NIST 800-53 Rev 5 to AWS Service Mapping (Luigi Carpio)

NIST 800-53 Rev 5 to AWS Service Mapping (Luigi Carpio)

tests/data/luigi_carpio/ holds one OSCAL component definition, component-definition.json, with its README and its licence. NOTICE says that the component definition is by Luigi Carpio, licensed under the MIT License, whose text is tests/data/luigi_carpio/LICENSE.txt.¹ The file’s metadata gives the title “NIST 800-53 Rev 5 to AWS Service Mapping”, the version 0.6.0 and oscal-version 1.1.2, while the schema renders OSCAL 1.2.3.²

The fixture’s README says that it maps NIST 800-53 Rev 5 security controls to AWS services that support their implementation, with FedRAMP High baseline filtering and a CJIS v6.0 delta section.³ Its table lists 31 controls, from AC-2 Account Management to SI-7 Software/Firmware Integrity. It names 5 controls where CJIS exceeds FedRAMP High: quarterly account reviews (AC-2), phishing-resistant AAL2 MFA (IA-2), 1-year audit log retention with weekly review (AU-6), agency-managed encryption keys (SC-28), and incident reporting to the CSO/FBI CJIS Division (IR-6). The README also describes a generator script and an output folder, which the copy in this repository does not hold.

How it is checked

The test-luigi-carpio recipe in project.justfile, which just test runs, rewrites the file’s keys with underscores, builds the generated ComponentDefinitionDocument from it, and checks:⁴

• that metadata.last_modified is a date and time with a time zone;
• that the file keeps OSCAL’s hyphenated top-level key, component-definition;
• that every implemented requirement carries a fedramp-high property whose value is true;
• that at least one implemented requirement carries a cjis-delta property;
• that the file holds at least one component.

It also checks every UUID field against a pattern for version 4 and version 5 UUIDs. A UUID that fails is a warning by default, and just test-luigi-carpio-strict, which sets OSCAL_STRICT_UUID=1, makes it a failure. See Test data and schema tests.

Footnotes

1. NOTICE, the Test fixtures section ↩

2. tests/data/luigi_carpio/component-definition.json, the metadata ↩

3. tests/data/luigi_carpio/README.md, the opening paragraph, Compliance Controls Addressed and CJIS v6.0 Relevance ↩

4. project.justfile, test-luigi-carpio and test-luigi-carpio-strict ↩