| Role |
Defines a function, which might be assigned to a party in a specific situatio... |
no |
| Resource |
A resource associated with content in the containing document instance |
yes |
| ParameterConstraint |
A formal or informal expression of a constraint or test |
yes |
| ReviewedControls |
Identifies the controls being assessed and their control objectives |
no |
| ControlSelection |
Identifies the controls being assessed |
no |
| ControlObjectiveSelection |
Identifies the control objectives of the assessment |
no |
| AssessmentSubject |
Identifies system elements being assessed, such as components, inventory item... |
no |
| AssessmentSubjectPlaceholder |
Used when the assessment subjects will be determined as part of one or more o... |
no |
| LocalObjective |
A local definition of a control objective for this assessment |
no |
| AssessmentMethod |
A local definition of a control objective |
no |
| Activity |
Identifies an assessment or related process that can be performed |
yes |
| Step |
Identifies an individual step in a series of steps related to an activity, su... |
yes |
| Task |
Represents a scheduled event or milestone, which may be associated with a ser... |
no |
| SystemComponent |
A defined component that can be part of an implemented system |
yes |
| SystemUser |
A type of user that interacts with the system based on an associated role |
no |
| AuthorizedPrivilege |
Identifies a specific system privilege held by the user, along with an associ... |
no |
| InventoryItem |
A single managed inventory item within the system |
yes |
| Observation |
Describes an individual observation |
yes |
| RelevantEvidence |
Links this observation to relevant evidence |
yes |
| Finding |
Describes an individual finding |
yes |
| FindingTarget |
Captures an assessor's conclusions regarding the degree to which an objective... |
no |
| Risk |
An identified risk |
yes |
| MitigatingFactor |
Describes an existing mitigating factor that may affect the overall determina... |
yes |
| Response |
Describes either recommended or an actual plan for addressing the risk |
yes |
| RequiredAsset |
Identifies an asset required to achieve remediation |
yes |
| RiskLogEntry |
Identifies an individual risk response that occurred as part of managing an i... |
no |
| SystemCharacteristics |
Contains the characteristics of the system, such as its name, purpose, and se... |
yes |
| InformationType |
Contains details about one information type that is stored, processed, or tra... |
yes |
| AuthorizationBoundary |
A description of this system's authorization boundary, optionally supplemente... |
yes |
| Diagram |
A graphic that provides a visual representation the system, or some aspect of... |
no |
| NetworkArchitecture |
A description of the system's network architecture, optionally supplemented w... |
yes |
| DataFlow |
A description of the logical flow of information within the system and across... |
yes |
| SspControlImplementation |
Describes how the system satisfies a set of controls |
yes |
| ByComponent |
Defines how the referenced component implements a set of controls |
yes |
| Export |
Defines a set of control implementations that are provided as reference imple... |
no |
| ProvidedControlImplementation |
Describes a capability which may be inherited by a leveraging system |
yes |
| ControlResponsibility |
Describes a control implementation responsibility imposed on a leveraging sys... |
yes |
| InheritedControlImplementation |
Describes a control implementation inherited by a leveraging system |
yes |
| SatisfiedControlImplementation |
Describes how this system satisfies a responsibility imposed by a leveraged s... |
yes |
| Result |
Identifies all of the assessment observations and findings, initial and resid... |
yes |
| AssessmentLogEntry |
Identifies the result of an action and/or task that occurred as part of execu... |
no |
| DefinedComponent |
A defined component that can be part of an implemented system |
yes |
| Capability |
A grouping of other components and/or capabilities |
yes |
| IncorporatesComponent |
The collection of components comprising a capability |
yes |
| ControlImplementationSet |
Defines how the component or capability supports a set of controls |
yes |
| ImplementedRequirement |
Describes how the containing component or capability implements an individual... |
yes |
| ImplementedControlStatement |
Identifies which statements within a control are addressed |
yes |
| QualifierItem |
A qualifier describing requirements or incompatibilities |
yes |
| PoamItem |
Describes an individual POA&M item |
yes |
| SspSystemComponent |
SSP-scoped system component with allows-authenticated-scan property typing |
no |
| SspInventoryItem |
SSP-scoped inventory item with allows-authenticated-scan property typing |
no |