| Group |
A group of controls, or of groups of controls |
yes |
| Control |
A structured object representing a requirement or guideline, which when imple... |
yes |
| Metadata |
Provides information about the containing document, and defines concepts shar... |
yes |
| Revision |
An entry in a sequential list of revisions to the containing document |
no |
| Role |
Defines a function, which might be assigned to a party in a specific situatio... |
yes |
| Location |
A physical point of presence, which may be associated with people, organizati... |
no |
| Resource |
A resource associated with content in the containing document instance |
yes |
| Part |
An annotated, markup-based textual element of a control's or catalog group's ... |
yes |
| ProfileGroup |
A group of (selected) controls or of groups of controls within a profile cust... |
yes |
| Addition |
Specifies content to be added into controls in resolution |
no |
| SubjectReference |
A human-oriented identifier reference to a resource |
no |
| AssessmentPlatform |
Used to represent the toolset used to perform aspects of the assessment |
no |
| Activity |
Identifies an assessment or related process that can be performed |
no |
| Step |
Identifies an individual step in a series of steps related to an activity, su... |
no |
| Task |
Represents a scheduled event or milestone, which may be associated with a ser... |
yes |
| AssessmentPart |
A partition of an assessment plan or results or a child of another part |
no |
| ControlPart |
An annotated, markup-based textual element of a control's or catalog group's ... |
no |
| SystemComponent |
A defined component that can be part of an implemented system |
yes |
| Protocol |
Information about the protocol used to provide a service |
no |
| SystemUser |
A type of user that interacts with the system based on an associated role |
no |
| AuthorizedPrivilege |
Identifies a specific system privilege held by the user, along with an associ... |
yes |
| Observation |
Describes an individual observation |
no |
| Finding |
Describes an individual finding |
yes |
| FindingTarget |
Captures an assessor's conclusions regarding the degree to which an objective... |
no |
| Risk |
An identified risk |
yes |
| Response |
Describes either recommended or an actual plan for addressing the risk |
yes |
| RequiredAsset |
Identifies an asset required to achieve remediation |
no |
| RiskLogEntry |
Identifies an individual risk response that occurred as part of managing an i... |
no |
| InformationType |
Contains details about one information type that is stored, processed, or tra... |
yes |
| LeveragedAuthorization |
A description of another authorized system from which this system inherits ca... |
yes |
| Result |
Identifies all of the assessment observations and findings, initial and resid... |
yes |
| AssessmentLogEntry |
Identifies the result of an action and/or task that occurred as part of execu... |
no |
| DefinedComponent |
A defined component that can be part of an implemented system |
yes |
| PoamItem |
Describes an individual POA&M item |
yes |
| TermsAndConditionsPart |
A terms-and-conditions scoped assessment part |
no |
| SspSystemComponent |
SSP-scoped system component with allows-authenticated-scan property typing |
no |