use Semantic Versioning as the version format. This allows for the easy identification of a version tree consisting of major, minor, and patch numbers.
A version is typically set by the document owner or by the tool used to maintain the content.
Description The OSCAL model version the document was authored against and will conform to as valid.
Remarks
Indicates the version of the OSCAL model to which the document conforms, for example
1.1.0
or 1.0.0-milestone1
. That can be used as a hint for a tool indicating which version of the OSCAL XML
or JSON schema to use for validation.
The OSCAL version serves a different purpose from the document version and is used to represent a different concept. If both have the same value, this is coincidental.
Element (1)
Description An entry in a sequential list of revisions to the containing document, expected to be in reverse chronological order (i.e. latest first).
Remarks
While published, last-modified, and oscal-version are not required, values for these entries should be provided if the information
is known. A link with a rel of source
should be provided if the information is known.
Constraint (1)
allowed values for link/@rel
The value may be locally defined, or one of the following:
- canonical: The link identifies the authoritative location for this resource. Defined by RFC 6596.
- alternate: The link identifies an alternative location or format for this resource. Defined by the HTML Living Standard
- predecessor-version: This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
- successor-version: This link identifies a resource containing the predecessor version in the version history. Defined by RFC 5829.
- version-history: This link identifies a resource containing the version history of this document. Defined by RFC 5829.
Elements (8)
Description A name given to the document revision, which may be used by a tool for display and navigation.
Description The date and time the document was last made available.
Remarks
Typically, this date value will be machine-generated at the time the containing document is published.
In some cases, an OSCAL document may be derived from some source material provided
in a different format. In such a case, the published value should indicate when the OSCAL document instance was last published, not the
source material.
Description The date and time the document was last stored for later retrieval.
Remarks
This value represents the point in time when the OSCAL document was last updated, or at the point of creation the creation date. Typically, this date value will be machine generated at time of creation or modification. Ideally, this field will be managed by the editing tool or service used to make modifications when storing the modified document.
The intent of the last modified timestamp is to distinguish between significant change milestones when the document may be accessed by multiple entities. This allows a given entity to differentiate between mutiple document states at specific points in time. It is possible to make multiple modifications to the document without storing these changes. In such a case, the last modified timestamp might not be updated until the document is finally stored.
In some cases, an OSCAL document may be derived from some source material in a different
format. In such a case, the last-modified value should indicate the last modification time of the OSCAL document instance,
not the source material.
Description Used to distinguish a specific revision of an OSCAL document from other previous and future versions.
Remarks
A version may be a release number, sequence number, date, or other identifier sufficient to distinguish between different document revisions.
While not required, it is recommended that OSCAL content authors use Semantic Versioning as the version format. This allows for the easy identification of a version tree consisting of major, minor, and patch numbers.
A version is typically set by the document owner or by the tool used to maintain the content.
Description The OSCAL model version the document was authored against and will conform to as valid.
Remarks
Indicates the version of the OSCAL model to which the document conforms, for example
1.1.0
or 1.0.0-milestone1
. That can be used as a hint for a tool indicating which version of the OSCAL XML
or JSON schema to use for validation.
The OSCAL version serves a different purpose from the document version and is used to represent a different concept. If both have the same value, this is coincidental.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A document identifier qualified by an identifier scheme.
Remarks
A document identifier provides a globally unique identifier with a cross-instance scope that is used for a group of documents that are to be treated as different versions, representations or digital surrogates of the same document.
A document identifier provides an additional data point for identifying a document that can be assigned by a publisher or organization for purposes in a wider system, such as a digital object identifier (DOI) or a local content management system identifier.
Use of a document identifier allows for document creators to associate sets of documents
that are related in some way by the same document-id.
An OSCAL document always has an implicit document identifier provided by the document's
UUID, defined by the uuid on the top-level object. Having a default UUID-based identifier ensures all documents
can be minimally identified when other document identifiers are not provided.
Attribute (1)
Description Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- http://www.doi.org/: A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Defines a function, which might be assigned to a party in a specific situation.
Remarks
Permissible values to be determined closer to the application (e.g. by a receiving authority).
OSCAL has defined a set of standardized roles for consistent use in OSCAL documents. This allows tools consuming OSCAL content to infer specific semantics when these roles are used. These roles are documented in the specific contexts of their use (e.g., responsible-party, responsible-role). When using such a role, it is necessary to define these roles in this list, which will then allow such a role to be referenced.
Attribute (1)
Description A unique identifier for the role.
Elements (6)
Description A name given to the role, which may be used by a tool for display and navigation.
Description A short common name, abbreviation, or acronym for the role.
Description A summary of the role's purpose and associated responsibilities.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A physical point of presence, which may be associated with people, organizations, or other concepts within the current or linked OSCAL document.
Remarks
An address might be sensitive in nature. In such cases a title, mailing address, email-address, and/or phone number may be used instead.
Constraints (5)
allowed value for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- type: Characterizes the kind of location.
allowed value for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value
The value must be one of the following:
- data-center: A location that contains computing assets. A class can be used to indicate the sub-type of data-center as primary or alternate.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type' and @value='data-center']/@class
The value must be one of the following:
- primary: The location is a data-center used for normal operations.
- alternate: The location is a data-center used for fail-over or backup operations.
has cardinality for address the cardinality of address is constrained: 1; maximum unbounded.
has cardinality for title|address|email-address|telephone-number the cardinality of title|address|email-address|telephone-number is constrained: 1; maximum unbounded.
Attribute (1)
Description A unique ID for the location, for reference.
Elements (8)
Description A name given to the location, which may be used by a tool for display and navigation.
Description A postal address for the location.
Remarks
The physical address of the location, which will provided for physical locations. Virtual locations can omit this data item.
Attribute (1)
Description Indicates the type of address.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- home: A home address.
- work: A work address.
Elements (5)
Description A single line of an address.
Description City, town or geographical region for the mailing address.
Description State, province or analogous geographical region for a mailing address.
Description Postal or ZIP code for mailing address.
Description The ISO 3166-1 alpha-2 country code for the mailing address.
Constraint (1)
matches: a target (value) must match the regular expression '[A-Z]{2}'.
Description An email address as defined by RFC 5322 Section 3.4.1.
Remarks
A contact email associated with the location.
Description A telephone service number as defined by ITU-T E.164.
Remarks
A phone number used to contact the location.
Constraint (1)
matches: a target (value) must match the regular expression '^[0-9]{3}[0-9]{1,12}$'.
Attribute (1)
Description Indicates the type of phone number.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- home: A home phone number.
- office: An office phone number.
- mobile: A mobile phone number.
deprecated as of 1.1.0
Description The uniform resource locator (URL) for a web site or other resource associated with the location.
Remarks
This data field is deprecated in favor of using a link with an appropriate relationship.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An organization or person, which may be associated with roles or other concepts within the current or linked OSCAL document.
Remarks
A party can be optionally associated with either an address or a location. While providing a meaningful location for a party is desired, there are some cases where it might not be possible to provide an exact location or even any location.
Constraint (1)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- mail-stop: A mail stop associated with the party.
- office: The name or number of the party's office.
- job-title: The formal job title of a person.
Attributes (2)
Description A unique identifier for the party.
Description A category describing the kind of party the object describes.
Constraint (1)
allowed values
The value must be one of the following:
- person: A human being regarded as an individual.
- organization: An organized group of one or more person individuals with a specific purpose.
Elements (11)
Description The full name of the party. This is typically the legal name associated with the party.
Description A short common name, abbreviation, or acronym for the party.
Description An identifier for a person or organization using a designated scheme. e.g. an Open Researcher and Contributor ID (ORCID).
Attribute (1)
Description Indicates the type of external identifier.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- http://orcid.org/: The identifier is Open Researcher and Contributor ID (ORCID).
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description An email address as defined by RFC 5322 Section 3.4.1.
Remarks
This is a contact email associated with the party.
Description A telephone service number as defined by ITU-T E.164.
Remarks
A phone number used to contact the party.
Constraint (1)
matches: a target (value) must match the regular expression '^[0-9]{3}[0-9]{1,12}$'.
Attribute (1)
Description Indicates the type of phone number.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- home: A home phone number.
- office: An office phone number.
- mobile: A mobile phone number.
A choice:
Description A postal address for the location.
Attribute (1)
Description Indicates the type of address.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- home: A home address.
- work: A work address.
Elements (5)
Description A single line of an address.
Description City, town or geographical region for the mailing address.
Description State, province or analogous geographical region for a mailing address.
Description Postal or ZIP code for mailing address.
Description The ISO 3166-1 alpha-2 country code for the mailing address.
Constraint (1)
matches: a target (value) must match the regular expression '[A-Z]{2}'.
Description Reference to a location by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-location-uuid using a key constructed of key field(s) .
Description A reference to another party by UUID, typically an organization, that this subject is associated with.
Remarks
Since the reference target of an organizational affiliation must be another party (whether further qualified as person or organization) as inidcated by its uuid. As a machine-oriented identifier with uniqueness across document and trans-document scope, this uuid value is sufficient to reference the data item locally or globally across related
documents, e.g., in an imported OSCAL instance.
Parties of both the person or organization type can be associated with an organization using the member-of-organization.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-organizations-uuid using a key constructed of key field(s) .
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a set of persons and/or organizations that have responsibility for performing the referenced role in the context of the containing object.
Remarks
A responsible-party requires one or more party-uuid references creating a strong relationship arc between the referenced role-id and the reference parties. This differs in semantics from responsible-role which doesn't require that a party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) @role-id
Attribute (1)
Description A reference to a role performed by a party.
Elements (4)
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An action applied by a role within a given party to the content.
Constraints (4)
index has key for responsible-partythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) @role-id
index has key for responsible-partythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) party-uuid
allowed value for ./system/@value
The value may be locally defined, or the following:
- http://csrc.nist.gov/ns/oscal: This value identifies action types defined in the NIST OSCAL namespace.
allowed values for ./type[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@value
The value must be one of the following:
- approval: An approval of a document instance's content.
- request-changes: A request from the responisble party or parties to change the content.
Attributes (4)
Description A unique identifier that can be used to reference this defined action elsewhere in an OSCAL document. A UUID should be consistently used for a given location across revisions of the document.
Description The date and time when the action occurred.
Description The type of action documented by the assembly, such as an approval.
Description Specifies the action type system used.
Remarks
Provides a means to segment the value space for the type, so that different organizations and individuals can assert control over the allowed
action's type. This allows the semantics associated with a given type to be defined on an organization-by-organization basis.
An organization MUST use a URI that they have control over. e.g., a domain registered to the organization in a URI, a registered uniform resource names (URN) namespace.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description A reference to a set of persons and/or organizations that have responsibility for performing the referenced role in the context of the containing object.
Remarks
A responsible-party requires one or more party-uuid references creating a strong relationship arc between the referenced role-id and the reference parties. This differs in semantics from responsible-role which doesn't require that a party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) @role-id
Attribute (1)
Description A reference to a role performed by a party.
Elements (4)
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Used by the assessment plan and POA&M to import information about the system.
Remarks
Used by the SAP to import information about the system being assessed.
Attribute (1)
Description A resolvable URL reference to the system security plan for the system being assessed.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to a
back-matterresource in this or an imported document (see linking to another OSCAL object).
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Used to define data objects that are used in the assessment plan, that do not appear in the referenced SSP.
Constraints (2)
is unique for component: any target value must be unique (i.e., occur only once)
is unique for user: any target value must be unique (i.e., occur only once)
Elements (6)
Description A defined component that can be part of an implemented system.
Remarks
Components may be products, services, application programming interface (APIs), policies, processes, plans, guidance, standards, or other tangible items that enable security and/or privacy.
The type indicates which of these component types is represented.
When defining a service component where are relationship to other components is known, one or more link entries with rel values of provided-by and used-by can be used to link to the specific
component identifier(s) that provide and use the service respectively.
Used to add any components, not defined via the System Security Plan (AR->AP->SSP)
Constraints (24)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- implementation-point: Relative placement of component ('internal' or 'external') to the system.
- leveraged-authorization-uuid: UUID of the related leveraged-authorization assembly in this SSP.
- inherited-uuid: UUID of the component as it was assigned in the leveraged system's SSP.
- asset-type: Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
- asset-id: An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
- asset-tag: An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
- public: Identifies whether the asset is publicly accessible (yes/no)
- virtual: Identifies whether the asset is virtualized (yes/no)
- vlan-id: Virtual LAN identifier of the asset.
- network-id: The network identifier of the asset.
- label: A human-readable label for the parent context.
- sort-id: An alternative identifier, whose value is easily sortable among other such values in the document.
- baseline-configuration-name: The name of the baseline configuration for the asset.
- allows-authenticated-scan: Can the asset be check with an authenticated scan? (yes/no)
- function: The function provided by the asset for the system.
- version: The version of the component.
- patch-level: The specific patch level of the component.
- model: The model of the component.
- release-date: The date the component was released, such as a software release date or policy publication date.
- validation-type: Used with component-type='validation' to provide a well-known name for a kind of validation.
- validation-reference: Used with component-type='validation' to indicate the validating body's assigned identifier for their validation of this component.
allowed values for link/@rel
The value may be locally defined, or one of the following:
- depends-on: A reference to another component that this component has a dependency on.
- validation: A reference to another component of component-type=validation, that is a validation (e.g., FIPS 140-2) for this component
- proof-of-compliance: A pointer to a validation record (e.g., FIPS 140-2) or other compliance information.
- baseline-template: A reference to the baseline template used to configure the asset.
- uses-service: This service is used by the referenced component identifier.
- system-security-plan: A link to the system security plan of the external system.
- uses-network: This component uses the network provided by the identified network component.
- imported-from: The hyperlink identifies a URI pointing to the component in a component-definition that originally defined the component.
allowed values for responsible-role/@role-id
The value may be locally defined, or one of the following:
- asset-owner: Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
- asset-administrator: Responsible for administering a set of assets.
- security-operations: Members of the security operations center (SOC).
- network-operations: Members of the network operations center (NOC).
- incident-response: Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
- help-desk: Responsible for providing information and support to users.
- configuration-management: Responsible for the configuration management processes governing changes to the asset.
- maintainer: Responsible for the creation and maintenance of a component.
- provider: Organization responsible for providing the component, if this is different from the "maintainer" (e.g., a reseller).
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='asset-type']/@value
The value may be locally defined, or one of the following:
- operating-system: System software that manages computer hardware, software resources, and provides common services for computer programs.
- database: An electronic collection of data, or information, that is specially organized for rapid search and retrieval.
- web-server: A system that delivers content or services to end users over the Internet or an intranet.
- dns-server: A system that resolves domain names to internet protocol (IP) addresses.
- email-server: A computer system that sends and receives electronic mail messages.
- directory-server: A system that stores, organizes and provides access to directory information in order to unify network resources.
- pbx: A private branch exchange (PBX) provides a a private telephone switchboard.
- firewall: A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
- router: A physical or virtual networking device that forwards data packets between computer networks.
- switch: A physical or virtual networking device that connects devices within a computer network by using packet switching to receive and forward data to the destination device.
- storage-array: A consolidated, block-level data storage capability.
- appliance: A physical or virtual machine that centralizes hardware, software, or services for a specific purpose.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='allows-authenticated-scan']/@value
The value must be one of the following:
- yes: The component allows an authenticated scan.
- no: The component does not allow an authenticated scan.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='public']/@value
The value must be one of the following:
- yes: The component is publicly accessible.
- no: The component is not publicly accessible.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='virtual']/@value
The value must be one of the following:
- yes: The component is virtualized.
- no: The component is not virtualized.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='implementation-point']/@value
The value must be one of the following:
- internal: The component is implemented within the system boundary.
- external: The component is implemented outside the system boundary.
index has key for prop[@name='physical-location']this value must correspond to a listing in the index index-metadata-location-uuid using a key constructed of key field(s) @value
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='inherited-uuid']/@value: the target value must match the lexical form of the 'uuid' data type.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='release-date']/@value: the target value must match the lexical form of the 'date' data type.
allowed value for (.)[@type=('software', 'hardware', 'service')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- vendor-name: The name of the company or organization
allowed value for (.)[@type='validation']/link/@rel
The value may be locally defined, or the following:
- validation-details: A link to an online information provided by the authorizing body.
allowed value for (.)[@type='software']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- software-identifier: If a "software" component-type, the identifier, such as a SWID tag, for the software component.
allowed values for (.)[@type='service']/link/@rel
The value may be locally defined, or one of the following:
- provided-by: This service is provided by the referenced component identifier.
- used-by: This service is used by the referenced component identifier.
allowed values for (.)[@type='interconnection']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- isa-title: Title of the Interconnection Security Agreement (ISA).
- isa-date: Date of the Interconnection Security Agreement (ISA).
- isa-remote-system-name: The name of the remote interconnected system.
- ipv4-address: An Internet Protocol Version 4 interconnection address
- ipv6-address: An Internet Protocol Version 6 interconnection address
- direction: An Internet Protocol Version 6 interconnection address
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('ipv4-address','ipv6-address')]/@class
The value must be one of the following:
- local: The identified IP address is for this system.
- remote: The identified IP address is for the remote system to which this system is connected.
allowed value for (.)[@type='interconnection']/link/@rel
The value may be locally defined, or the following:
- isa-agreement: A link to the system interconnection agreement.
allowed values for (.)[@type='interconnection']/responsible-role/@role-id
The value may be locally defined, or one of the following:
- isa-poc-local: Interconnection Security Agreement (ISA) point of contact (POC) for this system.
- isa-poc-remote: Interconnection Security Agreement (ISA) point of contact (POC) for the remote interconnected system.
- isa-authorizing-official-local: Interconnection Security Agreement (ISA) authorizing official for this system.
- isa-authorizing-official-remote: Interconnection Security Agreement (ISA) authorizing official for the remote interconnected system.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='isa-date']/@value: the target value must match the lexical form of the 'dateTime' data type.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='ipv4-address']/@value: the target value must match the lexical form of the 'ip-v4-address' data type.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='ipv6-address']/@value: the target value must match the lexical form of the 'ip-v6-address' data type.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='direction']/@value
The value must be one of the following:
- incoming: Data from the remote system flows into this system.
- outgoing: Data from this system flows to the remote system.
is unique for responsible-role: any target value must be unique (i.e., occur only once)
Attributes (2)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this component elsewhere in this or other OSCAL instances. The locally defined UUID of the component can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Description A category describing the purpose of the component.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- this-system: The system as a whole.
- system: An external system, which may be a leveraged system or the other side of an interconnection.
- interconnection: A connection to something outside this system.
- software: Any software, operating system, or firmware.
- hardware: A physical device.
- service: A service that may provide APIs.
- policy: An enforceable policy.
- physical: A tangible asset used to provide physical protections or countermeasures.
- process-procedure: A list of steps or actions to take to achieve some end result.
- plan: An applicable plan.
- guidance: Any guideline or recommendation.
- standard: Any organizational or industry standard.
- validation: An external assessment performed on some other component, that has been validated by a third-party.
- network: A physical or virtual network.
Elements (9)
Description A human readable name for the system component.
Description A description of the component, including information about its function.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A summary of the technological or business purpose of the component.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Describes the operational status of the system component.
Attribute (1)
Description The operational status.
Constraint (1)
allowed values
The value must be one of the following:
- under-development: The component is being designed, developed, or implemented.
- operational: The component is currently operational and is available for use in the system.
- disposition: The component is no longer operational.
- other: Some other state.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a role with responsibility for performing a function relative to the containing object, optionally associated with a set of persons and/or organizations that perform that role.
Remarks
A responsible-role allows zero or more party-uuid references, each of which creates a relationship arc between the referenced role-id and the referenced party. This differs in semantics from responsible-party, which requires that at least one party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Attribute (1)
Description A human-oriented identifier reference to a role performed.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Information about the protocol used to provide a service.
Remarks
Used for service components to define the protocols supported by the service.
Attributes (2)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this service protocol information elsewhere in
this or other OSCAL instances. The locally defined UUID of the service protocol can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Description The common name of the protocol, which should be the appropriate "service name" from the IANA Service Name and Transport Protocol Port Number Registry.
Remarks
The short name of the protocol (e.g., https).
Elements (2)
Description A human readable name for the protocol (e.g., Transport Layer Security).
Description Where applicable this is the IPv4 port range on which the service operates.
Remarks
To be validated as a natural number (integer >= 1). A single port uses the same value for start and end. Use multiple 'port-range' entries for non-contiguous ranges.
Attributes (3)
Description Indicates the starting port number in a port range
Remarks
Should be a number within a permitted range
Description Indicates the ending port number in a port range
Remarks
Should be a number within a permitted range
Description Indicates the transport type.
Constraint (1)
allowed values
The value must be one of the following:
- TCP: Transmission Control Protocol
- UDP: User Datagram Protocol
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A single managed inventory item within the system.
Remarks
Used to add any inventory-items, not defined via the System Security Plan (AR->AP->SSP)
Constraints (9)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- ipv4-address: The Internet Protocol v4 Address of the asset.
- ipv6-address: The Internet Protocol v6 Address of the asset.
- fqdn: The full-qualified domain name (FQDN) of the asset.
- uri: A Uniform Resource Identifier (URI) for the asset.
- serial-number: A serial number for the asset.
- netbios-name: The NetBIOS name for the asset.
- mac-address: The media access control (MAC) address for the asset.
- physical-location: The physical location of the asset's hardware (e.g., Data Center ID, Cage#, Rack#, or other meaningful location identifiers).
- is-scanned: is the asset subjected to network scans? (yes/no)
- hardware-model: The model number of the hardware used by the asset.
- os-name: The name of the operating system used by the asset.
- os-version: The version of the operating system used by the asset.
- software-name: The software product name used by the asset.
- software-version: The software product version used by the asset.
- software-patch-level: The software product patch level used by the asset.
- asset-type: Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
- asset-id: An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
- asset-tag: An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
- public: Identifies whether the asset is publicly accessible (yes/no)
- virtual: Identifies whether the asset is virtualized (yes/no)
- vlan-id: Virtual LAN identifier of the asset.
- network-id: The network identifier of the asset.
- label: A human-readable label for the parent context.
- sort-id: An alternative identifier, whose value is easily sortable among other such values in the document.
- baseline-configuration-name: The name of the baseline configuration for the asset.
- allows-authenticated-scan: Can the asset be check with an authenticated scan? (yes/no)
- function: The function provided by the asset for the system.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='asset-type']/@value
The value may be locally defined, or one of the following:
- operating-system: System software that manages computer hardware, software resources, and provides common services for computer programs.
- database: An electronic collection of data, or information, that is specially organized for rapid search and retrieval.
- web-server: A system that delivers content or services to end users over the Internet or an intranet.
- dns-server: A system that resolves domain names to internet protocol (IP) addresses.
- email-server: A computer system that sends and receives electronic mail messages.
- directory-server: A system that stores, organizes and provides access to directory information in order to unify network resources.
- pbx: A private branch exchange (PBX) provides a a private telephone switchboard.
- firewall: A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
- router: A physical or virtual networking device that forwards data packets between computer networks.
- switch: A physical or virtual networking device that connects devices within a computer network by using packet switching to receive and forward data to the destination device.
- storage-array: A consolidated, block-level data storage capability.
- appliance: A physical or virtual machine that centralizes hardware, software, or services for a specific purpose.
allowed value for (.)[@type=('software', 'hardware', 'service')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- vendor-name: The name of the company or organization
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='is-scanned']/@value
The value must be one of the following:
- yes: The asset is included in periodic vulnerability scanning.
- no: The asset is not included in periodic vulnerability scanning.
allowed value for link/@rel
The value may be locally defined, or the following:
- baseline-template: A reference to the baseline template used to configure the asset.
allowed values for responsible-party/@role-id
The value may be locally defined, or one of the following:
- asset-owner: Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
- asset-administrator: Responsible for administering a set of assets.
- security-operations: Members of the security operations center (SOC).
- network-operations: Members of the network operations center (NOC).
- incident-response: Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
- help-desk: Responsible for providing information and support to users.
- configuration-management: Responsible for the configuration management processes governing changes to the asset.
- maintainer: Responsible for the creation and maintenance of a component.
- provider: Organization responsible for providing the component, if this is different from the "maintainer" (e.g., a reseller).
index has key for responsible-partythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) @role-id
index has key for responsible-partythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) party-uuid
is unique for responsible-party: any target value must be unique (i.e., occur only once)
Attribute (1)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this inventory item elsewhere in this or other OSCAL instances. The locally defined UUID of the inventory item can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Elements (6)
Description A summary of the inventory item stating its purpose within the system.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description A reference to a set of persons and/or organizations that have responsibility for performing the referenced role in the context of the containing object.
Remarks
A responsible-party requires one or more party-uuid references creating a strong relationship arc between the referenced role-id and the reference parties. This differs in semantics from responsible-role which doesn't require that a party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) @role-id
Attribute (1)
Description A reference to a role performed by a party.
Elements (4)
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description The set of components that are implemented in a given system inventory item.
Constraints (4)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- version: The version of the component.
- patch-level: The specific patch level of the component.
- model: The model of the component.
- release-date: The date the component was released, such as a software release date or policy publication date.
- validation-type: Used with component-type='validation' to provide a well-known name for a kind of validation.
- validation-reference: Used with component-type='validation' to indicate the validating body's assigned identifier for their validation of this component.
- asset-type: Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
- asset-id: An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
- asset-tag: An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
- public: Identifies whether the asset is publicly accessible (yes/no)
- virtual: Identifies whether the asset is virtualized (yes/no)
- vlan-id: Virtual LAN identifier of the asset.
- network-id: The network identifier of the asset.
- label: A human-readable label for the parent context.
- sort-id: An alternative identifier, whose value is easily sortable among other such values in the document.
- baseline-configuration-name: The name of the baseline configuration for the asset.
- allows-authenticated-scan: Can the asset be check with an authenticated scan? (yes/no)
- function: The function provided by the asset for the system.
has cardinality for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='asset-id'] the cardinality of prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='asset-id'] is constrained: 1; maximum unbounded.
allowed values for responsible-party/@role-id
The value may be locally defined, or one of the following:
- asset-owner: Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
- asset-administrator: Responsible for administering a set of assets.
- security-operations: Members of the security operations center (SOC).
- network-operations: Members of the network operations center (NOC).
- incident-response: Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
- help-desk: Responsible for providing information and support to users.
- configuration-management: Responsible for the configuration management processes governing changes to the asset.
is unique for responsible-party: any target value must be unique (i.e., occur only once)
Attribute (1)
Description A machine-oriented identifier reference to a component that is implemented as part of an inventory item.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description A reference to a set of persons and/or organizations that have responsibility for performing the referenced role in the context of the containing object.
Remarks
A responsible-party requires one or more party-uuid references creating a strong relationship arc between the referenced role-id and the reference parties. This differs in semantics from responsible-role which doesn't require that a party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
This construct is used to either: 1) associate a party or parties to a role defined
on the component using the responsible-role construct, or 2) to define a party or parties that are responsible for a role defined
within the context of the containing inventory-item.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) @role-id
Attribute (1)
Description A reference to a role performed by a party.
Elements (4)
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A type of user that interacts with the system based on an associated role.
Remarks
Permissible values to be determined closer to the application, such as by a receiving authority.
Used to add any users, not defined via the System Security Plan (AR->AP->SSP)
Constraints (4)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- type: The type of user, such as internal, external, or general-public.
- privilege-level: The user's privilege level within the system, such as privileged, non-privileged, no-logical-access.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value
The value must be one of the following:
- internal: A user account for a person or entity that is part of the organization who owns or operates the system.
- external: A user account for a person or entity that is not part of the organization who owns or operates the system.
- general-public: A user of the system considered to be outside
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='privilege-level']/@value
The value must be one of the following:
- privileged: This role has elevated access to the system, such as a group or system administrator.
- non-privileged: This role has typical user-level access to the system without elevated access.
- no-logical-access: This role has no access to the system, such as a manager who approves access as part of a process.
allowed values for role-id
The value may be locally defined, or one of the following:
- asset-owner: Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
- asset-administrator: Responsible for administering a set of assets.
- security-operations: Members of the security operations center (SOC).
- network-operations: Members of the network operations center (NOC).
- incident-response: Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
- help-desk: Responsible for providing information and support to users.
- configuration-management: Responsible for the configuration management processes governing changes to the asset.
Attribute (1)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this user class elsewhere in this or other OSCAL instances. The locally defined UUID of the system user can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Elements (8)
Description A name given to the user, which may be used by a tool for display and navigation.
Description A short common name, abbreviation, or acronym for the user.
Description A summary of the user's purpose within the system.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Reference to a role by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) .
Description Identifies a specific system privilege held by the user, along with an associated description and/or rationale for the privilege.
Elements (3)
Description A human readable name for the privilege.
Description A summary of the privilege's purpose within the system.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Describes a function performed for a given authorized privilege by this user class.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A local definition of a control objective for this assessment. Uses catalog syntax for control objective and assessment actions.
Constraints (5)
allowed values for part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- objective: **(deprecated)** Use 'assessment-objective' instead.
- assessment: **(deprecated)** Use 'assessment-method' instead.
- assessment-objective: The part defines an assessment objective.
- assessment-method: The part defines an assessment method.
has cardinality for part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')] the cardinality of part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')] is constrained: 0; maximum 1.
has cardinality for part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/prop[has-oscal-namespace(('http://csrc.nist.gov/ns/oscal','http://csrc.nist.gov/ns/rmf'))
and @name='method'] the cardinality of part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/prop[has-oscal-namespace(('http://csrc.nist.gov/ns/oscal','http://csrc.nist.gov/ns/rmf'))
and @name='method'] is constrained: 1; maximum 1.
has cardinality for part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')
and @name=('objects','assessment-objects')] the cardinality of part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('assessment','assessment-method')]/part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')
and @name=('objects','assessment-objects')] is constrained: 1; maximum 1.
has cardinality for part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')
and @name='method-id'] the cardinality of part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('objective','assessment-objective')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')
and @name='method-id'] is constrained: 1; maximum unbounded.
Attribute (1)
Description A reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Remarks
The specified control-id must be a valid value within the baseline identified by the target system's SSP via
the import-profile statement.
Elements (5)
Description A human-readable description of this control objective.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description An annotated, markup-based textual element of a control's or catalog group's definition, or a child of another part.
Remarks
A part provides for logical partitioning of prose, and can be thought of as a grouping structure
(e.g., section). A part can have child parts allowing for arbitrary nesting of prose content (e.g., statement
hierarchy). A part can contain prop objects that allow for enriching prose text with structured name/value information.
A part can be assigned an optional id, which allows references to this part from within a catalog, or within an instance
of another OSCAL model that has a need to reference the part. Examples of where part
referencing is used in OSCAL include:
- Referencing a part by id to tailor (make modifications to) a control statement in a profile.
- Referencing a control statement represented by a part in a system security plan implemented-requirement where a statement-level response is desired.
Use of part and prop provides for a wide degree of extensibility within the OSCAL catalog model. The optional
ns provides a means to qualify a part's name, allowing for organization-specific vocabularies to be defined with clear semantics.
Any organization that extends OSCAL in this way should consistently assign a ns value that represents the organization, making a given namespace qualified name unique to that organization. This allows the combination of ns and name to always be unique and unambiguous, even when mixed with extensions from other organizations.
Each organization is responsible for governance of their own extensions, and is strongly
encouraged to publish their extensions as standards to their user community. If no
ns is provided, the name is expected to be in the "OSCAL" namespace.
To ensure a ns is unique to an organization and naming conflicts are avoided, a URI containing a
DNS or other globally defined organization name should be used. For example, if FedRAMP
and DoD both extend OSCAL, FedRAMP will use the ns http://fedramp.gov/ns/oscal, while DoD might use the ns https://defense.gov for any organization specific name.
Tools that process OSCAL content are not required to interpret unrecognized OSCAL extensions; however, OSCAL compliant tools should not modify or remove unrecognized extensions, unless there is a compelling reason to do so, such as data sensitivity.
Constraint (1)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- label: A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
- sort-id: An alternative identifier, whose value is easily sortable among other such values in the document.
- alt-identifier: An alternate or aliased identifier for the parent context.
Attributes (4)
Description A unique identifier for the part.
Remarks
While a part is not required to have an id, it is often desirable for an identifier to be provided, which allows the part to be referenced elsewhere in OSCAL document instances. For this reason, it is RECOMMENDED to provide a part identifier.
Description A textual label that uniquely identifies the part's semantic type, which exists in
a value space qualified by the ns.
Description An optional namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same
name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description An optional textual providing a sub-type or characterization of the part's name, or a category to which the part belongs.
Remarks
One use of this flag is to distinguish or discriminate between the semantics of multiple
parts of the same control with the same name and ns (since even within a given namespace it can be useful to overload a name).
A class can be used in validation rules to express extra constraints over named items of
a specific class value.
A class can also be used in an OSCAL profile as a means to target an alteration to control
content.
Elements (4+)
Description An optional name given to the part, which may be used by a tool for display and navigation.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
This use of the markup-multiline type permits unwrapped block-level markup.
Description An annotated, markup-based textual element of a control's or catalog group's definition, or a child of another part.
Remarks
A part provides for logical partitioning of prose, and can be thought of as a grouping structure
(e.g., section). A part can have child parts allowing for arbitrary nesting of prose content (e.g., statement
hierarchy). A part can contain prop objects that allow for enriching prose text with structured name/value information.
A part can be assigned an optional id, which allows references to this part from within a catalog, or within an instance
of another OSCAL model that has a need to reference the part. Examples of where part
referencing is used in OSCAL include:
- Referencing a part by id to tailor (make modifications to) a control statement in a profile.
- Referencing a control statement represented by a part in a system security plan implemented-requirement where a statement-level response is desired.
Use of part and prop provides for a wide degree of extensibility within the OSCAL catalog model. The optional
ns provides a means to qualify a part's name, allowing for organization-specific vocabularies to be defined with clear semantics.
Any organization that extends OSCAL in this way should consistently assign a ns value that represents the organization, making a given namespace qualified name unique to that organization. This allows the combination of ns and name to always be unique and unambiguous, even when mixed with extensions from other organizations.
Each organization is responsible for governance of their own extensions, and is strongly
encouraged to publish their extensions as standards to their user community. If no
ns is provided, the name is expected to be in the "OSCAL" namespace.
To ensure a ns is unique to an organization and naming conflicts are avoided, a URI containing a
DNS or other globally defined organization name should be used. For example, if FedRAMP
and DoD both extend OSCAL, FedRAMP will use the ns http://fedramp.gov/ns/oscal, while DoD might use the ns https://defense.gov for any organization specific name.
Tools that process OSCAL content are not required to interpret unrecognized OSCAL extensions; however, OSCAL compliant tools should not modify or remove unrecognized extensions, unless there is a compelling reason to do so, such as data sensitivity.
Constraint (1)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- label: A human-readable label for the parent context, which may be rendered in place of the actual identifier for some use cases.
- sort-id: An alternative identifier, whose value is easily sortable among other such values in the document.
- alt-identifier: An alternate or aliased identifier for the parent context.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies an assessment or related process that can be performed. In the assessment plan, this is an intended activity which may be associated with an assessment task. In the assessment results, this an activity that was actually performed as part of an assessment.
Constraints (4)
allowed value for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- method: The assessment method to use. This typically appears on parts with the name "assessment".
has cardinality for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method'] the cardinality of prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method'] is constrained: 1; maximum unbounded.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='method']/@value
The value must be one of the following:
- INTERVIEW: The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.
- EXAMINE: The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).
- TEST: The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.
is unique for responsible-role: any target value must be unique (i.e., occur only once)
Attribute (1)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this assessment activity elsewhere in this or other OSCAL instances. The locally defined UUID of the activity can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Elements (8)
Description The title for this included activity.
Description A human-readable description of this included activity.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Identifies an individual step in a series of steps related to an activity, such as an assessment test or examination procedure.
Constraint (1)
is unique for responsible-role: any target value must be unique (i.e., occur only once)
Attribute (1)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this step elsewhere in this or other OSCAL instances. The locally defined UUID of the step (in a series of steps) can be used to reference the data item locally or globally
(e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Elements (7)
Description The title for this step.
Description A human-readable description of this step.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Identifies the controls being assessed and their control objectives.
Remarks
In the context of an assessment plan, this construct is used to identify the controls and control objectives that are to be assessed. In the context of an assessment result, this construct is used to identify the actual controls and objectives that were assessed, reflecting any changes from the plan.
When resolving the selection of controls and control objectives, the following processing will occur:
1. Controls will be resolved by creating a set of controls based on the control-selections by first handling the includes, and then removing any excluded controls.
2. The set of control objectives will be resolved from the set of controls that was generated in the previous step. The set of control objectives is based on the control-objective-selection by first handling the includes, and then removing any excluded control objectives.
This can be optionally used to define the set of controls and control objectives that are assessed by this step.
Elements (6)
Description A human-readable description of control objectives.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Identifies the controls being assessed. In the assessment plan, these are the planned controls. In the assessment results, these are the actual controls, and reflects any changes from the plan.
Remarks
The include-all, specifies all control identified in the baseline are included in the scope if this assessment, as specified by the include-profile statement within the linked SSP.
Any control specified within exclude-controls must first be within a range of explicitly included controls, via include-controls or include-all.
Elements (7)
Description A human-readable description of in-scope controls specified for assessment.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
Remarks
Used to select a control for inclusion by the control's identifier. Specific control statements can be selected by their statement identifier.
Attribute (1)
Description A reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Element (1)
Description Used to constrain the selection to only specificity identified statements.
Description Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
Remarks
Used to select a control for exclusion by the control's identifier. Specific control statements can be excluded by their statement identifier.
Attribute (1)
Description A reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Element (1)
Description Used to constrain the selection to only specificity identified statements.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies the control objectives of the assessment. In the assessment plan, these are the planned objectives. In the assessment results, these are the assessed objectives, and reflects any changes from the plan.
Remarks
The include-all field, specifies all control objectives for any in-scope control. In-scope controls
are defined in the control-selection.
Any control objective specified within exclude-controls must first be within a range of explicitly included control objectives, via include-objectives or include-all.
Elements (7)
Description A human-readable description of this collection of control objectives.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
Remarks
Used to select a control objective for inclusion by the control objective's identifier.
Attribute (1)
Description Points to an assessment objective.
Description Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
Remarks
Used to select a control objective for exclusion by the control objective's identifier.
Attribute (1)
Description Points to an assessment objective.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a role with responsibility for performing a function relative to the containing object, optionally associated with a set of persons and/or organizations that perform that role.
Remarks
A responsible-role allows zero or more party-uuid references, each of which creates a relationship arc between the referenced role-id and the referenced party. This differs in semantics from responsible-party, which requires that at least one party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Identifies the roles, and optionally the parties, associated with this step that is part of an assessment activity.
Attribute (1)
Description A human-oriented identifier reference to a role performed.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies the controls being assessed and their control objectives.
Remarks
In the context of an assessment plan, this construct is used to identify the controls and control objectives that are to be assessed. In the context of an assessment result, this construct is used to identify the actual controls and objectives that were assessed, reflecting any changes from the plan.
When resolving the selection of controls and control objectives, the following processing will occur:
1. Controls will be resolved by creating a set of controls based on the control-selections by first handling the includes, and then removing any excluded controls.
2. The set of control objectives will be resolved from the set of controls that was generated in the previous step. The set of control objectives is based on the control-objective-selection by first handling the includes, and then removing any excluded control objectives.
This can be optionally used to define the set of controls and control objectives that are assessed or remediated by this activity.
Elements (6)
Description A human-readable description of control objectives.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Identifies the controls being assessed. In the assessment plan, these are the planned controls. In the assessment results, these are the actual controls, and reflects any changes from the plan.
Remarks
The include-all, specifies all control identified in the baseline are included in the scope if this assessment, as specified by the include-profile statement within the linked SSP.
Any control specified within exclude-controls must first be within a range of explicitly included controls, via include-controls or include-all.
Elements (7)
Description A human-readable description of in-scope controls specified for assessment.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
Remarks
Used to select a control for inclusion by the control's identifier. Specific control statements can be selected by their statement identifier.
Attribute (1)
Description A reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Element (1)
Description Used to constrain the selection to only specificity identified statements.
Description Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
Remarks
Used to select a control for exclusion by the control's identifier. Specific control statements can be excluded by their statement identifier.
Attribute (1)
Description A reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Element (1)
Description Used to constrain the selection to only specificity identified statements.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies the control objectives of the assessment. In the assessment plan, these are the planned objectives. In the assessment results, these are the assessed objectives, and reflects any changes from the plan.
Remarks
The include-all field, specifies all control objectives for any in-scope control. In-scope controls
are defined in the control-selection.
Any control objective specified within exclude-controls must first be within a range of explicitly included control objectives, via include-objectives or include-all.
Elements (7)
Description A human-readable description of this collection of control objectives.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
Remarks
Used to select a control objective for inclusion by the control objective's identifier.
Attribute (1)
Description Points to an assessment objective.
Description Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
Remarks
Used to select a control objective for exclusion by the control objective's identifier.
Attribute (1)
Description Points to an assessment objective.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a role with responsibility for performing a function relative to the containing object, optionally associated with a set of persons and/or organizations that perform that role.
Remarks
A responsible-role allows zero or more party-uuid references, each of which creates a relationship arc between the referenced role-id and the referenced party. This differs in semantics from responsible-party, which requires that at least one party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Since responsible-role associates multiple party-uuid entries with a single role-id, each role-id must be referenced only once.
Attribute (1)
Description A human-oriented identifier reference to a role performed.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Used to define various terms and conditions under which an assessment, described by the plan, can be performed. Each child part defines a different type of term or condition.
Constraint (1)
allowed values for part[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- rules-of-engagement: Defines the circumstances, conditions, degree, and manner in which the use of cyber-attack techniques or actions may be applied to the assessment.
- disclosures: Any information the assessor should make known to the system owner or authorizing official. Has child 'item' parts for each individual disclosure.
- assessment-inclusions: Defines any assessment activities which the system owner or authorizing official wishes to ensure are performed as part of the assessment.
- assessment-exclusions: Defines any assessment activities which the system owner or authorizing official explicitly prohibits from being performed as part of the assessment.
- results-delivery: Defines conditions related to the delivery of the assessment results, such as when to deliver, how, and to whom.
- assumptions: Defines any supposition made by the assessor. Has child 'item' parts for each assumption.
- methodology: An explanation of practices, procedures, and rules used in the course of the assessment.
Element (1)
Description A partition of an assessment plan or results or a child of another part.
Remarks
A part provides for logical partitioning of prose, and can be thought of as a grouping structure
(e.g., section). A part can have child parts allowing for arbitrary nesting of prose content (e.g., statement
hierarchy). A part can contain prop objects that allow for enriching prose text with structured name/value information.
A part can be assigned an optional id, which allows for internal and external references to the textual concept contained
within a part. A id provides a means for an OSCAL profile, or a higher layer OSCAL model to reference
a specific part within a catalog. For example, an id can be used to reference or to make modifications to a control statement in a profile.
Use of part and prop provides for a wide degree of extensibility within the OSCAL catalog model. The optional
ns provides a means to qualify a part's name, allowing for organization-specific vocabularies to be defined with clear semantics.
Any organization that extends OSCAL in this way should consistently assign a ns value that represents the organization, making a given namespace qualified name unique to that organization. This allows the combination of ns and name to always be unique and unambiguous, even when mixed with extensions from other organizations.
Each organization is responsible for governance of their own extensions, and is strongly
encouraged to publish their extensions as standards to their user community. If no
ns is provided, the name is expected to be in the "OSCAL" namespace.
To ensure a ns is unique to an organization and naming conflicts are avoided, a URI containing a
DNS or other globally defined organization name should be used. For example, if FedRAMP
and DoD both extend OSCAL, FedRAMP will use the ns http://fedramp.gov/ns/oscal, while DoD might use the ns https://defense.gov for any organization specific name.
Tools that process OSCAL content are not required to interpret unrecognized OSCAL extensions; however, OSCAL compliant tools should not modify or remove unrecognized extensions, unless there is a compelling reason to do so, such as data sensitivity.
Constraints (3)
allowed value for .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- method: The assessment method to use. This typically appears on parts with the name "objective".
has cardinality for .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and
@name='method'] the cardinality of .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and
@name='method'] is constrained: 1; maximum unbounded.
allowed values for .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and
@name='method']/@value
The value must be one of the following:
- INTERVIEW: The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.
- EXAMINE: The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).
- TEST: The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.
Attributes (4)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this part elsewhere in this or other OSCAL instances. The locally defined UUID of the part can be used to reference the data item locally or globally (e.g., in an ported OSCAL
instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Description A textual label that uniquely identifies the part's semantic type.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- asset: An assessment asset.
- method: An assessment method.
- objective: Describes a set of control objectives.
Description A namespace qualifying the part's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description A textual label that provides a sub-type or characterization of the part's name. This can be used to further distinguish or discriminate between the semantics of
multiple parts of the same control with the same name and ns.
Remarks
A class can be used in validation rules to express extra constraints over named items of
a specific class value.
A class can also be used in an OSCAL profile as a means to target an alteration to control
content.
Elements (4+)
Description A name given to the part, which may be used by a tool for display and navigation.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
This use of the markup-multiline type permits unwrapped block-level markup.
Description A partition of an assessment plan or results or a child of another part.
Remarks
A part provides for logical partitioning of prose, and can be thought of as a grouping structure
(e.g., section). A part can have child parts allowing for arbitrary nesting of prose content (e.g., statement
hierarchy). A part can contain prop objects that allow for enriching prose text with structured name/value information.
A part can be assigned an optional id, which allows for internal and external references to the textual concept contained
within a part. A id provides a means for an OSCAL profile, or a higher layer OSCAL model to reference
a specific part within a catalog. For example, an id can be used to reference or to make modifications to a control statement in a profile.
Use of part and prop provides for a wide degree of extensibility within the OSCAL catalog model. The optional
ns provides a means to qualify a part's name, allowing for organization-specific vocabularies to be defined with clear semantics.
Any organization that extends OSCAL in this way should consistently assign a ns value that represents the organization, making a given namespace qualified name unique to that organization. This allows the combination of ns and name to always be unique and unambiguous, even when mixed with extensions from other organizations.
Each organization is responsible for governance of their own extensions, and is strongly
encouraged to publish their extensions as standards to their user community. If no
ns is provided, the name is expected to be in the "OSCAL" namespace.
To ensure a ns is unique to an organization and naming conflicts are avoided, a URI containing a
DNS or other globally defined organization name should be used. For example, if FedRAMP
and DoD both extend OSCAL, FedRAMP will use the ns http://fedramp.gov/ns/oscal, while DoD might use the ns https://defense.gov for any organization specific name.
Tools that process OSCAL content are not required to interpret unrecognized OSCAL extensions; however, OSCAL compliant tools should not modify or remove unrecognized extensions, unless there is a compelling reason to do so, such as data sensitivity.
Constraints (3)
allowed value for .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- method: The assessment method to use. This typically appears on parts with the name "objective".
has cardinality for .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and
@name='method'] the cardinality of .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and
@name='method'] is constrained: 1; maximum unbounded.
allowed values for .[@name='objective']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and
@name='method']/@value
The value must be one of the following:
- INTERVIEW: The process of holding discussions with individuals or groups of individuals within an organization to once again, facilitate assessor understanding, achieve clarification, or obtain evidence.
- EXAMINE: The process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities).
- TEST: The process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare actual with expected behavior.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Identifies the controls being assessed and their control objectives.
Remarks
In the context of an assessment plan, this construct is used to identify the controls and control objectives that are to be assessed. In the context of an assessment result, this construct is used to identify the actual controls and objectives that were assessed, reflecting any changes from the plan.
When resolving the selection of controls and control objectives, the following processing will occur:
1. Controls will be resolved by creating a set of controls based on the control-selections by first handling the includes, and then removing any excluded controls.
2. The set of control objectives will be resolved from the set of controls that was generated in the previous step. The set of control objectives is based on the control-objective-selection by first handling the includes, and then removing any excluded control objectives.
Elements (6)
Description A human-readable description of control objectives.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Identifies the controls being assessed. In the assessment plan, these are the planned controls. In the assessment results, these are the actual controls, and reflects any changes from the plan.
Remarks
The include-all, specifies all control identified in the baseline are included in the scope if this assessment, as specified by the include-profile statement within the linked SSP.
Any control specified within exclude-controls must first be within a range of explicitly included controls, via include-controls or include-all.
Elements (7)
Description A human-readable description of in-scope controls specified for assessment.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
Remarks
Used to select a control for inclusion by the control's identifier. Specific control statements can be selected by their statement identifier.
Attribute (1)
Description A reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Element (1)
Description Used to constrain the selection to only specificity identified statements.
Description Used to select a control for inclusion/exclusion based on one or more control identifiers. A set of statement identifiers can be used to target the inclusion/exclusion to only specific control statements providing more granularity over the specific statements that are within the asessment scope.
Remarks
Used to select a control for exclusion by the control's identifier. Specific control statements can be excluded by their statement identifier.
Attribute (1)
Description A reference to a control with a corresponding id value. When referencing an externally defined control, the Control Identifier Reference must be used in the context of the external / imported OSCAL instance (e.g., uri-reference).
Element (1)
Description Used to constrain the selection to only specificity identified statements.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies the control objectives of the assessment. In the assessment plan, these are the planned objectives. In the assessment results, these are the assessed objectives, and reflects any changes from the plan.
Remarks
The include-all field, specifies all control objectives for any in-scope control. In-scope controls
are defined in the control-selection.
Any control objective specified within exclude-controls must first be within a range of explicitly included control objectives, via include-objectives or include-all.
Elements (7)
Description A human-readable description of this collection of control objectives.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
Remarks
Used to select a control objective for inclusion by the control objective's identifier.
Attribute (1)
Description Points to an assessment objective.
Description Used to select a control objective for inclusion/exclusion based on the control objective's identifier.
Remarks
Used to select a control objective for exclusion by the control objective's identifier.
Attribute (1)
Description Points to an assessment objective.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.
Remarks
Processing of an include/exclude pair starts with processing the include, then removing matching entries in the exclude.
Attribute (1)
Description Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: The referenced assessment subject is a component defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
- inventory-item: The referenced assessment subject is a inventory item defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
- location: The referenced assessment subject is a location defined in the metadata of the SSP, Assessment Plan, or Assessment Results.
- party: The referenced assessment subject is a person or team to interview, who is defined as a party in the metadata of the SSP, Assessment Plan, or Assessment Results.
- user: The referenced assessment subject is a user defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
Elements (7)
Description A human-readable description of the collection of subjects being included in this assessment.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Identifies a set of assessment subjects to include/exclude by UUID.
Attributes (2)
Description A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Description Used to indicate the type of object pointed to by the uuid-ref within a subject.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: Component
- inventory-item: Inventory Item
- location: Location
- party: Interview Party
- user: User
- resource: Resource or Artifact
Elements (3)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies a set of assessment subjects to include/exclude by UUID.
Attributes (2)
Description A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Description Used to indicate the type of object pointed to by the uuid-ref within a subject.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: Component
- inventory-item: Inventory Item
- location: Location
- party: Interview Party
- user: User
- resource: Resource or Artifact
Elements (3)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies the assets used to perform this assessment, such as the assessment team, scanning tools, and assumptions.
Constraint (1)
is unique for component: any target value must be unique (i.e., occur only once)
Elements (2)
Description A defined component that can be part of an implemented system.
Remarks
Components may be products, services, application programming interface (APIs), policies, processes, plans, guidance, standards, or other tangible items that enable security and/or privacy.
The type indicates which of these component types is represented.
When defining a service component where are relationship to other components is known, one or more link entries with rel values of provided-by and used-by can be used to link to the specific
component identifier(s) that provide and use the service respectively.
Used to add any components for tools used during the assessment. These are represented here to avoid mixing with system components.
The technology tools used by the assessor to perform the assessment, such as vulnerability scanners. In the assessment plan these are the intended tools. In the assessment results, these are the actual tools used, including any differences from the assessment plan.
Constraints (24)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- implementation-point: Relative placement of component ('internal' or 'external') to the system.
- leveraged-authorization-uuid: UUID of the related leveraged-authorization assembly in this SSP.
- inherited-uuid: UUID of the component as it was assigned in the leveraged system's SSP.
- asset-type: Simple indication of the asset's function, such as Router, Storage Array, DNS Server.
- asset-id: An organizationally specific identifier that is used to uniquely identify a logical or tangible item by the organization that owns the item.
- asset-tag: An asset tag assigned by the organization responsible for maintaining the logical or tangible item.
- public: Identifies whether the asset is publicly accessible (yes/no)
- virtual: Identifies whether the asset is virtualized (yes/no)
- vlan-id: Virtual LAN identifier of the asset.
- network-id: The network identifier of the asset.
- label: A human-readable label for the parent context.
- sort-id: An alternative identifier, whose value is easily sortable among other such values in the document.
- baseline-configuration-name: The name of the baseline configuration for the asset.
- allows-authenticated-scan: Can the asset be check with an authenticated scan? (yes/no)
- function: The function provided by the asset for the system.
- version: The version of the component.
- patch-level: The specific patch level of the component.
- model: The model of the component.
- release-date: The date the component was released, such as a software release date or policy publication date.
- validation-type: Used with component-type='validation' to provide a well-known name for a kind of validation.
- validation-reference: Used with component-type='validation' to indicate the validating body's assigned identifier for their validation of this component.
allowed values for link/@rel
The value may be locally defined, or one of the following:
- depends-on: A reference to another component that this component has a dependency on.
- validation: A reference to another component of component-type=validation, that is a validation (e.g., FIPS 140-2) for this component
- proof-of-compliance: A pointer to a validation record (e.g., FIPS 140-2) or other compliance information.
- baseline-template: A reference to the baseline template used to configure the asset.
- uses-service: This service is used by the referenced component identifier.
- system-security-plan: A link to the system security plan of the external system.
- uses-network: This component uses the network provided by the identified network component.
- imported-from: The hyperlink identifies a URI pointing to the component in a component-definition that originally defined the component.
allowed values for responsible-role/@role-id
The value may be locally defined, or one of the following:
- asset-owner: Accountable for ensuring the asset is managed in accordance with organizational policies and procedures.
- asset-administrator: Responsible for administering a set of assets.
- security-operations: Members of the security operations center (SOC).
- network-operations: Members of the network operations center (NOC).
- incident-response: Responsible for responding to an event that could lead to loss of, or disruption to, an organization's operations, services or functions.
- help-desk: Responsible for providing information and support to users.
- configuration-management: Responsible for the configuration management processes governing changes to the asset.
- maintainer: Responsible for the creation and maintenance of a component.
- provider: Organization responsible for providing the component, if this is different from the "maintainer" (e.g., a reseller).
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='asset-type']/@value
The value may be locally defined, or one of the following:
- operating-system: System software that manages computer hardware, software resources, and provides common services for computer programs.
- database: An electronic collection of data, or information, that is specially organized for rapid search and retrieval.
- web-server: A system that delivers content or services to end users over the Internet or an intranet.
- dns-server: A system that resolves domain names to internet protocol (IP) addresses.
- email-server: A computer system that sends and receives electronic mail messages.
- directory-server: A system that stores, organizes and provides access to directory information in order to unify network resources.
- pbx: A private branch exchange (PBX) provides a a private telephone switchboard.
- firewall: A network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
- router: A physical or virtual networking device that forwards data packets between computer networks.
- switch: A physical or virtual networking device that connects devices within a computer network by using packet switching to receive and forward data to the destination device.
- storage-array: A consolidated, block-level data storage capability.
- appliance: A physical or virtual machine that centralizes hardware, software, or services for a specific purpose.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='allows-authenticated-scan']/@value
The value must be one of the following:
- yes: The component allows an authenticated scan.
- no: The component does not allow an authenticated scan.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='public']/@value
The value must be one of the following:
- yes: The component is publicly accessible.
- no: The component is not publicly accessible.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='virtual']/@value
The value must be one of the following:
- yes: The component is virtualized.
- no: The component is not virtualized.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='implementation-point']/@value
The value must be one of the following:
- internal: The component is implemented within the system boundary.
- external: The component is implemented outside the system boundary.
index has key for prop[@name='physical-location']this value must correspond to a listing in the index index-metadata-location-uuid using a key constructed of key field(s) @value
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='inherited-uuid']/@value: the target value must match the lexical form of the 'uuid' data type.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='release-date']/@value: the target value must match the lexical form of the 'date' data type.
allowed value for (.)[@type=('software', 'hardware', 'service')]/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- vendor-name: The name of the company or organization
allowed value for (.)[@type='validation']/link/@rel
The value may be locally defined, or the following:
- validation-details: A link to an online information provided by the authorizing body.
allowed value for (.)[@type='software']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- software-identifier: If a "software" component-type, the identifier, such as a SWID tag, for the software component.
allowed values for (.)[@type='service']/link/@rel
The value may be locally defined, or one of the following:
- provided-by: This service is provided by the referenced component identifier.
- used-by: This service is used by the referenced component identifier.
allowed values for (.)[@type='interconnection']/prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- isa-title: Title of the Interconnection Security Agreement (ISA).
- isa-date: Date of the Interconnection Security Agreement (ISA).
- isa-remote-system-name: The name of the remote interconnected system.
- ipv4-address: An Internet Protocol Version 4 interconnection address
- ipv6-address: An Internet Protocol Version 6 interconnection address
- direction: An Internet Protocol Version 6 interconnection address
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name=('ipv4-address','ipv6-address')]/@class
The value must be one of the following:
- local: The identified IP address is for this system.
- remote: The identified IP address is for the remote system to which this system is connected.
allowed value for (.)[@type='interconnection']/link/@rel
The value may be locally defined, or the following:
- isa-agreement: A link to the system interconnection agreement.
allowed values for (.)[@type='interconnection']/responsible-role/@role-id
The value may be locally defined, or one of the following:
- isa-poc-local: Interconnection Security Agreement (ISA) point of contact (POC) for this system.
- isa-poc-remote: Interconnection Security Agreement (ISA) point of contact (POC) for the remote interconnected system.
- isa-authorizing-official-local: Interconnection Security Agreement (ISA) authorizing official for this system.
- isa-authorizing-official-remote: Interconnection Security Agreement (ISA) authorizing official for the remote interconnected system.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='isa-date']/@value: the target value must match the lexical form of the 'dateTime' data type.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='ipv4-address']/@value: the target value must match the lexical form of the 'ip-v4-address' data type.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='ipv6-address']/@value: the target value must match the lexical form of the 'ip-v6-address' data type.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='direction']/@value
The value must be one of the following:
- incoming: Data from the remote system flows into this system.
- outgoing: Data from this system flows to the remote system.
is unique for responsible-role: any target value must be unique (i.e., occur only once)
Attributes (2)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this component elsewhere in this or other OSCAL instances. The locally defined UUID of the component can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Description A category describing the purpose of the component.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- this-system: The system as a whole.
- system: An external system, which may be a leveraged system or the other side of an interconnection.
- interconnection: A connection to something outside this system.
- software: Any software, operating system, or firmware.
- hardware: A physical device.
- service: A service that may provide APIs.
- policy: An enforceable policy.
- physical: A tangible asset used to provide physical protections or countermeasures.
- process-procedure: A list of steps or actions to take to achieve some end result.
- plan: An applicable plan.
- guidance: Any guideline or recommendation.
- standard: Any organizational or industry standard.
- validation: An external assessment performed on some other component, that has been validated by a third-party.
- network: A physical or virtual network.
Elements (9)
Description A human readable name for the system component.
Description A description of the component, including information about its function.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A summary of the technological or business purpose of the component.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Describes the operational status of the system component.
Attribute (1)
Description The operational status.
Constraint (1)
allowed values
The value must be one of the following:
- under-development: The component is being designed, developed, or implemented.
- operational: The component is currently operational and is available for use in the system.
- disposition: The component is no longer operational.
- other: Some other state.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a role with responsibility for performing a function relative to the containing object, optionally associated with a set of persons and/or organizations that perform that role.
Remarks
A responsible-role allows zero or more party-uuid references, each of which creates a relationship arc between the referenced role-id and the referenced party. This differs in semantics from responsible-party, which requires that at least one party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Attribute (1)
Description A human-oriented identifier reference to a role performed.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Information about the protocol used to provide a service.
Remarks
Used for service components to define the protocols supported by the service.
Attributes (2)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this service protocol information elsewhere in
this or other OSCAL instances. The locally defined UUID of the service protocol can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Description The common name of the protocol, which should be the appropriate "service name" from the IANA Service Name and Transport Protocol Port Number Registry.
Remarks
The short name of the protocol (e.g., https).
Elements (2)
Description A human readable name for the protocol (e.g., Transport Layer Security).
Description Where applicable this is the IPv4 port range on which the service operates.
Remarks
To be validated as a natural number (integer >= 1). A single port uses the same value for start and end. Use multiple 'port-range' entries for non-contiguous ranges.
Attributes (3)
Description Indicates the starting port number in a port range
Remarks
Should be a number within a permitted range
Description Indicates the ending port number in a port range
Remarks
Should be a number within a permitted range
Description Indicates the transport type.
Constraint (1)
allowed values
The value must be one of the following:
- TCP: Transmission Control Protocol
- UDP: User Datagram Protocol
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Used to represent the toolset used to perform aspects of the assessment.
Attribute (1)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this assessment platform elsewhere in this or
other OSCAL instances. The locally defined UUID of the assessment platform can be used to reference the data item locally or globally (e.g., in an imported OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Elements (5)
Description The title or name for the assessment platform.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description The set of components that are used by the assessment platform.
Constraint (1)
is unique for responsible-party: any target value must be unique (i.e., occur only once)
Attribute (1)
Description A machine-oriented identifier reference to a component that is implemented as part of an inventory item.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description A reference to a set of persons and/or organizations that have responsibility for performing the referenced role in the context of the containing object.
Remarks
A responsible-party requires one or more party-uuid references creating a strong relationship arc between the referenced role-id and the reference parties. This differs in semantics from responsible-role which doesn't require that a party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-role-id using a key constructed of key field(s) @role-id
Attribute (1)
Description A reference to a role performed by a party.
Elements (4)
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Represents a scheduled event or milestone, which may be associated with a series of assessment actions.
Attributes (2)
Description A machine-oriented, globally unique identifier with cross-instance scope that can be used to reference this task elsewhere in this or other OSCAL instances. The locally defined UUID of the task can be used to reference the data item locally or globally (e.g., in an imported
OSCAL instance). This UUID should be assigned per-subject, which means it should be consistently used to identify the same subject across revisions
of the document.
Description The type of task.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- milestone: The task represents a planned milestone.
- action: The task represents a specific assessment action to be performed.
Elements (11)
Description The title for this task.
Description A human-readable description of this task.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description The timing under which the task is intended to occur.
Elements (3)
A choice:
Description The task is intended to occur on the specified date.
Attribute (1)
Description The task must occur on the specified date.
Description The task is intended to occur within the specified date range.
Attributes (2)
Description The task must occur on or after the specified date.
Description The task must occur on or before the specified date.
Description The task is intended to occur at the specified frequency.
Attributes (2)
Description The task must occur after the specified period has elapsed.
Description The unit of time for the period.
Constraint (1)
allowed values
The value must be one of the following:
- seconds: The period is specified in seconds.
- minutes: The period is specified in minutes.
- hours: The period is specified in hours.
- days: The period is specified in days.
- months: The period is specified in calendar months.
- years: The period is specified in calendar years.
Description Used to indicate that a task is dependent on another task.
Attribute (1)
Description A machine-oriented identifier reference to a unique task.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Represents a scheduled event or milestone, which may be associated with a series of assessment actions.
Description Identifies an individual activity to be performed as part of a task.
Constraint (1)
is unique for responsible-role: any target value must be unique (i.e., occur only once)
Attribute (1)
Description A machine-oriented identifier reference to an activity defined in the list of activities.
Elements (5)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description A reference to a role with responsibility for performing a function relative to the containing object, optionally associated with a set of persons and/or organizations that perform that role.
Remarks
A responsible-role allows zero or more party-uuid references, each of which creates a relationship arc between the referenced role-id and the referenced party. This differs in semantics from responsible-party, which requires that at least one party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Identifies the person or organization responsible for performing a specific role defined by the activity.
Attribute (1)
Description A human-oriented identifier reference to a role performed.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.
Remarks
Processing of an include/exclude pair starts with processing the include, then removing matching entries in the exclude.
Attribute (1)
Description Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: The referenced assessment subject is a component defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
- inventory-item: The referenced assessment subject is a inventory item defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
- location: The referenced assessment subject is a location defined in the metadata of the SSP, Assessment Plan, or Assessment Results.
- party: The referenced assessment subject is a person or team to interview, who is defined as a party in the metadata of the SSP, Assessment Plan, or Assessment Results.
- user: The referenced assessment subject is a user defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
Elements (7)
Description A human-readable description of the collection of subjects being included in this assessment.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Identifies a set of assessment subjects to include/exclude by UUID.
Attributes (2)
Description A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Description Used to indicate the type of object pointed to by the uuid-ref within a subject.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: Component
- inventory-item: Inventory Item
- location: Location
- party: Interview Party
- user: User
- resource: Resource or Artifact
Elements (3)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies a set of assessment subjects to include/exclude by UUID.
Attributes (2)
Description A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Description Used to indicate the type of object pointed to by the uuid-ref within a subject.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: Component
- inventory-item: Inventory Item
- location: Location
- party: Interview Party
- user: User
- resource: Resource or Artifact
Elements (3)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies system elements being assessed, such as components, inventory items, and locations. In the assessment plan, this identifies a planned assessment subject. In the assessment results this is an actual assessment subject, and reflects any changes from the plan. exactly what will be the focus of this assessment. Any subjects not identified in this way are out-of-scope.
Remarks
Processing of an include/exclude pair starts with processing the include, then removing matching entries in the exclude.
The assessment subjects that the activity was performed against.
Attribute (1)
Description Indicates the type of assessment subject, such as a component, inventory, item, location, or party represented by this selection statement.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: The referenced assessment subject is a component defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
- inventory-item: The referenced assessment subject is a inventory item defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
- location: The referenced assessment subject is a location defined in the metadata of the SSP, Assessment Plan, or Assessment Results.
- party: The referenced assessment subject is a person or team to interview, who is defined as a party in the metadata of the SSP, Assessment Plan, or Assessment Results.
- user: The referenced assessment subject is a user defined in the SSP, or in the local-definitions of an Assessment Plan or Assessment Results.
Elements (7)
Description A human-readable description of the collection of subjects being included in this assessment.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
A choice:
Description Include all controls from the imported catalog or profile resources.
Remarks
This element provides an alternative to calling controls individually from a catalog.
Description Identifies a set of assessment subjects to include/exclude by UUID.
Attributes (2)
Description A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Description Used to indicate the type of object pointed to by the uuid-ref within a subject.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: Component
- inventory-item: Inventory Item
- location: Location
- party: Interview Party
- user: User
- resource: Resource or Artifact
Elements (3)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Identifies a set of assessment subjects to include/exclude by UUID.
Attributes (2)
Description A machine-oriented identifier reference to a component, inventory-item, location, party, user, or resource using it's UUID.
Description Used to indicate the type of object pointed to by the uuid-ref within a subject.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- component: Component
- inventory-item: Inventory Item
- location: Location
- party: Interview Party
- user: User
- resource: Resource or Artifact
Elements (3)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a role with responsibility for performing a function relative to the containing object, optionally associated with a set of persons and/or organizations that perform that role.
Remarks
A responsible-role allows zero or more party-uuid references, each of which creates a relationship arc between the referenced role-id and the referenced party. This differs in semantics from responsible-party, which requires that at least one party-uuid is referenced.
The scope of use of this object determines if the responsibility has been performed or will be performed in the future. The containing object will describe the intent.
Identifies the person or organization responsible for performing a specific role related to the task.
Attribute (1)
Description A human-oriented identifier reference to a role performed.
Elements (4)
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description Reference to a party by UUID.
Constraint (1)
index has keythis value must correspond to a listing in the index index-metadata-party-uuid using a key constructed of key field(s) .
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A collection of resources that may be referenced from within the OSCAL document instance.
Remarks
Provides a collection of identified resource objects that can be referenced by a link with a rel value of "reference" and an href value that is a fragment "#" followed by a reference to a reference's uuid. Other specialized link "rel" values also use this pattern when indicated in that
context of use.
Constraint (1)
index for resource an index index-back-matter-resource shall list values returned by targets resource using keys constructed of key field(s) @uuid
Element (1)
Description A resource associated with content in the containing document instance. A resource may be directly included in the document using base64 encoding or may point to one or more equivalent internet resources.
Remarks
A resource can be used in two ways. 1) it may point to an specific retrievable network
resource using a rlink, or 2) it may be included as an attachment using a base64. A resource may contain multiple rlink and base64 entries that represent alternative download locations (rlink) and attachments (base64)
for the same resource.
Both rlink and base64 allow for a media-type to be specified, which is used to distinguish between different representations of
the same resource (e.g., Microsoft Word, PDF). When multiple rlink and base64 items are included for a given resource, all items must contain equivalent information.
This allows the document consumer to choose a preferred item to process based on a
the selected item's media-type. This is extremely important when the items represent OSCAL content that is represented
in alternate formats (i.e., XML, JSON, YAML), allowing the same OSCAL data to be processed
from any of the available formats indicated by the items.
When a resource includes a citation, then the title and citation properties must both be included.
Constraints (6)
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- type: Identifies the type of resource represented. The most specific appropriate type value SHOULD be used.
- version: For resources representing a published document, this represents the version number of that document.
- published: For resources representing a published document, this represents the publication date of that document.
matches for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='published']/@value: the target value must match the lexical form of the 'dateTime-with-timezone' data
type.
allowed values for prop[has-oscal-namespace('http://csrc.nist.gov/ns/oscal') and @name='type']/@value
The value must be one of the following:
- logo: Indicates the resource is an organization's logo.
- image: Indicates the resource represents an image.
- screen-shot: Indicates the resource represents an image of screen content.
- law: Indicates the resource represents an applicable law.
- regulation: Indicates the resource represents an applicable regulation.
- standard: Indicates the resource represents an applicable standard.
- external-guidance: Indicates the resource represents applicable guidance.
- acronyms: Indicates the resource provides a list of relevant acronyms.
- citation: Indicates the resource cites relevant information.
- policy: Indicates the resource is a policy.
- procedure: Indicates the resource is a procedure.
- system-guide: Indicates the resource is guidance document related to the subject system of an SSP.
- users-guide: Indicates the resource is guidance document a user's guide or administrator's guide.
- administrators-guide: Indicates the resource is guidance document a administrator's guide.
- rules-of-behavior: Indicates the resource represents rules of behavior content.
- plan: Indicates the resource represents a plan.
- artifact: Indicates the resource represents an artifact, such as may be reviewed by an assessor.
- evidence: Indicates the resource represents evidence, such as to support an assessment finding.
- tool-output: Indicates the resource represents output from a tool.
- raw-data: Indicates the resource represents machine data, which may require a tool or analysis for interpretation or presentation.
- interview-notes: Indicates the resource represents notes from an interview, such as may be collected during an assessment.
- questionnaire: Indicates the resource is a set of questions, possibly with responses.
- report: Indicates the resource is a report.
- agreement: Indicates the resource is a formal agreement between two or more parties.
has cardinality for rlink|base64 the cardinality of rlink|base64 is constrained: 1; maximum unbounded.
is unique for rlink: any target value must be unique (i.e., occur only once)
is unique for base64: any target value must be unique (i.e., occur only once)
Attribute (1)
Description A unique identifier for a resource.
Elements (8)
Description An optional name given to the resource, which may be used by a tool for display and navigation.
Description An optional short summary of the resource used to indicate the purpose of the resource.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A document identifier qualified by an identifier scheme.
Remarks
A document identifier provides a globally unique identifier with a cross-instance scope that is used for a group of documents that are to be treated as different versions, representations or digital surrogates of the same document.
A document identifier provides an additional data point for identifying a document that can be assigned by a publisher or organization for purposes in a wider system, such as a digital object identifier (DOI) or a local content management system identifier.
Use of a document identifier allows for document creators to associate sets of documents
that are related in some way by the same document-id.
An OSCAL document always has an implicit document identifier provided by the document's
UUID, defined by the uuid on the top-level object. Having a default UUID-based identifier ensures all documents
can be minimally identified when other document identifiers are not provided.
Attribute (1)
Description Qualifies the kind of document identifier using a URI. If the scheme is not provided the value of the element will be interpreted as a string of characters.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- http://www.doi.org/: A Digital Object Identifier (DOI); use is preferred, since this allows for retrieval of a full bibliographic record.
Description An optional citation consisting of end note text using structured markup.
Elements (3)
Description A line of citation text.
Description An attribute, characteristic, or quality of the containing object expressed as a namespace qualified name/value pair.
Remarks
Properties permit the deployment and management of arbitrary controlled values, within OSCAL objects. A property can be included for any purpose useful to an application or implementation. Typically, properties will be used to sort, filter, select, order, and arrange OSCAL content objects, to relate OSCAL objects to one another, or to associate an OSCAL object to class hierarchies, taxonomies, or external authorities. Thus, the lexical composition of properties may be constrained by external processes to ensure consistency.
Property allows for associated remarks that describe why the specific property value was applied to the containing object, or the significance of the value in the context of the containing object.
Constraint (1)
allowed value for .[has-oscal-namespace('http://csrc.nist.gov/ns/oscal')]/@name
The value must be one of the following:
- marking: A label or descriptor that is tied to a sensitivity or classification marking system. An optional class can be used to define the specific marking system used for the associated value.
Attributes (6)
Description A textual label, within a namespace, that identifies a specific attribute, characteristic, or quality of the property's containing object.
Description A unique identifier for a property.
Description A namespace qualifying the property's name. This allows different organizations to associate distinct semantics with the same name.
Remarks
This value must be an absolute URI that serves as a naming system identifier.
When a ns is not provided, its value should be assumed to be http://csrc.nist.gov/ns/oscal and the name should be a name defined by the associated OSCAL model.
Description Indicates the value of the attribute, characteristic, or quality.
Description A textual label that provides a sub-type or characterization of the property's name.
Remarks
This can be used to further distinguish or discriminate between the semantics of multiple
properties of the same object with the same name and ns, or to group properties into categories.
A class can be used in validation rules to express extra constraints over named items of
a specific class value. It is available for grouping, but unlike group is not expected specifically to designate any group membership as such.
Description An identifier for relating distinct sets of properties.
Remarks
Different sets of properties may relate to separate contexts. Declare a group on a property to associate it with one or more other properties in a given context.
Element (1)
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.
Description A reference to a local or remote resource, that has a specific relation to the containing object.
Remarks
To provide a cryptographic hash for a remote target resource, a local reference to
a back matter resource is needed. The resource allows one or more hash values to be provided using the rlink/hash object.
The OSCAL link is a roughly based on the HTML link element.
Constraints (4)
matches for .[@rel=('reference') and starts-with(@href,'#')]/@href: the target value must match the lexical form of the 'uri-reference' data type.
index has key for .[@rel=('reference') and starts-with(@href,'#')]this value must correspond to a listing in the index index-back-matter-resource using a key constructed of key field(s) @href
matches for .[@rel=('reference') and not(starts-with(@href,'#'))]/@href: the target value must match the lexical form of the 'uri' data type.
matches for @resource-fragment: a target (value) must match the regular expression '(?:[0-9a-zA-Z-._~/?!$&'()*+,;=:@]|%[0-9A-F][0-9A-F])+'.
Attributes (4)
Description A resolvable URL reference to a resource.
Remarks
This value may be one of:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
- a bare URI fragment (i.e., `#uuid`) pointing to an OSCAL object by the objects identifier (e.g., id, uuid) in this or an imported document (see linking to another OSCAL object). The specific object type will differ based on the link relationship type.
Description Describes the type of relationship provided by the link's hypertext reference. This can be an indicator of the link's purpose.
Constraint (1)
allowed value
The value may be locally defined, or the following:
- reference: A generalized reference to a network resource (relative or absolute) or to a back-matter resource by UUID expressed as a bare URI fragment.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
The media-type provides a hint about the content model of the referenced resource. A valid entry
from the IANA Media Types registry SHOULD be used.
Description In case where the href points to a back-matter/resource, this value will indicate the URI fragment to append to any rlink associated with the resource. This value MUST be URI encoded.
Element (1)
Description A textual label to associate with the link, which may be used for presentation in a tool.
Description A URL-based pointer to an external resource with an optional hash for verification and change detection.
Remarks
Multiple rlink objects can be included for a resource. In such a case, all provided rlink items are intended to be equivalent in content, but may differ in structure or format.
A media-type is used to identify the format of a given rlink, and can be used to differentiate
items in a collection of rlinks. The media-type provides a hint to the OSCAL document consumer about the structure of the resource
referenced by the rlink.
Attributes (2)
Description A resolvable URL pointing to the referenced resource.
Remarks
This value may be either:
- an absolute URI that points to a network resolvable resource,
- a relative reference pointing to a network resolvable resource whose base URI is the URI of the containing document, or
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
Element (1)
Description A representation of a cryptographic digest generated over a resource using a specified hash algorithm.
Remarks
The hash value can be used to confirm that the resource referenced by the href is the same resources that was hashed by retrieving the resource, calculating a hash,
and comparing the result to this value.
Constraints (4)
matches for .[@algorithm=('SHA-224','SHA3-224')]: a target (value) must match the regular expression '^[0-9a-fA-F]{28}$'.
matches for .[@algorithm=('SHA-256','SHA3-256')]: a target (value) must match the regular expression '^[0-9a-fA-F]{32}$'.
matches for .[@algorithm=('SHA-384','SHA3-384')]: a target (value) must match the regular expression '^[0-9a-fA-F]{48}$'.
matches for .[@algorithm=('SHA-512','SHA3-512')]: a target (value) must match the regular expression '^[0-9a-fA-F]{64}$'.
Attribute (1)
Description The digest method by which a hash is derived.
Remarks
Any other value used MUST be a value defined in the W3C XML Security Algorithm Cross-Reference Digest Methods (W3C, April 2013) or RFC 6931 Section 2.1.5 New SHA Functions.
Constraint (1)
allowed values
The value may be locally defined, or one of the following:
- SHA-224: The SHA-224 algorithm as defined by NIST FIPS 180-4.
- SHA-256: The SHA-256 algorithm as defined by NIST FIPS 180-4.
- SHA-384: The SHA-384 algorithm as defined by NIST FIPS 180-4.
- SHA-512: The SHA-512 algorithm as defined by NIST FIPS 180-4.
- SHA3-224: The SHA3-224 algorithm as defined by NIST FIPS 202.
- SHA3-256: The SHA3-256 algorithm as defined by NIST FIPS 202.
- SHA3-384: The SHA3-384 algorithm as defined by NIST FIPS 202.
- SHA3-512: The SHA3-512 algorithm as defined by NIST FIPS 202.
Description A resource encoded using the Base64 alphabet defined by RFC 2045.
Attributes (2)
Description Name of the file before it was encoded as Base64 to be embedded in a resource. This is the name that will be assigned to the file when the file is decoded.
Description A label that indicates the nature of a resource, as a data serialization or format.
Remarks
The Internet Assigned Numbers Authority (IANA) Media Types Registry defines a standardized set of media types, which may be used here.
The application/oscal+xml, application/oscal+json or application/oscal+yaml media types SHOULD be used when referencing OSCAL XML, JSON, or YAML resources respectively.
**Note: There is no official media type for YAML at this time.** OSCAL documents should
specify application/yaml for general YAML content, or application/oscal+yaml for YAML-based OSCAL content. This approach aligns with use of a structured name
suffix, per RFC 6838 Section 4.2.8.
Some earlier OSCAL content incorporated the model into the media type. For example:
application/oscal.catalog+xml. This practice SHOULD be avoided, since the OSCAL model can be detected by parsing
the initial content of the referenced resource.
Description Additional commentary about the containing object.
Remarks
The remarks field SHOULD not be used to store arbitrary data. Instead, a prop or link should be used to annotate or reference any additional data not formally supported
by OSCAL.
Element (0+)
This use of the markup-multiline type permits unwrapped block-level markup.