OSCAL Assessment Plan Schema

OSCAL Assessment Plan Schema

src/oscal/schema/oscal_assessment_plan.yaml is the module titled “OSCAL Assessment Plan Model”, with the id https://w3id.org/lmodel/oscal/oscal_assessment_plan.¹ Its version is 1.2.3, its license Apache-2.0, and its source is NIST’s JSON schema of the model, http://csrc.nist.gov/ns/oscal/1.2.3/oscal-ap-schema.json. It imports linkml:types and the catalog module. Its see_also names NIST’s page on the assessment plan, https://pages.nist.gov/OSCAL/learn/concepts/layer/assessment/assessment-plan/.

The README describes the assessment plan and the assessment results together as what an assessment covers, and what it observed and found.² AssessmentPlan is “An assessment plan, such as those provided by a FedRAMP assessor”. It requires uuid, metadata, import-ssp and reviewed-controls, and also holds local-definitions, terms-and-conditions, assessment-subjects, assessment-assets, tasks and back-matter. AssessmentPlanDocument wraps one plan as the root of an assessment plan document.

The classes other modules share

The module defines three subsets:

• assessment_plan: the root document and its direct containers, local definitions and terms and conditions;
• assessment_common: the classes of OSCAL’s assessment-common namespace, such as subjects, assets, activities, tasks, findings, observations and risks;
• implementation_common: the classes of OSCAL’s implementation-common namespace, such as system components, protocols, inventory items, users and set-parameter.

So the component definition, system security plan, assessment results and POA&M modules import this module beside the catalog module. It also defines the types NonNegativeIntegerType and PositiveIntegerType.

Footnotes

1. src/oscal/schema/oscal_assessment_plan.yaml, the header, the subsets, the types, AssessmentPlan and AssessmentPlanDocument ↩

2. README.md, the What it models section ↩